On this page
- How fake recovery firms manufacture authority
- A practical verification sequence before you pay
- Claims about IC3 and the FBI require particular care
- If you already paid or sent identity documents
- Tracing, legal action and recovery are different outcomes
- The $1.4 billion recovery-scam figure needs its footnote
Someone knows how much cryptocurrency you lost, names the platform you used and says your funds have been recovered. They may present a lawyer’s letter, a government seal or a bank dashboard. Before paying or sharing more records, verify the person and the claimed recovery through channels they do not control. Accurate details about your first loss are not proof that the new contact is legitimate.
A real legal assessment should identify the work to be done, the person responsible and the limits of the available evidence. A demand for another transfer to unlock an unverified balance requires a different response: stop, preserve the demand and independently check the supposed authority.
How fake recovery firms manufacture authority
The FBI’s August 2025 warning describes impersonation of genuine lawyers, invented regulatory bodies, supposed government partnerships and fake foreign-bank accounts. A group chat may include apparent attorneys and bank staff who reinforce one another’s claims. The contact may already know the dates and amounts of earlier transfers. That knowledge can make a new demand persuasive without authenticating it. Source: FBI warning on fictitious law firms.
Check three different propositions: does the professional exist, is this contact actually that professional, and does the proposed work support the particular claim being made? Finding a genuine lawyer with the same name answers only the first question. A copied licence or letterhead can be part of the impersonation.
A practical verification sequence before you pay
| Question | Independent check | What remains unproven |
|---|---|---|
| Is this a registered lawyer? | Find the relevant professional register yourself; compare name and registration details | Registration does not authenticate the person messaging you |
| Did this firm contact me? | Obtain its established contact details independently and ask the firm to confirm the communication | A lookalike domain, email signature or video does not supply that confirmation |
| What work am I buying? | Request a written scope, responsible professional, fee basis and identified legal route | A retainer does not guarantee asset access or recovery |
| Who supposedly holds the funds? | Ask for the institution, case reference and basis for connecting the funds to your transfers | A dashboard or wallet screenshot does not prove a recoverable balance |
| Who can release or freeze them? | Verify the named authority and document through its official channel | A private tracing report is not itself a court order or a provider’s commitment |
| Why this payment destination? | Check the payee against the verified engagement and stated purpose | An unrelated recipient or new wallet needs an explanation, not trust based on urgency |
Do not use the links or telephone numbers in the suspicious letter to perform these checks. If the contact claims to act for a government agency, verify both the agency’s existence and the individual’s role. In its recovery-scam warning, the FBI specifically flags false “official partner” claims and says the US government does not charge for its law-enforcement services. Source: August 2025 warning.
A legitimate professional may charge for defined legal or forensic work. The warning sign is not the existence of a fee alone. It is a false identity, unsupported authority, unexplained payment destination or assurance that another payment will release funds whose existence and legal status have not been established.
Claims about IC3 and the FBI require particular care
IC3 says it does not communicate directly with individuals by telephone, email, messaging apps or social platforms, and does not charge to recover funds or refer victims to a company demanding a recovery payment. The same warning explains that genuine FBI field-office personnel or other law-enforcement officers may contact someone for further information. Verify any such approach independently with the relevant office. Source: IC3 impersonation warning.
Enter ic3.gov directly when filing a complaint. A site that resembles the reporting portal may itself collect sensitive information. The FBI’s September 2025 warning also says that IC3 has no social-media presence. A recovery profile claiming to be IC3 on a messaging or social platform is not an official reporting channel. Source: spoofed IC3 website warning.
If you already paid or sent identity documents
- Pause payments to the unverified contact. Independently check any cancellation, clearance or refund-fee demand rather than paying merely to end the relationship.
- Preserve both episodes. Keep the original fraud records and the recovery approach, including the advertisement or referral that connected them.
- Contact the sending provider promptly. Supply the recovery-payment reference, amount, recipient and time. Ask about available protective steps and retain the response.
- Record information exposure. List identity documents, bank details, credentials and remote access supplied. Use official provider channels to secure affected accounts.
- Report the second approach. Give investigators the original complaint reference where available, but explain which payments and identities belong to the new episode.
If a genuine lawyer or firm was impersonated, preserve the imitation letter and contact the real firm through verified details. Avoid publishing passports, account numbers or accusations against a person whose identity may have been stolen.
Tracing, legal action and recovery are different outcomes
A tracing analysis may identify transfers or a possible service endpoint. Provider records may then be needed to connect that activity to an account holder. Legal authority may be required for disclosure or restraint, and return of funds may involve another process. None follows automatically from seeing an address on a blockchain.
For a blocked trading-platform balance, see the crypto investment evidence guide. If there is a Turkish account, provider, suspect or asset connection, crypto fraud and asset recovery in Turkey addresses the jurisdiction-specific route. Neither a claimed foreign connection nor an official-looking document establishes that a particular recovery measure is available.
The $1.4 billion recovery-scam figure needs its footnote
The FBI’s 2025 IC3 report records 10,516 complaints and $1.4 billion in losses in its recovery-scam section. The report expressly states that losses may also include the earlier scam that caused the person to approach the recovery company. It would therefore be inaccurate to describe the full $1.4 billion as new payments to recovery scammers. The section also notes increased complaints involving impersonated officials and recovery firms. Source: IC3 report, page 53.
The figure describes reported complaints, not proven liability in each case, unique victims or a global estimate. Recovery contact can be a second stage of the same underlying scheme. Keep its payment requests and losses separately identifiable in your own records.
