Home › Knowledge Hub › After a recovery offer
Someone offered to recover your crypto: what to do now
If someone has contacted you offering to recover cryptocurrency you lost, slow down and assume it is a second scam until proven otherwise. Do not pay an upfront fee, and do not hand over passwords, recovery phrases, or remote access to your device. The fact that they reached out to you is itself the warning sign: legitimate help does not arrive unsolicited, days after a loss, promising to get your money back.
Start here
This guide is for the moment just after a recovery offer lands: a message, a call, a comment, an email from someone who says they can get your lost crypto back. If you want the full checklist for telling a real provider from a fake one, our guide on spotting a crypto recovery scam covers the warning signs in detail. This page is the immediate response: what to do in the next few minutes, and what never to do.
The four moves, in order
1. Do not pay anything upfront. This is the single rule that defends against almost every recovery scam. A fee requested before anything is recovered is the signature of the fraud. In the United States it is not merely suspicious, it is prohibited: the FTC's Telemarketing Sales Rule bars charging an advance fee for a promise to recover money you have already lost. Whatever the fee is called, a retainer, a deposit, a "gas fee", a "release fee", a "tax", do not pay it.
2. Do not share secrets or access. No genuine recovery of funds requires your seed phrase, your private key, your exchange password, your two-factor codes, or remote control of your computer. Anyone asking for these is not recovering your money, they are taking what is left. This request alone ends the conversation.
3. Verify independently, on your own initiative. Do not use the links, numbers, or credentials they gave you. If they claim a licence or registration, look it up yourself on the real regulator's register. If they name a law firm or an investigator, find that organisation through a search you run and contact it through details you find. An honest party survives this check. A scammer controls only the channel they contacted you on.
4. Report it. File the original loss, and the recovery approach, through official channels. In the US that is ic3.gov; elsewhere, your national fraud line. Reporting the second approach matters: it feeds the pattern analysis that maps these operations.
Why they found you
The hardest part to accept is that being contacted is not luck or hope arriving. It is the opposite.
After a crypto loss, your details often end up on a list: sold between fraud operations, scraped from a complaint you posted, or still held by the people who scammed you the first time. Recovery scammers buy and trade these lists precisely because a person who has just lost money is the most receptive audience there is for a promise to get it back. The approach is targeted, and the timing, days or weeks after the loss, is deliberate.
That is why the direction of contact is the tell. Genuine options for recovery are things you go and find: a report you file, a lawyer you engage, a provider you research and approach. They do not come looking for you first.
The forms the second scam takes
The offer arrives wearing different uniforms. The shared thread is that each one ends in money or secrets flowing from you.
The recovery agent promises to get your funds back and asks for an upfront fee to begin. The blockchain tracer sells you a "trace" that produces a document naming no one and freezing nothing, for a fee paid in advance. The fake investigator or lawyer cites a licence that turns out to be a free registration rather than a real credential. The law-enforcement impersonator says a case has been opened in your name and a payment is needed to release the recovered funds. The refund processor claims your money has already been found and only a fee stands between you and its return.
They look different. They are the same transaction.
What a real path actually looks like
It helps to know what you are not getting, so the contrast is clear.
Recovering stolen cryptocurrency, where it is possible at all, runs through a small number of unglamorous routes: a fast report to your bank or exchange while funds may still be frozen, an official complaint that reaches teams who work with exchanges, and in larger cases a lawyer pursuing a civil process. Our guide on whether stolen crypto can be recovered is honest about how narrow these are.
A legitimate tracing or forensic provider, where one is warranted, works on a clear basis, names a verifiable credential, never guarantees an outcome, and is usually something you approach rather than something that approaches you. Our guide to forensic reports and crypto-fraud lawyers explains what such a report is and is not. None of these begins with an unsolicited message and an upfront fee.
If you have already engaged
If you have already paid a recovery operator, stop sending anything further, the same way you would in any fee-to-withdraw trap: there is no payment that completes the sequence. If you shared a password or a code, change it now and secure the account, starting with your email. If you gave remote access to your device, disconnect it from the internet, and have it checked by someone you trust before you log into anything sensitive. Then preserve what you have and report it.
You are not foolish for having been targeted. These operations are built to find people at their most hopeful, and the hope is the lever they pull.
Red flags
- Any offer to recover funds that arrives unsolicited
- A fee of any kind requested before anything is recovered
- A request for your seed phrase, private key, password, or codes
- A request for remote access to your device
- A guarantee that your money will be recovered
- A licence or registration you are told not to look up yourself
- Pressure to decide quickly, or a "window" that is closing
- Contact from someone claiming a case is already open in your name
What this guide cannot do
It cannot recover what the first scam took, and it cannot promise that a given provider is genuine. What it can do is stop the second loss, which is the one in front of you and the one still preventable. When an offer survives independent verification and asks for nothing upfront, it may be worth a closer look; until it does, the safe answer is no.
This is general information, not legal or financial advice, and the specific rules on recovery fees vary by country.
Use Chain Pursuit's free tools to understand your options, preserve evidence, and identify possible recovery scams. Do not share your seed phrase or private keys with anyone.
Sources
Federal Trade Commission, Told You Can Recover Your Lost Money? It's a Scam. https://consumer.ftc.gov/consumer-alerts, on recovery scams targeting prior victims and the upfront-fee warning.
Federal Trade Commission, Telemarketing Sales Rule. https://www.ftc.gov/legal-library/browse/rules/telemarketing-sales-rule, prohibits requesting or receiving an advance fee for a promise to recover money lost in a prior transaction.
Internet Crime Complaint Center, File a Complaint. https://www.ic3.gov/Home/ComplaintChoice, where to report, with a warning against non-law-enforcement recovery services.
The sale and reuse of victim contact lists is widely documented by law-enforcement and consumer-protection agencies; the direction-of-contact principle here follows from it. Reviewed quarterly.
Frequently asked questions
Someone messaged me saying they can recover my lost crypto. Is it real?
Assume it is a scam until it proves otherwise. Genuine recovery options are ones you seek out, not ones that arrive unsolicited after a loss. Do not pay anything upfront and do not share any passwords or recovery phrases while you verify them independently.
They only want a small fee to start. Isn't that reasonable?
No. Any fee requested before funds are recovered is the defining sign of a recovery scam, and in the US charging one is prohibited under the FTC's Telemarketing Sales Rule. The size of the fee does not matter. An upfront fee of any amount is the reason to walk away.
How did they even know I was scammed?
Your details likely ended up on a list, sold between fraud operations, scraped from a public complaint, or kept by the original scammers. Recovery fraudsters target recent victims deliberately, which is why the unsolicited contact itself is the warning sign.
They asked for my wallet's recovery phrase to "return the funds." Should I give it?
Never. No legitimate recovery needs your seed phrase, private key, password, or codes. Anyone asking for them is trying to take what remains, not return anything. That request alone means the conversation is over.
They say they are from law enforcement and a payment will release my recovered money. Is that how it works?
No. Law enforcement does not contact victims out of the blue to collect a payment that "releases" recovered funds. That is an impersonation scam. Verify by contacting the agency yourself through details you find independently, not the ones they gave you.
I already paid a recovery company. What now?
Stop sending anything further, because no additional payment completes the process. If you shared any credentials, change them and secure your email first. If you granted device access, disconnect and have it checked. Then preserve evidence and report it through official channels.
How can I check whether a provider is genuine before engaging?
Verify everything yourself, not through the links or numbers they supplied. Look up any licence on the real regulator's register, confirm a named firm exists through your own search, and reject anyone who guarantees an outcome or wants a fee upfront. Our guide on spotting a recovery scam has the full checklist.
Is there any legitimate way to get stolen crypto back?
Sometimes, and it is narrow: fast reporting to a bank or exchange while funds may be frozen, an official complaint, and in large cases a civil legal process. None of these starts with an unsolicited offer and an advance fee. Our guide on whether stolen crypto can be recovered is honest about the odds.
Not sure whether anyone can genuinely help your case?
Eleven questions and an honest answer, including when the answer is that nobody can.
Check my case