How the second approach usually arrives
- An unsolicited message on Telegram, WhatsApp, Instagram or a comment reply under a post where you described your loss.
- A caller who already knows accurate details about your case, which feels like proof of legitimacy but usually means your details were resold.
- A profile presenting as a law-enforcement officer, regulator or exchange compliance officer, using an email address on a free or lookalike domain.
- A website built recently, with stock imagery, no registered address and no named people.
The claims that should stop the conversation
Certain promises are simply not technically possible, so anyone making them is either mistaken or deliberately misleading you.
- That a confirmed on-chain transaction can be reversed, cancelled or clawed back. It cannot.
- That an individual can be named from an address alone, without any off-chain disclosure.
- That funds can be released once you pay a fee, tax, gas top-up, unlock charge or insurance deposit.
- That a specific sum will definitely be returned, or that a timescale for return can be guaranteed.
- Any request for your seed phrase, private key, exchange password or one-time codes.
Why the fee is always framed as almost over
The structure of the second approach is designed to make each payment feel like the last one. You are told the funds are located and frozen, and that only a small procedural cost stands between you and their release. Once paid, a new obstacle appears: a conversion fee, a compliance charge, a wallet activation cost. Each is small relative to the sum supposedly waiting, which is precisely the point.
The tell is not the size of the fee but the sequence. Legitimate investigative work is scoped and priced before it begins, in writing, and the price does not change because of what the work finds.
Checks that take five minutes
- Look up the company at Companies House or the equivalent register in its stated country. A firm with no registration and no address is not a firm.
- Check the domain registration date. A site created weeks ago claiming years of experience is a contradiction.
- Search the exact wording of their messages. Scripted approaches are frequently reported verbatim by others.
- Contact any organisation they claim to represent using the number on that organisation's own website, never the number they gave you.
- Refuse any request to install remote-access software or to share your screen while logged into a wallet or exchange.
What to do if you have already paid
Stop all payments immediately, even if you are told the process will be lost. Preserve everything: message threads, profile names, phone numbers, payment references, wallet addresses and transaction hashes. Report to Action Fraud in England, Wales and Northern Ireland, or to Police Scotland on 101 in Scotland. If a card or bank transfer was involved, notify your bank the same day and ask for the payment to be recalled.
Then take the details to a firm that will look at the record before promising you anything. Any assessment worth having starts with what the ledger shows, not with what you hope it shows.
Common questions
- Someone contacted me who knows details of my loss. Does that mean they are genuine?
- No. Details of reported losses circulate widely, including through resold victim lists. Knowledge of your case is not evidence of legitimacy — verify the organisation independently instead.
- Can a crypto transaction be reversed if I act fast enough?
- No. Once a transaction is confirmed on a public network it is final. What can change is where the funds go next, which is why documenting the trail promptly still has value.
- Is it normal to pay before any work is done?
- Paying for an agreed, written scope of investigative work is normal. Paying a fee that is described as unlocking or releasing your funds is not.
Have a case you want reviewed?
We scope at intake and tell you honestly whether the on-chain data supports a traceable case.