The person who has just lost crypto is the most valuable target in this market, and the people who know it best are the ones who took the money the first time. Within days of a loss — sometimes within hours of a comment under a warning post or a report to a portal — the second approach arrives: a firm, an agent, an "officer" who can get it back, for a fee, first. This is the advance-fee recovery scam, and it is structurally the oldest fraud there is: a payment now for a result that is never delivered. It works because it arrives when judgement is weakest. What follows is the script as it actually runs, the seven signs that give it away, and what to do if some of the money has already gone.
How the script runs
The variations are cosmetic; the sequence is fixed.
The approach. A message — email, Telegram, a comment reply, a phone call — from a "blockchain recovery agency", a "crypto law firm", a "regulator", an "exchange compliance department" or an "ethical hacker". They know the platform you lost money to and roughly how much. That knowledge came from the victim list, from your public complaint, or from the scam's own records.
The proof. Your funds have "already been located". A screenshot, a dashboard, a PDF with a seal, a wallet address holding "your" balance "pending release". None of it references a transaction you can open in an explorer, and none of it was seen by any exchange or authority — but it looks like evidence to someone who has never seen real evidence.
The fee. To release the located funds, something must be paid first: a "gas fee", a "tax", an "AML clearance", a "wallet verification deposit", an "insurance" — to a crypto address, today, because the "window closes". The amount is set below the loss, so that paying feels rational.
The next fee. The release "failed" or "requires one more step". Then another. The script ends only when the victim stops paying, and the later fees are often larger than the first, because the sunk cost is now doing the persuading.
The seven red flags
1. They contacted you
Legitimate investigative firms are found; they do not find you. No police unit or regulator refers victims to a private firm that contacts them, and law enforcement does not charge victims a fee for investigating crimes (FBI IC3, PSA240624). The approach itself is the evidence — before a word of the message is read.
2. They claim an affiliation they cannot show
"Working with the FBI", "authorised by the regulator", "partnered with Binance compliance", "our own contact at Tether". Real relationships are documented on both sides: a partner announces the partnership on its own website, a licence appears in the register that issued it. A claim that exists only in the message — or only on the firm's own page — is a claim to disbelieve until the other side confirms it. The FBI's Internet Crime Complaint Center has issued public advisories about fraudsters posing as agencies and law firms to target scam victims; the pattern is common enough to have its own warnings.
3. They promise the outcome
"Guaranteed." "100% recovery." "Within 48 hours." "Your funds are already secured." Whether frozen funds come back is decided by an exchange, a stablecoin issuer or a court — not by the firm asking you for money — and a party that does not control the decision cannot honestly guarantee it. Real timelines are measured in stages and published with their limits — ours are on our figures page: in our cases, at an exchange, a freeze request has taken 2–4 days and a return, typically on a court decision, 6–9 months; through a stablecoin issuer, a request has been answered in 24–62 hours and a first payout has come 12–20 months in — two separate routes, not one sequence. A number of days for something that takes months is the single most reliable marker in this market.
4. Payment before any documented work — or payment to "release" funds
Investigative work does cost money before a result exists, and a legitimate firm may take a retainer under a written contract with a defined scope. What it never does is charge to release funds. Releases are done by exchanges, issuers and courts; the firm that traced the funds does not hold them and cannot "unlock" them for a fee. Any payment described as a tax, a gas fee, a clearance or a deposit required before you can receive your own money is the scam's signature, and it is the point at which to stop.
5. No entity, no register, no KYC, no contract
A legitimate firm has a legal name you can look up, a licence number you can check at the authority that issued it, a physical address and named people. It verifies your identity before it starts — we do, through Sumsub, because we do not take cases where the source of the funds cannot be confirmed — and it signs a contract before any money moves. A scheme has a first name, a handle and a PDF certificate. It does not verify you — verifying its victims would leave evidence of itself — and its "contract" arrives, if at all, after the first payment. Our own entity, licence and registers are published on the credentials page so that this test can be run on us before it is run on anyone else.
6. "Your funds have been located" — with a picture
A real trace is a document in which every step points to a transaction hash anyone can open, every attribution names its source, and every inference is labelled as one. A screenshot of a balance is not a trace. A dashboard with your name on it is not a trace. A wallet address that "holds your funds" is, at best, an address that holds someone's funds. If the "proof" cannot be verified in a public explorer by you, it was not produced for verification.
7. Urgency and secrecy
The window is closing. Do not tell your bank, the police or the exchange — they will "interfere". Pay today. Real processes have the opposite shape: they are slow, they are documented, and they run through the police and the exchange rather than around them. Anyone who needs you to act before you can think, and to keep the people who could warn you out of the room, is running the script.
What legitimate practice looks like on the same seven points
Found rather than finding; a free assessment in which "no" is a possible answer; affiliations documented on the partner's own site; timelines published in stages with their limits; a written scope before any payment and no payment ever to "release" funds; a legal entity, a licence, KYC and a contract; a report that can be checked in an explorer; and a process that runs through the police report rather than around it. We publish a ten-point checklist built on exactly these tests on the verification page, written to work on any firm and not only on ours.
If you have already paid
Stop. The next request is coming, and nothing you pay will produce a release, because there is nothing to release. Preserve everything: the messages, the "proof" you were sent, the addresses you paid to and the hashes of the payments — from your own wallet or exchange history. Report it as a theft in its own right, to the national cybercrime portal and to the police where you live: the fee you sent is a transfer to a specific address, traceable in exactly the same way as the original loss, and the two can be worked as one case. Where to file, by country, is on the reporting page. Expect a third approach — a "firm" that recovers money from recovery scams — and treat it by the same seven flags. Then, if the combined loss justifies it, get an assessment from a firm you found yourself. Ours is free, we aim to respond within two business hours, and it includes the answer that there is nothing to pursue; our published threshold is a loss from $200,000, with smaller cases reviewed individually.
Why this scam works, and who it targets
It targets people known to have lost money, at the moment they are most motivated to get it back and least able to evaluate an offer. The victim lists circulate: sold between operators, scraped from public complaints, or reused by the same group that ran the first scheme. Every visible act of a victim — a post, a comment, a review — is an intake form for the second approach. That is not a reason to stay silent; reporting matters. It is a reason to expect the approach, and to have the seven flags in mind before it arrives.
If the funds are traceable and the loss is significant, send us the transaction hashes: the assessment is free, and we aim to respond within two business hours, including when the answer is that there is nothing to pursue. Write through the contact page or message @StarCompliance on Telegram.
Questions people ask about recovery scams
A "recovery firm" showed me my funds in a wallet. How is that possible if it is a scam?
Any address on any blockchain can be shown to anyone; showing it proves nothing about who controls it or whose funds they are. A real trace is a document that references transactions you can open yourself, not a picture of a balance.
They asked for a small fee. Is it worth the risk?
The first fee is small by design. If it is paid, the second is larger, and the sequence continues until you stop. There is no version of a legitimate process in which money is paid to release funds that have "already been recovered".
Can a real firm ask for money up front?
Yes — a retainer under a written contract with a defined scope, from a legal entity you can look up, with result-based stages after it. In our model the assessment is free, a retainer is payable before work begins and is not refundable, and the fees that follow are commissions on funds actually frozen and actually returned; the terms are fixed in the engagement agreement, and no amounts are published. The difference from the scam is not that money is asked for; it is what the money is for, who is asking, and what is written down.
They say they work with the police. Should I check with the police?
Yes, and expect the answer to be no. Law enforcement does not charge victims a fee and does not hand victims to private firms that contact them. If the police confirm no such cooperation exists, you have your answer; if you cannot reach the police, the claim's unverifiability is the answer.
Someone contacted me offering to recover my crypto. Is that a red flag?
Yes — it is the first of the seven. Legitimate investigative firms are found by the victim; they do not find you. We do not cold-message victims, and if someone approaches you in our name, it is not us.
Where can I check a recovery firm before paying anything?
Look the entity up in the register that issued its licence, and check any claimed partnership on the partner's own website. A ten-point checklist that works on any firm is on our verification page.
This article is informational material, not legal advice, and no outcome is promised: decisions on freezing and releasing funds are made by exchanges, issuers and courts. Figures are from StarCompliance casework and are published, with the period each covers, on our figures page.
