Reporting crypto fraud in the UK: who to contact and in what order

Before you contact anyone: preserve the record

• Screenshot every conversation, dashboard, invoice and support ticket before accounts are closed or deleted.
• Export your own transaction history from the wallet or exchange you sent from, including transaction hashes.
• Record the exact addresses you sent to and the network used for each payment.
• Note names, phone numbers, websites, company names and payment references given to you.
• Do not send any further payment. A demand for tax, a release fee or a compliance deposit before withdrawal is a continuation of the fraud, not a route out of it.

1. Your bank or payment provider — first, and quickly

If any part of the money left a UK bank account or card, contact your bank's fraud team immediately. Timing genuinely matters here: some funds can still be held at the receiving institution if flagged early enough, and UK reimbursement rules for authorised push payment fraud have strict reporting expectations.

Ask for a written case reference. You will need it for every later step.

2. Action Fraud (or Police Scotland)

Action Fraud is the national reporting centre for fraud and cybercrime in England, Wales and Northern Ireland; in Scotland, report to Police Scotland on 101. Reporting produces a crime reference number, which banks, exchanges and solicitors will frequently ask for before they will engage.

Be realistic about what follows: Action Fraud is a reporting and intelligence function, and most individual reports do not result in a dedicated investigation. That does not make reporting pointless — the reference number is a prerequisite for almost everything else, and aggregated reports are how patterns get identified.

3. The exchange or platform involved

If your funds reached a deposit address at a centralised exchange, contact that exchange's compliance or law-enforcement channel — not general support. Provide the transaction hash, the deposit address, the amount, the timestamp and your crime reference number.

Exchanges will not tell you who owns an account, and should not: account holder information is disclosed to law enforcement under legal process, not to members of the public. What they can do is review and, where their policies allow, restrict an account.

4. The FCA and other regulators

If the firm claimed to be UK-regulated, check the FCA Register and report a clone or unauthorised firm to the FCA. This will not recover your money, but it feeds warnings that stop other people losing theirs, and it creates a record that the firm was operating without authorisation.

5. Where forensic work fits

Tracing is most useful after the immediate steps above, because it answers a question the other bodies cannot: where the value actually went. A trace can tell your bank or a solicitor that funds reached a specific service's deposit address at a specific time, which is far more actionable than a report saying money was lost.

Wallsec produces that documentation. We do not hold, handle or return client funds, we are not a law firm, and we do not contact any third party on your behalf unless you instruct us to.

Warning signs of a follow-up scam

People who have already lost money are targeted a second time. Treat any unsolicited approach as hostile, and be especially wary of these patterns.

• An upfront fee framed as tax, a release fee, a bond, or a legal deposit.
• A request for your seed phrase, private key, exchange password or 2FA code — no legitimate party ever needs these.
• A request to install remote-access software so someone can 'help' from your device.
• A guarantee that funds will be returned, or a fee taken as a share of recovered money.
• Contact out of the blue from someone claiming to already hold your case file.