Discovering that a crypto investment was fraudulent can trigger panic, anger, embarrassment, and a strong urge to act immediately. The first few hours matter, but rushing into another payment or trusting an unsolicited “recovery expert” can make the situation worse. A disciplined response is usually more useful than an emotional one.
Crypto investment scams often involve fake trading platforms, fabricated account balances, impersonated brokers, romance-based investment schemes, or social-media groups that promise unusually high returns. The technology can make the trail look complicated, but victims can still take practical steps to preserve information and improve their chances of understanding what happened.
This guide focuses on the first 72 hours. It does not promise that stolen funds can be recovered. Instead, it explains how to stabilize the situation, preserve evidence, notify relevant institutions, and avoid secondary scams.
1. Stop Sending Money
The first step is simple: stop making payments. A scammer may claim that another transfer is required to unlock a withdrawal, pay a tax, complete verification, release a wallet, or settle a compliance charge. These demands are frequently presented as urgent and final, but paying again does not establish that a legitimate withdrawal will occur.
Do not send a “recovery fee,” “blockchain validation fee,” “AML deposit,” or similar payment simply because someone says it is necessary to retrieve your money. A new person who contacts you after the original loss and promises guaranteed recovery should also be treated cautiously.
If the scammer still has access to your accounts, stopping communication should be combined with account-security steps. Do not delete the conversation before preserving it, because messages may later help explain the sequence of events. Another useful principle is to keep this step separate from conclusions about the identity of the perpetrator. At this stage, document what can be independently established: the account used, the instruction received, the payment made, the date and time, and the resulting record. This approach reduces errors and makes later review much easier.
It is also worth preserving the context around the event. A single screenshot may show an amount or message, but surrounding conversation, timestamps, account identifiers, and related records can explain why the transaction occurred. When information is missing, mark it as unknown rather than filling the gap with assumptions. A reliable record is more valuable than a confident but unsupported explanation.
2. Secure Your Accounts and Devices
Change passwords for email, cryptocurrency exchanges, banking services, and any account that may have been exposed. Use unique passwords and enable multi-factor authentication where available. If a scammer had remote access to your computer or phone, disconnecting the device from the internet while assessing it can be sensible.
Check whether email forwarding rules, recovery addresses, unfamiliar devices, API keys, or active sessions were added. For cryptocurrency services, review withdrawal addresses, API permissions, and connected applications. If you use a hardware wallet, do not disclose the seed phrase to anyone. Legitimate support personnel should not need your private recovery phrase.
If banking credentials or card information were exposed, contact the bank through an official channel rather than a number supplied by the person who contacted you. Ask what protective measures are appropriate for the account. Another useful principle is to keep this step separate from conclusions about the identity of the perpetrator. At this stage, document what can be independently established: the account used, the instruction received, the payment made, the date and time, and the resulting record. This approach reduces errors and makes later review much easier.
It is also worth preserving the context around the event. A single screenshot may show an amount or message, but surrounding conversation, timestamps, account identifiers, and related records can explain why the transaction occurred. When information is missing, mark it as unknown rather than filling the gap with assumptions. A reliable record is more valuable than a confident but unsupported explanation.
3. Preserve Evidence Before It Disappears
Evidence is one of the most valuable things a victim can preserve. Save screenshots of the website, account dashboard, wallet addresses, transaction IDs, payment receipts, emails, chat messages, usernames, phone numbers, domain names, and social-media profiles.
Keep original files where possible rather than editing screenshots. Record dates and times and note which platform was used for each conversation. If you were asked to install remote-access software, record the application name and the date it was installed.
For blockchain transactions, save the transaction hash and the sending and receiving wallet addresses. A transaction hash can help distinguish one transfer from another and may allow investigators or service providers to trace subsequent movements on a public blockchain. Blockchain tracing does not automatically mean funds can be recovered, but accurate transaction information is much more useful than a vague statement such as “I sent crypto to a scammer.” Another useful principle is to keep this step separate from conclusions about the identity of the perpetrator. At this stage, document what can be independently established: the account used, the instruction received, the payment made, the date and time, and the resulting record. This approach reduces errors and makes later review much easier.
It is also worth preserving the context around the event. A single screenshot may show an amount or message, but surrounding conversation, timestamps, account identifiers, and related records can explain why the transaction occurred. When information is missing, mark it as unknown rather than filling the gap with assumptions. A reliable record is more valuable than a confident but unsupported explanation.
4. Build a Clear Timeline
Create a chronological record while the details are fresh. Start with the first contact and continue through the final payment. Include what the scammer claimed, what you were asked to do, which payment method was used, and when each transfer occurred.
A simple table can contain: date and time, communication channel, person or account involved, amount, currency, destination, transaction reference, and supporting evidence. If several wallets were used, list each one separately.
This timeline can reveal patterns that are difficult to see during a stressful event. It may also help distinguish deposits, transfers, withdrawals, refunds, and additional payments that were presented as fees. Accuracy matters more than dramatic descriptions. Another useful principle is to keep this step separate from conclusions about the identity of the perpetrator. At this stage, document what can be independently established: the account used, the instruction received, the payment made, the date and time, and the resulting record. This approach reduces errors and makes later review much easier.
It is also worth preserving the context around the event. A single screenshot may show an amount or message, but surrounding conversation, timestamps, account identifiers, and related records can explain why the transaction occurred. When information is missing, mark it as unknown rather than filling the gap with assumptions. A reliable record is more valuable than a confident but unsupported explanation.
5. Contact the Payment Providers
If money moved through a bank, card, payment app, or cryptocurrency exchange, contact the relevant provider promptly. Explain that the transaction is connected to suspected fraud and ask what reporting or dispute procedures are available.
For bank transfers, the bank may be able to place a fraud note on the account or investigate whether a payment can be recalled. Card transactions may have different dispute procedures. Cryptocurrency transactions are generally difficult to reverse once confirmed, but the exchange or service used to send the funds may still have fraud-reporting processes.
Give providers the transaction details they request. Avoid exaggerating or changing facts. A concise factual report is more useful than a long narrative that leaves uncertainty about what actually happened. Another useful principle is to keep this step separate from conclusions about the identity of the perpetrator. At this stage, document what can be independently established: the account used, the instruction received, the payment made, the date and time, and the resulting record. This approach reduces errors and makes later review much easier.
It is also worth preserving the context around the event. A single screenshot may show an amount or message, but surrounding conversation, timestamps, account identifiers, and related records can explain why the transaction occurred. When information is missing, mark it as unknown rather than filling the gap with assumptions. A reliable record is more valuable than a confident but unsupported explanation.
6. Report the Scam
Depending on your country, report the fraud to the appropriate law-enforcement, cybercrime, financial-regulatory, and consumer-protection authorities. Reporting may not result in an immediate refund, but reports can help authorities identify related cases and establish patterns.
Keep copies of every report number, submission receipt, and correspondence. If an exchange or financial institution asks for a police or cybercrime report, you will already have the information organized.
If the scam involved impersonation of a real company or professional, consider reporting the impersonation to the legitimate organization as well. This can sometimes help the organization warn other customers. Another useful principle is to keep this step separate from conclusions about the identity of the perpetrator. At this stage, document what can be independently established: the account used, the instruction received, the payment made, the date and time, and the resulting record. This approach reduces errors and makes later review much easier.
It is also worth preserving the context around the event. A single screenshot may show an amount or message, but surrounding conversation, timestamps, account identifiers, and related records can explain why the transaction occurred. When information is missing, mark it as unknown rather than filling the gap with assumptions. A reliable record is more valuable than a confident but unsupported explanation.
7. Be Alert for Recovery Scams
A second scam often follows the first. Fraudsters may discover victims through social-media posts, public complaints, hacked databases, or scam-recovery advertisements. They may claim to be lawyers, blockchain investigators, government officials, hackers, or former insiders.
Warning signs include guaranteed recovery, requests for cryptocurrency-only fees, pressure to act immediately, claims that a private connection can unlock a frozen wallet, and demands for seed phrases or remote computer access.
A legitimate professional should be willing to explain what they can actually do, what they cannot guarantee, how fees are calculated, and what legal or technical process they will use. Verification should be performed independently using contact details from an official source. Another useful principle is to keep this step separate from conclusions about the identity of the perpetrator. At this stage, document what can be independently established: the account used, the instruction received, the payment made, the date and time, and the resulting record. This approach reduces errors and makes later review much easier.
It is also worth preserving the context around the event. A single screenshot may show an amount or message, but surrounding conversation, timestamps, account identifiers, and related records can explain why the transaction occurred. When information is missing, mark it as unknown rather than filling the gap with assumptions. A reliable record is more valuable than a confident but unsupported explanation.
8. What Recovery Can Realistically Mean
Recovery outcomes vary significantly. In some cases, funds may be frozen or intercepted before they move through additional services. In other cases, the money may move through multiple wallets or services, making recovery difficult. Traditional bank payments can have different possibilities from confirmed cryptocurrency transfers.
The strongest approach is to separate three goals: stopping further loss, documenting the incident, and pursuing any legitimate recovery avenue. Do not measure success only by whether the entire amount is returned.
A careful investigation can still provide value when a full recovery is not possible. It can identify the infrastructure used, clarify where the money went, protect other accounts, and produce a better record for authorities or professional advisers. Another useful principle is to keep this step separate from conclusions about the identity of the perpetrator. At this stage, document what can be independently established: the account used, the instruction received, the payment made, the date and time, and the resulting record. This approach reduces errors and makes later review much easier.
It is also worth preserving the context around the event. A single screenshot may show an amount or message, but surrounding conversation, timestamps, account identifiers, and related records can explain why the transaction occurred. When information is missing, mark it as unknown rather than filling the gap with assumptions. A reliable record is more valuable than a confident but unsupported explanation.
