Fraud · How to spot it
The five recovery scams and how to avoid them
They all do the same thing: find someone who has just lost money and sell them hope. Only the staging changes. Here are the five recurring shapes, the specific tell that gives each away, and the short checklist you should also apply to me.
1. The advance fee
It is the mother of all the others. “We can recover your funds; we only need to cover the analysis / the software licence / the gas for the release transaction.” It works because it is plausible: technical services do charge, and the amount asked is always small next to what you lost.
What gives it away is not the amount but the sequence: when you pay the first fee a second one appears — taxes, miner fee, conversion charge, insurance — and so on until you stop paying. And one technical detail closes it: there is no such thing as a “release transaction”. Moving funds requires the key, not a payment. If they had the key, they would already have taken the money without telling you.
2. The fake ethical hacker
It shows up in the comments of a video about lost wallets, or replying to the post where you told your problem in public. “Contact specialist so-and-so, they got my 4 ETH back in two days.” Underneath, three or four enthusiastic testimonials from accounts created that same week.
The tell is the direction of contact: they found you, and they did it in public, in a place where you have just demonstrated that you are desperate. A real service does not trawl for victims in social media replies, not least because it does not need to.
3. The phrase validator and the miracle software
“Enter your phrase and we will check whether it is valid.” “Download this program: it scans the chain looking for your wallet.” What the site or the program does is send your phrase to someone else’s server, and the draining is usually automatic and takes seconds. It is the most profitable of the five because it never has to convince you to pay anything.
The tell is simple: anything asking you to type the phrase somewhere that is not your own wallet. Validating a BIP-39 phrase is a piece of arithmetic done offline with no third party; needing a server for it is itself the confession.
4. The recovery of the recovery
A “law firm”, a “digital asset recovery agency” or someone claiming to represent an official body writes to you, offering to recover what was stolen in the previous scam. They know your case in detail because they work from victim lists, sometimes bought from the very people who scammed you the first time.
Two tells, and they are enough: they took the initiative and there is an up-front payment, dressed as a court fee, a retainer or a refundable deposit. No authority charges you to give your money back, and none opens a case over instant messaging.
5. Impersonation
A clone of your wallet maker’s site, a sponsored ad placed above the genuine result, an “official support” account that answers within a minute in the chat where you asked. Everything identical except one detail in the domain, and the “restore wallet” form is the trap.
The tell is how you got there: through an ad, a link you were sent, or a search engine. Type the domain by hand, always. And remember that legitimate support at any manufacturer never initiates contact by private message.
The short checklist, for any provider (me included)
- Do they ask for money before a verifiable result exists?
- Do they ask for the recovery phrase or the private key at any point?
- Do they guarantee the outcome, or even hint at it?
- Do they offer to move or hold the funds “for safety”?
- Do they rush you: limited slots, expiring offers, urgency?
- Do they have a verifiable identity, a written contract and an invoice?
- Can they explain in detail what they cannot do?
The first six are knockouts: one bad answer is enough to walk away. The seventh is the one that best separates a technician from a salesperson, because it requires actually knowing where the limit is.
If you have already fallen for one
- Stop paying. The next fee will not unlock anything. There never is one.
- Delete nothing. Conversations, emails, screenshots, addresses, transaction ids, usernames, phone numbers. All of it is the case file.
- Report it. In Spain, to the Policía Nacional or the Guardia Civil; keep a copy of the report. If a bank transfer was involved, tell the bank immediately.
- Be realistic about what follows. The addresses you sent to are recorded forever, and if the money passed through a centralised service there is a legal route — slow, and requiring a court order. It is unlikely, but it is the only real thing on offer. Anyone promising something faster is the next one in line.
- Distrust whoever appears right afterwards. Reporting puts you into circulation: the recovery-of-the-recovery arrives exactly then.