Official Wallsec emails only ever come from an @wallsec.co.uk address.

First steps · 6 min read

Crypto scam on Telegram or WhatsApp: what to do

Many cryptocurrency frauds start with a message from a stranger, a 'mentor' or an investment group on Telegram or WhatsApp. Chats can be deleted and accounts closed quickly, so the order you act in matters.

Written and reviewed by the Wallsec investigations team · Last updated

Save the conversation before anything else

Accounts and groups used in fraud are often deleted once a victim stops paying. Export or screenshot the full chat now, including the username, phone number and profile details of every contact involved.

  • WhatsApp: open the chat, choose More, then Export chat, and include media.
  • Telegram: on desktop, use Export chat history from the chat menu.
  • Screenshot group names, member lists and any links to trading websites.

Stop paying and stop replying

Do not send more money for fees, taxes, account upgrades or 'unlocking' a withdrawal. You do not need to tell the contact you have realised it is fraud; simply stop engaging.

Report the account and the payments

  • Call your bank on the number on your card if you paid from a bank account or card.
  • Report to Action Fraud (or Police Scotland if you live in Scotland) and keep the reference number.
  • Report the contact inside the app so the platform can review the account.
  • Contact the exchange you bought the cryptocurrency on with your transaction hashes.

Collect the onchain details

From your exchange or wallet history, note each transaction hash, the receiving address, the amount and the date. These are what make an onchain trace possible.

If you are looking at your own case rather than reading generally, our cryptocurrency investigation service explains how a case is scoped and worked, the asset tracing hub covers the network-specific work, and our overview of cryptocurrency scam recovery in the UK sets out what is realistic. Asset pages: USDT tracing, Bitcoin tracing and Ethereum tracing. You can also contact the investigations team directly.

Common questions

Can Telegram or WhatsApp tell me who the scammer is?
Not usually directly to you. Account information is normally released to police under legal process, which is why reporting to Action Fraud matters.
Someone in the group says they can get my money back. Should I trust them?
Be careful with anyone who contacts you first. Check any firm independently, for example on Companies House, before sharing details.
This guide is general information, not legal or financial advice. We provide investigative and reporting services only, and no report can guarantee an outcome.

Have a case you want reviewed?

We scope at intake and tell you honestly whether the onchain data supports a traceable case.

Request a case review

Related guides