Two markets use the same words. One is investigative work — tracing stolen funds to a party who can freeze them and carrying the case through a legal process that takes months. The other is a fraud that targets people who have already been defrauded, and it borrows the first market's vocabulary word for word: "recovery", "forensics", "blockchain experts", "legal team". From the outside, a website is a website. The difference is in how each one behaves on a handful of specific points, and those points can be checked before any money changes hands. This is the comparison, point by point, with our own practice stated so it can be held to the same test.
How the first contact happens
A legitimate firm is found. The victim searches, compares, asks a lawyer, reads a checklist. The firm does not know the victim exists until the victim writes.
A scam finds you. Within days of a loss — often within hours of a public complaint, a comment under a warning post, or a report to a portal — a message arrives: a "recovery agency" that has "been assigned your case", a "law firm" that "already recovered funds for other victims of the same platform", an "exchange compliance officer" who has "located your funds". The victim list is the scam's raw material; sometimes it is the same people who ran the first scheme. The FBI's Internet Crime Complaint Center has published advisories about exactly this pattern. Law enforcement does not charge victims a fee and does not assign your case to a private firm that contacts you. We do not cold-message victims, and if someone approaches you in our name, it is not us.
What the first conversation sounds like
Legitimate: an assessment, with "no" as a possible answer. The firm asks for the transaction hashes, looks at where the funds went, and tells you whether there is a party who can be asked to freeze them. In our case that assessment is free, we aim to respond within two business hours, and it includes — for a meaningful share of enquiries — the answer that there is nothing worth pursuing. A firm that declines cases is not running an advance-fee scheme; declining is the one thing a scheme cannot afford to do.
Scam: certainty. The funds have "already been traced", the "hacker's wallet has been identified", a "recovery rate of 95%" is quoted, and the only remaining question is when you pay.
Identity, contract and who you are dealing with
Legitimate: a legal entity you can look up, a licence or registration number you can check in the register that issued it, named people, a physical address, and a contract before any work. Our entity, licence number and the registers it can be checked in are published field by field on the credentials page; identity checks and the contract are completed through Sumsub before work starts — we verify the client too, because we do not take cases where the source of the funds cannot be confirmed.
Scam: a first name and a messaging handle. A "certificate" as a JPEG. A registration number that belongs to a different company, or to nobody. A contract that arrives, if at all, after the first payment. No KYC of you — because a scheme that verified its victims would leave evidence of itself.
Money: when it is paid, and for what
This is the point that decides most cases, and it is worth being precise about both sides.
Legitimate: the structure is written down before work begins, and every payment is attached to a defined stage. In our model, the assessment and the intro call are free; if a case is opened, an upfront retainer is payable before work begins and is not refundable; the fees that follow are commissions on the funds actually frozen and on the funds actually returned, each due only after the result it is attached to. No amounts or percentages are published — they are fixed in the engagement agreement, in writing, in full. Where funds come back through a stablecoin issuer's reissue, the issuer often charges its own fee, a percentage of the amount, which is not ours. A retainer is not by itself a warning sign — real investigative work costs money before any result exists — but a retainer with no written scope, no entity behind it and no result-based stage after it is.
Scam: a fee to release funds that have "already been recovered". A "tax", a "gas fee", an "AML clearance", a "network unlock", a deposit to "verify your wallet", an "insurance" — always payable before you see anything, always to a crypto address, always followed by another. The tell is not that money is asked for; it is that money is asked for in exchange for a result that supposedly already exists. A legitimate recovery firm does not charge a fee to "unlock" or release funds, because the release is decided by an exchange, an issuer or a court — not by the firm.
That is not the same as saying a real process has no costs at that stage: court fees, legal costs, an issuer's fees or administrative costs can arise. They belong to the legal or issuer process, are set out in writing, and are not a price for releasing funds.
What is promised about the outcome
Legitimate: nothing about the outcome, and a lot about the process. Whether frozen funds come back is decided by an exchange, an issuer or a court, and a firm that does not control that decision cannot honestly guarantee it. What can be stated are timelines measured on past cases, published with their limits. Ours are on the figures page: at an exchange, a freeze request has taken 2–4 days and a return, typically on a court decision, 6–9 months; through a stablecoin issuer, a request has been answered in 24–62 hours and a first payout has come 12–20 months in — two separate routes, not one sequence; complex cases 6–36 months. The aggregate we publish is stated in full — 68% success rate on accepted cases · measured over the past 24 months — and never without the qualifier.
Scam: "guaranteed", "100%", "within 48 hours", "no risk to you" from a party that will never reach the recovery stage. A number of days for something that takes months is the most reliable single marker in this market, and the reason we publish two clocks side by side rather than one; the difference between them is explained in Crypto Recovery vs. Freeze in 2026: Two Clocks, Real Timelines.
What they refuse to do
Legitimate: a published list of refusals, because the method has limits and a firm that knows its method knows them. We do not take Monero cases, because its design means we cannot produce the evidence an exchange or a court would need. We do not take cases where the source of the funds is unconfirmed, cases with no realistic prospect of recovery, or non-crypto assets. We stop work if a client misstates the facts. We do not practise law: every legal step in our cases is carried out by partner law firms admitted in the relevant jurisdiction, under our case management.
Scam: everything is recoverable — Monero, funds "lost" in a Ponzi dashboard that never held assets, a transfer from three years ago, a balance on a platform that never existed. The absence of any stated limit is itself the limit.
What you receive
Legitimate: a report — the path of the funds with a transaction hash behind every step, the endpoints with their attribution and its confidence, the artefacts fixed with SHA-256 hashes under a chain of custody. It is written so that an exchange, a police unit or a court can check it without trusting the author. Whether a given court accepts it is the court's decision; the firm's job is to make it checkable.
Scam: a screenshot. A "dashboard" showing your funds "located" and "pending release". A PDF with a seal. None of it references a transaction you can open in an explorer, and none of it was seen by any exchange or authority.
Who does the legal work
Legitimate: lawyers admitted in the relevant jurisdiction, named when the case gets there, engaged under the same agreement. That jurisdiction does not follow simply from where the funds are held: the exchange entity, the issuer, the defendant, the requesting authority and the applicable law can all matter. A firm that does its own filings in every jurisdiction in the world is describing something that does not exist.
Scam: "our legal team", "our hackers", "our contacts at the exchange", "our own contact at Tether". We have no private channel into any stablecoin issuer and do not claim one; depending on the case and jurisdiction, freeze requests may be submitted through law-enforcement or other accepted legal or compliance channels, supported in our cases by our investigation report, and a recovery firm offering you a "private channel" should be asked to show it.
What can be checked without contacting anyone
Every point above can be tested from a browser before a first message is sent: the entity in its register, the licence at the issuing authority, the partners on the partners' own websites, the figures with their periods, the refusals in writing, the fee structure in writing. We publish a ten-point version of that test on the verification page, written to work on any firm and not only on ours. Run it on us. Then run it on whoever else is on the shortlist.
If you have already paid a "recovery service"
Stop paying — the next request will come, and it will be the last one only when you stop. Preserve everything: the messages, the addresses you paid to, the hashes of the payments. Report it as a theft in its own right, to the national cybercrime portal and to the police where you live; the fee you sent is a traceable transfer to a specific address, exactly like the original loss, and the two can be worked as one case. Where and how to file is on the reporting page. Then, if the total loss justifies it, get an honest assessment — from a firm that found you nowhere.
If the funds are traceable and the loss is significant, send us the transaction hashes: the assessment is free, and we aim to respond within two business hours, including when the answer is that there is nothing to pursue. Write through the contact page or message @StarCompliance on Telegram.
Questions people ask when choosing a recovery firm
Is asking for a retainer a red flag?
Not by itself. Tracing, evidence work and case management cost money before any freeze exists, and a firm that takes no retainer is either not doing the work or is planning to be paid another way. The red flag is a payment with no written scope, no legal entity behind it, and no result-based stage after it — or any payment described as a fee to "release" funds.
A firm says it has its own contact inside Tether. Is that possible?
Treat it as a claim to test. We have no such channel and do not claim one: depending on the case and jurisdiction, a freeze request may be submitted through law-enforcement or other accepted legal or compliance channels, supported in our cases by our investigation report, and the issuer decides the timeline — in our cases a response typically arrives within 24 to 62 hours. A "private channel" is a claim to test by asking to see it.
What is a realistic success rate?
Any single number without its definition is meaningless. Ours is 68% success rate on accepted cases · measured over the past 24 months — and "accepted" does the work, because we decline cases where we see no realistic prospect. A firm quoting 95% or 100% is either counting something else or not counting at all.
Can a legitimate firm recover funds that went through a mixer or to Monero?
Mixers can sometimes be worked statistically, and the result is reported with a confidence level rather than as a fact. We do not take Monero cases: its design means we cannot produce the evidence an exchange or a court would need.
How can I check a recovery firm before I contact it?
Look up the legal entity in its register, the licence at the authority that issued it and any partnership on the partner's own website, and read the firm's written refusals and fee structure. We publish a ten-point version of that test on our verification page, written to work on any firm, including ours.
What should I do if I have already paid a recovery scam?
Stop paying, preserve the messages, the addresses you paid to and the payment hashes, and report it as a theft to the national cybercrime portal and to the police where you live. The fee you sent is a traceable transfer, and it can be worked together with the original loss.
This article is informational material, not legal advice, and no outcome is promised: decisions on freezing and releasing funds are made by exchanges, issuers and courts. Figures are from StarCompliance casework and are published, with the period each covers, on our figures page.
