Skip to content
Advisory

Recovery scams: how the second fraud finds you

Victim lists get resold. The people who contact you after a loss claiming they can get your money back are, more often than not, running the same playbook against a target they know is already vulnerable.
CoinSentry ResearchInvestigations6 min read

There is an uncomfortable fact about this industry: a large share of firms advertising crypto recovery are fraudulent, and they target people who have already been defrauded once. We would rather say so plainly than pretend otherwise.

Victim data circulates. Complaint forums are scraped. Anyone who posted publicly about a loss is on a list, and that list has resale value precisely because it identifies people with a motive to act quickly.

What the second fraud looks like

Unsolicited contact. A comment on your forum post, a direct message, a call from someone who already knows your loss amount. Legitimate firms do not cold-call fraud victims. Knowing details about your case is evidence you were profiled, not evidence of capability.

A guarantee. No one can guarantee recovery. Outcomes depend on where funds landed and whether a court can reach them, and neither is knowable before the tracing is done.

Claimed access to agencies. "Direct access to government intelligence", "our contacts inside Interpol", "partnerships with federal agencies". Private firms do not have privileged channels into law enforcement systems. They file reports through the same public portals you can use yourself, for free.

Fees framed as something else. A "commissioning fee", "unlocking fee", "wallet activation deposit", "insurance bond", or a request for gas fees to move recovered funds. Note that a legitimate firm may well charge a retainer for work performed. The distinguishing feature is not that money is charged; it is that the fee is attached to the release of funds rather than to the labour of investigating.

Payment in crypto to a personal wallet. Real firms invoice through banking rails against a written engagement.

No verifiable identity. No registered company number, no named professionals with checkable histories, a website registered weeks ago, stock photography for the team, and an address that turns out to be a virtual office.

Ten minutes of checks that filter most of it

  1. Look up the company registration number in the national registry it claims. If there is no number, stop.
  2. Check the domain registration date with a WHOIS lookup. A firm claiming ten years of history on a six-week-old domain is lying about something.
  3. Search the named principals independently. Reverse image search the team photos.
  4. If a licence is claimed, verify it with the issuing regulator directly rather than through a link the firm provides.
  5. Read the engagement letter before paying anything. If there is no engagement letter, there is no firm.
  6. Ask what specifically the fee buys and what the deliverable is. A real answer describes analyst hours and a written report, not an outcome.

What we do and do not offer

We trace funds and produce evidence packages suitable for law enforcement and civil counsel. We charge for analyst time against a written scope, we tell clients when a case is not economically worth pursuing, and we decline matters where the trail is already cold.

We do not guarantee recovery, do not take contingency fees on funds we did not recover, do not have privileged access to any agency, and will never ask you to send cryptocurrency to release a balance.

If you have been approached by a recovery firm and want a second opinion before paying anyone, ask us. We will tell you what we think of the offer at no charge, including when the answer is that you do not need us either.

recovery-frauddue-diligence

Tell us what happened. We will tell you if it is worth pursuing.

Triage costs nothing and commits you to nothing. You get a written assessment of whether the trail is live enough to act on, and if it is not, you get told that too.

No obligation. No upfront fee at triage. No promise of recovery.