Once you understand how the recovery scam works, covered in detail in our guide on cryptocurrency recovery scams, the natural next question is how to actually tell a fake agent from a legitimate one in the moment. This guide is a practical, checkable list, the specific things to look for, the questions to ask, and the exact phrasing that should make you stop and verify before proceeding.
Warning Sign One: They Contacted You First
This is the single strongest signal, and it applies almost without exception. Legitimate investigators, law firms, and recovery specialists do not cold contact scam victims to offer help. Reputable firms operate on inbound inquiries, referrals, or established professional relationships, not unsolicited outreach to someone whose loss they learned about through a forum post, a public report, or a purchased contact list.
If a direct message, email, or phone call arrives out of nowhere referencing your specific loss, treat that origin itself as disqualifying, regardless of how professional or sympathetic the message sounds.
Warning Sign Two: They Guarantee a Specific Outcome
No legitimate investigator can tell you, before reviewing any details of your case, that your funds will be recovered, or quote you a specific dollar amount or percentage they expect to retrieve. Recovery, where it happens at all, depends on facts that take real investigative work to establish, where the funds moved, whether they touched a cooperative exchange, and whether a legal process exists that can be brought to bear.
- Phrases like guaranteed recovery, one hundred percent success rate, or we always get funds back should be treated as immediate red flags
- A specific recovery timeline given before any actual tracing work has started is not a sign of competence, it is a sign of a script
- Be equally cautious of firms that claim unusually high self reported success rates without any independent way to verify those figures
Warning Sign Three: Payment Structure
This is where the clearest, most objective line exists. A legitimate firm bills for the investigative work it performs, such as blockchain tracing, case documentation, and legal coordination, and is generally transparent about that fee structure regardless of outcome. A scam demands payment framed as a precondition to releasing funds that supposedly already exist, calling it a release fee, a tax on the recovered amount, a processing charge, or a small deposit to verify your receiving account.
If any part of the pitch involves paying money, or sending cryptocurrency, in order to unlock or release other money that is described as already recovered or already found, that is not a fee. That is the scam.
Warning Sign Four: They Ask for Your Seed Phrase or Private Key
There is no legitimate scenario in which a recovery firm, an investigator, or a government agency needs your seed phrase or private key to trace stolen funds or to pursue legal action. Tracing works entirely from public blockchain data and the transaction details you already have, such as wallet addresses and transaction hashes. A request for your seed phrase or private key, framed as necessary to access, verify, or retrieve your funds, should end the conversation immediately, no matter how the request is worded.
Warning Sign Five: Fake Credentials and Impersonation
Sophisticated recovery scams increasingly use fabricated credentials to build trust quickly. This has included fake employee identification badges, doctored government letterhead, spoofed phone numbers that appear to show an official agency's number, and in more recent cases, AI generated video or cloned voice messages designed to seem like a real representative. The FBI has specifically noted a rise in scammers impersonating IC3 employees using exactly these tactics.
- Government agencies like the FBI's IC3 do not maintain social media accounts through which they contact individual victims
- Real government agencies will never ask you to communicate through encrypted messaging apps or social media direct messages
- A badge photo, a letterhead document, or a case number can all be fabricated, and none of them constitute independent verification on their own
Warning Sign Six: No Verifiable Business Footprint
Legitimate firms can generally be verified independently, through business registration records, a findable and consistent online presence that predates your contact with them, and named staff who can be researched separately from what the firm itself claims about them. A firm with only a generic website built recently, no verifiable address, and communication limited to a single messaging app or anonymous email address is not offering you enough to verify who you are actually dealing with.
Warning Sign Seven: Artificial Urgency and Pressure
Nearly every version of this scam includes some form of manufactured time pressure, a claim that the frozen funds will be released to someone else, that a legal deadline is about to pass, or that the wallet holding the funds will only stay accessible for a limited window. This pressure exists for a single reason: it is much harder to spot inconsistencies in a story, or to take the time to independently verify who you are dealing with, when you believe you have to decide within the hour. Genuine investigative and legal processes involving blockchain assets do not move on artificial hourly deadlines. Tracing takes time to do properly, legal filings take time to prepare, and an exchange does not release funds based on a countdown timer communicated by a third party contacting you directly.
If you notice yourself feeling rushed by a recovery offer, treat the urgency itself as a data point. Slow down deliberately, tell someone else what is happening before making any payment, and remember that a legitimate opportunity to pursue recovery does not disappear because you took a day to verify who you were talking to.
A Worked Example: Comparing Two Offers Side by Side
It helps to see the contrast directly. Offer one arrives unsolicited through a direct message days after a public post about a loss, claims to have already located the funds, quotes a specific recovery amount, and asks for a release fee paid in cryptocurrency before any documentation is shared, with a 24 hour deadline attached. Offer two comes from a firm the victim found independently through a search and a referral, has a real business address and named staff who can be found through separate channels, is explicit that recovery is not guaranteed and depends on where the funds can be shown to have gone, proposes a scope of work with a fee tied to the investigative work itself, and puts terms in a written agreement before any payment or sensitive information is exchanged.
The difference is not tone or professionalism, since both can sound polished. The difference is structural: who initiated contact, whether a specific outcome was promised before any work began, whether payment is tied to unlocking an already found amount versus billing for work performed, and whether the firm can be independently verified. Applying those four checks consistently is more reliable than judging based on how convincing an offer feels.
What Legitimate Engagement Actually Looks Like
When you approach a legitimate investigative or legal firm for help, expect a process that looks intentionally unhurried compared to a scam pitch. That typically includes an initial intake where you describe what happened and share the documentation you have gathered, a written scope of work or engagement letter describing what will actually be done, an honest conversation about whether the case has a realistic path forward given where the funds appear to have gone, and a fee structure tied to the work itself rather than a promised outcome. None of this happens within an hour of first contact, and that is by design, not a red flag.
A Short Verification Checklist
- Did I contact them first, or did they contact me
- Have they promised a specific outcome or dollar amount before reviewing my case
- Are they asking me to pay anything before delivering any actual work, or to send crypto to release other crypto
- Have they asked for my seed phrase or private key in any form
- Can I verify their business registration, physical address, and named staff independently of what they have told me
- If they claim to represent a government agency, have I confirmed that independently by going directly to that agency's official website
If any of these checks fail, walk away from the offer, regardless of how urgent or time sensitive they claim it is. Urgency itself is a manipulation tactic common to nearly every version of this scam. Genuine investigative work does not depend on you deciding within the hour. For the correct sequence of what to actually do instead, see our guide on what to do after a crypto scam.
Frequently asked questions
Yes, this is different from a seed phrase or private key. Wallet addresses and transaction hashes are already public on the blockchain and are the basic information a legitimate investigator needs to begin tracing. What you should never share is your seed phrase, private key, or any credential that grants control over a wallet.
Look for independently verifiable business registration, a physical address, a consistent online presence and reviews that predate your contact with them, and named staff you can research separately. Search the company name along with words like scam or complaint, and be cautious if search results are dominated by the company's own content with no independent coverage at all.
This does not confirm legitimacy. Many recovery scammers obtain real case details from public posts, scraped reports, or purchased victim lists, and use those specifics deliberately to seem credible. Treat accurate case knowledge as a sign the scammer did research, not as proof they can help.
Yes. Reporting the attempted contact to IC3 and the FTC, along with any identifying details such as messages, phone numbers, or website URLs, helps agencies track the pattern and can protect other potential victims, even if you personally lost nothing.
Legitimate firms typically need to review documentation, assess whether the facts support a realistic path forward, and prepare a proper engagement scope before committing to work, none of which can be done responsibly within minutes. A scam has no real investigative work to perform, so it can respond instantly and promise fast results with no actual constraint holding it back.
Sources and further reading
- FBI Warns of Scammers Impersonating the IC3 · Internet Crime Complaint Center, Federal Bureau of Investigation
- Fictitious Law Firms Targeting Cryptocurrency Scam Victims Offering to Recover Funds · Internet Crime Complaint Center, Federal Bureau of Investigation
- Refund and Recovery Scams · Federal Trade Commission