After an investment scam, victims may receive messages from people claiming to be lawyers, investigators, blockchain analysts, or government-connected recovery specialists. Some may even know details about the original fraud.
This information does not prove that the new contact is legitimate. Secondary scammers can obtain victim information from public complaints, compromised data, or the original fraud operation itself.
1. Verify the Person
Ask for the person’s full professional name, organization, jurisdiction, office address, and professional registration where applicable. Verify those details through an independent official directory.
Do not rely on a certificate or license number displayed on the person’s website.
### Practical note on 1. verify the person
Keep a written record of the action taken at this stage and the source of the information used to make the decision. If another person later reviews the case, they should be able to understand what was known at the time and why the action was taken. This is particularly useful when an incident involves several payments or multiple people communicating under different names.
It is also important to avoid turning an investigation into a confrontation. Do not threaten suspected individuals, attempt unauthorized access to accounts, or publish unverified accusations. Those actions can create additional security, legal, and evidentiary problems. Use legitimate institutional and professional channels instead.
Where information cannot be verified, label it clearly as an allegation or an unresolved point. A case built around accurate uncertainty is stronger than one built around assumptions that later prove incorrect.
2. Verify the Organization
Check the legal identity of the organization and whether it has a consistent professional history. Look for an address, responsible personnel, and independent references.
Be cautious when an organization exists only through a newly created website or social-media profile.
### Practical note on 2. verify the organization
Keep a written record of the action taken at this stage and the source of the information used to make the decision. If another person later reviews the case, they should be able to understand what was known at the time and why the action was taken. This is particularly useful when an incident involves several payments or multiple people communicating under different names.
It is also important to avoid turning an investigation into a confrontation. Do not threaten suspected individuals, attempt unauthorized access to accounts, or publish unverified accusations. Those actions can create additional security, legal, and evidentiary problems. Use legitimate institutional and professional channels instead.
Where information cannot be verified, label it clearly as an allegation or an unresolved point. A case built around accurate uncertainty is stronger than one built around assumptions that later prove incorrect.
3. Ask What Legal Authority Exists
A legitimate professional should be able to explain what process they intend to use. Ask whether they are providing legal advice, investigative services, technical analysis, or administrative assistance.
A person cannot create legal authority simply by calling themselves an investigator or recovery agent.
### Practical note on 3. ask what legal authority exists
Keep a written record of the action taken at this stage and the source of the information used to make the decision. If another person later reviews the case, they should be able to understand what was known at the time and why the action was taken. This is particularly useful when an incident involves several payments or multiple people communicating under different names.
It is also important to avoid turning an investigation into a confrontation. Do not threaten suspected individuals, attempt unauthorized access to accounts, or publish unverified accusations. Those actions can create additional security, legal, and evidentiary problems. Use legitimate institutional and professional channels instead.
Where information cannot be verified, label it clearly as an allegation or an unresolved point. A case built around accurate uncertainty is stronger than one built around assumptions that later prove incorrect.
4. Examine the Fee Structure
Ask for fees in writing before authorizing work. Understand retainers, hourly charges, contingency fees, expenses, and conditions for additional payments.
Repeated requests for unexplained deposits are a warning sign. A “release fee” for cryptocurrency supposedly already recovered should receive particular scrutiny.
### Practical note on 4. examine the fee structure
Keep a written record of the action taken at this stage and the source of the information used to make the decision. If another person later reviews the case, they should be able to understand what was known at the time and why the action was taken. This is particularly useful when an incident involves several payments or multiple people communicating under different names.
It is also important to avoid turning an investigation into a confrontation. Do not threaten suspected individuals, attempt unauthorized access to accounts, or publish unverified accusations. Those actions can create additional security, legal, and evidentiary problems. Use legitimate institutional and professional channels instead.
Where information cannot be verified, label it clearly as an allegation or an unresolved point. A case built around accurate uncertainty is stronger than one built around assumptions that later prove incorrect.
5. Be Careful With Government Claims
Fraudsters may impersonate police officers, regulators, courts, tax authorities, or international organizations. They may send official-looking documents.
Verify the claimed institution through an independently sourced official contact method. Do not use a phone number supplied only in the suspicious message.
### Practical note on 5. be careful with government claims
Keep a written record of the action taken at this stage and the source of the information used to make the decision. If another person later reviews the case, they should be able to understand what was known at the time and why the action was taken. This is particularly useful when an incident involves several payments or multiple people communicating under different names.
It is also important to avoid turning an investigation into a confrontation. Do not threaten suspected individuals, attempt unauthorized access to accounts, or publish unverified accusations. Those actions can create additional security, legal, and evidentiary problems. Use legitimate institutional and professional channels instead.
Where information cannot be verified, label it clearly as an allegation or an unresolved point. A case built around accurate uncertainty is stronger than one built around assumptions that later prove incorrect.
6. Never Share Critical Credentials
No recovery professional should need your wallet seed phrase or private key simply to assess a transaction trail. Do not provide passwords or authentication codes.
If remote access is requested, understand exactly why and consider whether a safer alternative exists.
### Practical note on 6. never share critical credentials
Keep a written record of the action taken at this stage and the source of the information used to make the decision. If another person later reviews the case, they should be able to understand what was known at the time and why the action was taken. This is particularly useful when an incident involves several payments or multiple people communicating under different names.
It is also important to avoid turning an investigation into a confrontation. Do not threaten suspected individuals, attempt unauthorized access to accounts, or publish unverified accusations. Those actions can create additional security, legal, and evidentiary problems. Use legitimate institutional and professional channels instead.
Where information cannot be verified, label it clearly as an allegation or an unresolved point. A case built around accurate uncertainty is stronger than one built around assumptions that later prove incorrect.
7. Demand a Written Scope
A written engagement should explain what work will be done and what deliverables you will receive. It should also describe limitations and conditions for termination.
A vague promise to “recover your funds” is not an adequate description of professional services.
### Practical note on 7. demand a written scope
Keep a written record of the action taken at this stage and the source of the information used to make the decision. If another person later reviews the case, they should be able to understand what was known at the time and why the action was taken. This is particularly useful when an incident involves several payments or multiple people communicating under different names.
It is also important to avoid turning an investigation into a confrontation. Do not threaten suspected individuals, attempt unauthorized access to accounts, or publish unverified accusations. Those actions can create additional security, legal, and evidentiary problems. Use legitimate institutional and professional channels instead.
Where information cannot be verified, label it clearly as an allegation or an unresolved point. A case built around accurate uncertainty is stronger than one built around assumptions that later prove incorrect.
8. Recognize Recovery Theater
Some fraud operations create elaborate stories involving investigators, lawyers, exchange officials, and blockchain specialists. Multiple people may contact the victim to confirm one another’s claims.
This apparent complexity can be deliberate. Independent verification of every participant remains necessary.
### Practical note on 8. recognize recovery theater
Keep a written record of the action taken at this stage and the source of the information used to make the decision. If another person later reviews the case, they should be able to understand what was known at the time and why the action was taken. This is particularly useful when an incident involves several payments or multiple people communicating under different names.
It is also important to avoid turning an investigation into a confrontation. Do not threaten suspected individuals, attempt unauthorized access to accounts, or publish unverified accusations. Those actions can create additional security, legal, and evidentiary problems. Use legitimate institutional and professional channels instead.
Where information cannot be verified, label it clearly as an allegation or an unresolved point. A case built around accurate uncertainty is stronger than one built around assumptions that later prove incorrect.
9. Compare Before Paying
If a significant amount of money is requested, consider obtaining an independent second opinion. Do not let urgency prevent basic due diligence.
A credible professional should be able to explain why a second opinion is reasonable and should not require immediate payment merely to prevent an imaginary deadline.
### Practical note on 9. compare before paying
Keep a written record of the action taken at this stage and the source of the information used to make the decision. If another person later reviews the case, they should be able to understand what was known at the time and why the action was taken. This is particularly useful when an incident involves several payments or multiple people communicating under different names.
It is also important to avoid turning an investigation into a confrontation. Do not threaten suspected individuals, attempt unauthorized access to accounts, or publish unverified accusations. Those actions can create additional security, legal, and evidentiary problems. Use legitimate institutional and professional channels instead.
Where information cannot be verified, label it clearly as an allegation or an unresolved point. A case built around accurate uncertainty is stronger than one built around assumptions that later prove incorrect.
