Recovery scams: how to tell a real forensics service from a second theft

We are in an awkward position writing this. We sell forensic work to people whose funds are frozen, which is the same sentence a recovery scam would open with. So this piece is written to be useful even if you never contact us, and every marker below is something you can check without taking our word for anything. If we fail our own test at some point, the test still works.

The single strongest marker: who contacted whom

Legitimate forensic services do not send you the first message. They do not reply to your complaint thread offering help, they do not direct-message you after you post about a freeze, and they do not appear in your inbox knowing details about your case.

The reason is structural rather than ethical. A service that works on referral and search has no mechanism for finding your complaint and no reason to. A service whose economics depend on volume outreach to distressed people has exactly that mechanism, and it is the mechanism that pays for itself.

This one marker eliminates the large majority of what you will encounter. If they wrote first, close the conversation. You lose nothing: a service worth using can be found by searching for it in a week's time when you are calmer.

Guarantees

Nobody can guarantee that frozen funds will be released, because the decision does not belong to any service. When an exchange freezes a withdrawal, the compliance team decides. When Tether blacklists an address, the issuer decides, usually at the request of a law enforcement agency, and there is no consumer appeals process. When funds have moved to an address controlled by someone else, they are gone unless that person or a court acts.

A service that guarantees an outcome is either lying or does not understand the process. Both disqualify. What an honest service can promise is specific and much smaller: that they will screen the addresses, tell you what the counterparty is likely seeing, help assemble a package that will not be returned for format reasons, and give you their honest read on the odds, including when the honest read is that the odds are poor.

The odds genuinely are poor in a large share of cases. Against thousands of blacklist events, unfreezing is the exception rather than the rule, and destruction of frozen balances is routine. Any provider who describes this as routinely reversible is describing a different reality from the one on chain.

Money mechanics

Large payment up front, before anyone has looked at your case, is the classic shape. So is a fee structure that grows as the case proceeds: a small diagnostic, then a fee to "unlock" the transfer, then a tax, then a final release payment. Each step is justified by the previous one, and each is designed to exploit the sunk cost of the last.

Legitimate work is priced in stages that correspond to actual work, and the first stage is small or free because it is diagnostic. If someone wants a four-figure payment before telling you anything specific about your situation, they are selling hope.

Payment channel matters too. A service operating as a business can accept payment as a business. Insistence on crypto only, to a personal wallet, with no invoice, is a preference for irreversibility, and irreversibility is only an advantage to one side of the transaction.

Things a real service will never ask for

Your seed phrase or private keys. There is no analysis that requires them. Blockchain data is public; anyone who can do the work can do it from your address alone. A request for keys is a request to take the remaining funds.

Remote access to your device, "to help with the withdrawal". Your account credentials. A payment to a wallet address they describe as an escrow, which is not what escrow means.

Your exchange password, ever, for any reason, including a claim that they have a contact inside the exchange. Which brings us to the next marker.

Claimed insider access

"We have a contact in their compliance department" is a red flag rather than a selling point. Compliance functions at large exchanges are audited precisely because they are attack surfaces, and a genuine insider channel would be a criminal liability for everyone involved, including you.

What actually exists are official submission channels: enhanced due diligence queues, formal complaint procedures, and regulator escalation where the platform is licensed. These are slower and less exciting than an insider, and they are the only routes that exist.

What can be verified about a service

Ask for anything with a date and a source that you can check independently. Published data with a stated methodology, which you can recompute. A named legal entity in a named jurisdiction. Content that predates your case by months, because a service built to harvest a wave of victims has no history.

Test their honesty by asking a question they should refuse. "Can you guarantee it comes back?" A service worth using says no, explains why, and tells you what the realistic range is. A scam says yes. This single question is remarkably effective.

Ask what they will not do. A service with real boundaries can name them. We decline cases with a genuine sanctions connection, and we say so publicly, because taking such a case would expose both sides to liability. A provider who takes everything has no criteria.

If you have already paid one

Stop paying immediately. The next request will be framed as the final one; it will not be. Preserve everything: handles, wallet addresses, transaction identifiers, the full message history. Report it to your national cybercrime unit and, if the funds went through an exchange, to that exchange's compliance channel with the transaction identifiers, because addresses used by recovery-fraud operations are often reused across many victims and do sometimes get frozen.

Then treat any subsequent approach as connected. Victims of recovery fraud are commonly approached again by a second operation offering to recover what the first one took, and that second operation is frequently the same people.

The short version

They wrote first: stop. They guarantee an outcome: stop. They want a large payment before looking at anything: stop. They ask for keys, passwords or remote access: stop. They claim an insider: stop.

Everything else is judgement, and judgement is easier when you are not in the first panicked week. The freeze will still be there in seven days. The pressure to decide immediately is manufactured, and it is manufactured by the person applying it.