Scam patterns
Advance-fee recovery scams
A person promises to recover stolen assets after an upfront payment.
In this article
The second payment is the product
A recovery scam targets someone who has already lost money. The new contact promises access to stolen funds, a refund or a supposedly frozen account, then demands a payment before releasing it. The FTC describes how scammers reuse information about previous victims and impersonate organisations to make these approaches convincing. Knowing the amount lost or the name of the original platform is therefore not proof that a caller has legitimate access to the case. FTC guidance on refund and recovery scams.
The demand may be presented as a tax, an unlock deposit or an administrative charge. The label changes, but the claim remains testable: who holds the money, what authority allows its release, and why would sending money to this particular recipient cause the release? A balance shown on an unfamiliar website answers none of those questions. Its operator can change the number without moving any asset.
Separate an investigation from control over funds
A researcher can document a transfer and explain where the visible trail leads. That does not give the researcher the private key of the receiving wallet, the power to reverse a confirmed transfer or authority over an exchange account. A paid report should specify the work being purchased and the records delivered. It should not present tracing as a guarantee that assets will return.
For example, a report may show that 3 transfers reached an address labelled as belonging to a platform. A separate process would still be needed to establish who controlled the relevant account and whether the platform can or will restrict it. The label, the platform’s response and the legal authority for any action are different pieces of evidence. A private message claiming that all of them have already been resolved should be checked with the organisation through independently obtained contact details.
Pressure tactics conceal the missing mechanism
Deadlines can move attention away from verification. A caller may say that a recovery window expires in 30 minutes, that speaking to anyone else will invalidate the claim or that an additional payment is necessary because the previous one was insufficient. Each new condition should be documented. Repeated payment requests do not become more credible because the victim has already paid several of them.
A demand for a seed phrase or private key is particularly revealing. Those secrets enable control of assets; they are not ordinary case identifiers. Transaction IDs and public addresses can identify the visible transfers without handing over signing authority. Do not put private keys, recovery phrases or authentication codes into a case form.
Keep a usable record
Save the original approach, claimed identity, domains, payment requests, wallet addresses and transaction IDs. Keep promises about recovery separate from what actually happened. The FTC recommends independently checking organisations that make these approaches and reporting refund scams. A useful record allows the next reviewer to follow the sequence without relying on a cropped chat screenshot or an attacker-controlled dashboard.