Buyer protection · 2026
How to spot a crypto recovery scam
Search for “crypto recovery” and the results are dominated by operators promising guaranteed fund recovery for a fee — most of them unverifiable, some outright fraudulent. If you've lost crypto to a hack, scam, or drainer attack, the pressure to find someone who can “get it back” is real, and that pressure is exactly what these operators exploit. This guide walks through the specific red flags, how to verify a firm before you engage it, and what a legitimate investigation actually looks like.
The guaranteed-recovery red flag
The single clearest warning sign in this market is a specific number: a claimed success rate of 95–100%. Crypto tracing is genuinely uncertain — recovery depends on whether funds passed through a mixer, how fast the case was reported, and whether the receiving exchange can be legally compelled to act. No legitimate forensics firm can promise a specific recovery outcome before reviewing a case, because the outcome depends on facts the firm doesn't control until it has actually looked at the evidence.
Watch for this combination, specifically:
- A guaranteed or near-100% success rate quoted before any case review
- Contact available only through WhatsApp or Telegram, with no corporate phone line or physical address
- No verifiable registered company behind the service — a name and a chat handle, nothing else
Any one of these alone isn't necessarily disqualifying — a lot of legitimate consulting happens over messaging apps, and plenty of real firms use WhatsApp as one contact channel among several. What matters is whether it's the only channel, and whether it's paired with a guaranteed outcome. A real investigator will tell you upfront that recovery isn't guaranteed; an operator with nothing to lose will tell you whatever keeps you paying.
It also helps to notice what a scam pitch spends its time on. Legitimate firms describe process — what they'll check, what they need from you, how long it typically takes. Scam pitches spend most of their time on the outcome: the dollar figure you'll get back, how fast, and how confident they are. If a pitch is heavier on promises than on process, that imbalance is itself informative.
Due diligence
How to verify a firm's legitimacy
Before engaging any crypto forensics or recovery provider, check for these five things. None of them take more than a few minutes.
-
A registered company in a named jurisdiction
A real forensics firm can tell you exactly where it's incorporated and usually has a public registration number you can look up. If a provider is vague about this — “we operate globally” without a specific answer — that vagueness is itself a direct answer to a direct question they're avoiding.
-
A published case-acceptance process
Legitimate investigative firms review a case before taking it — checking whether there's enough on-chain evidence (transaction hashes, wallet addresses) to realistically trace anything. Some firms apply a minimum reported-loss threshold before accepting a case at all, since very small cases often lack the evidence base to justify a full investigation.
-
A described methodology, not just a promised outcome
Terms like cluster analysis, cross-chain tracing, or transaction de-mixing should map to an actual explanation of what the firm does with your case — how it moves from your submitted evidence to a conclusion — not just marketing copy repeating the same buzzwords without substance.
-
A verifiable corporate footprint
Look for the company on professional networks, past media coverage, conference speaker listings, or partnership announcements with recognized blockchain-analytics vendors. An operator with zero footprint outside its own website and a handful of testimonials is a red flag, regardless of how professional the website looks.
-
A named point of contact you can hold accountable
A legitimate firm will put a named investigator or account manager on your case, not rotate you between anonymous chat handles. If nobody will put their name to the work, ask why.
None of these checks take more than a few minutes each, and a legitimate firm won't be bothered by you asking. An operator that gets defensive or evasive when you ask basic verification questions is telling you something important.
Pressure tactics
Upfront-fee pressure and other manipulation tactics
Beyond the guaranteed-recovery claim, these five patterns show up again and again.
-
Full payment demanded before any work starts
Legitimate firms typically structure fees around the investigation itself, not a lump sum collected purely on the promise of a result. Some structure fees in stages tied to what's actually delivered at each point — a case-acceptance review, then the investigation itself, then the report.
-
Manufactured urgency
“Your funds will be unrecoverable in 24 hours unless you pay now.” Blockchain transactions don't work on artificial deadlines like this; the traceability of a transaction depends on how the funds have already moved, not on how fast you sign a contract. Urgency is a pressure tactic, not a technical reality.
-
Testimonials that can't be verified
A named “victim” success story with no way to confirm it happened is not evidence — it's copy. Ask whether you can speak to a past client directly, or check for any independent mention of the case elsewhere.
-
A second “recovery agent” appearing mid-process
A known follow-on scam pattern: after paying an initial recovery service, victims are contacted by a second party claiming they can recover the money already lost to the first scam — for another fee. Treat any unsolicited follow-up offer with the same scrutiny as the original pitch.
-
Requests to move funds “to a safe wallet” the firm controls
A legitimate investigator traces and reports; it does not need custody of any remaining assets you still hold to do that work.
The real process
What a legitimate investigation actually looks like
-
Evidence submission
You provide transaction hashes (TXIDs), wallet addresses, and a description of what happened. A firm that skips this step and jumps straight to a fee quote hasn't actually looked at your case yet.
-
Case-acceptance review
The firm assesses whether there's enough on-chain evidence to proceed, and whether the case meets its acceptance criteria. This can take anywhere from a day to a couple of weeks depending on complexity, and it's normal for a firm to decline a case at this stage.
-
Investigation
Cluster analysis, cross-chain tracing, and attribution work, depending on how the funds moved. This is the longest stage, and its length is genuinely unpredictable at the outset — a firm that quotes a fixed timeline before starting is guessing.
-
Report or expert testimony
A documented forensic report, sometimes supporting a legal claim or law-enforcement referral, occasionally including expert-witness testimony if the case goes to court. The report should explain the methodology used, not just state a conclusion.
Nowhere in that process is there a guaranteed dollar figure promised on day one. If a firm skips straight from your first message to a specific recovery number, it has skipped the part of the process where that number could actually be justified.
Where to find vetted providers
Once you've ruled out the guaranteed-recovery pattern above, the practical next step is comparing providers that pass the verification checklist in this guide — a registered entity, a described methodology, a real case-acceptance process, and a footprint that exists outside their own marketing. We've done that comparison for the UAE market specifically, covering both institutional analytics platforms and firms you can hire directly to run an investigation.
FAQ
Recovery questions, answered plainly
Can I actually get stolen crypto back?
Sometimes. Recovery depends heavily on how quickly you report the incident, whether the funds passed through a mixer or cross-chain bridge, and whether the receiving platform can be compelled to freeze assets. Fast reporting meaningfully improves the odds.
What should a legitimate investigation cost?
There's no fixed industry rate — cost depends on case complexity, the number of chains and wallets involved, and whether expert testimony is required. Be skeptical of any provider quoting a fixed low price before reviewing your case.
Should I ever pay 100% upfront?
Be cautious of any firm that demands full payment before starting any work, especially when combined with a guaranteed-outcome promise. Ask what the fee structure covers and at what stages you're billed.
Is it normal for a firm to decline my case?
Yes. Legitimate firms apply case-acceptance criteria — if there isn't enough on-chain evidence to trace, or the loss falls below a firm's minimum threshold, a real investigator will tell you that rather than take your money regardless.
How can I check if a company is really registered where it claims to be?
Most jurisdictions publish a public company registry you can search by name or registration number. If a provider gives you a company name and jurisdiction, that lookup takes a few minutes and either confirms or contradicts what you were told — a discrepancy here is a hard stop, not a minor detail.
What should I do if I've already paid a suspicious recovery service?
Stop any further payment immediately, preserve all communication and transaction records, and report the incident to your local cybercrime authority — in the UAE, that typically means the police cybercrime unit. A second “recovery” pitch following the first payment is a known follow-on scam pattern, not a legitimate rescue offer.