A cryptocurrency scam can leave victims unsure what to do first. The situation becomes easier to manage when broken into a sequence: stop further loss, secure accounts, preserve evidence, notify providers, report the fraud, and evaluate legitimate investigative options.
This checklist is designed for practical use. It does not promise recovery, and it should not replace legal, financial, or cybersecurity advice when a case is complex.
Step 1: Stop Contact and Payments
Stop sending money to the scammer and do not pay new fees requested to release previous funds. Preserve the communication before blocking or deleting accounts.
If you believe the scammer still has access to an account, prioritize security rather than continued conversation. Another useful principle is to keep this step separate from conclusions about the identity of the perpetrator. At this stage, document what can be independently established: the account used, the instruction received, the payment made, the date and time, and the resulting record. This approach reduces errors and makes later review much easier.
It is also worth preserving the context around the event. A single screenshot may show an amount or message, but surrounding conversation, timestamps, account identifiers, and related records can explain why the transaction occurred. When information is missing, mark it as unknown rather than filling the gap with assumptions. A reliable record is more valuable than a confident but unsupported explanation.
Step 2: Secure Email and Financial Accounts
Change exposed passwords, enable multi-factor authentication, review active sessions, and remove unauthorized applications or API permissions.
If banking or card credentials may have been compromised, contact the financial institution using official contact information. Another useful principle is to keep this step separate from conclusions about the identity of the perpetrator. At this stage, document what can be independently established: the account used, the instruction received, the payment made, the date and time, and the resulting record. This approach reduces errors and makes later review much easier.
It is also worth preserving the context around the event. A single screenshot may show an amount or message, but surrounding conversation, timestamps, account identifiers, and related records can explain why the transaction occurred. When information is missing, mark it as unknown rather than filling the gap with assumptions. A reliable record is more valuable than a confident but unsupported explanation.
Step 3: Preserve the Evidence
Save conversations, emails, websites, screenshots, payment receipts, wallet addresses, transaction hashes, usernames, phone numbers, and domain names.
Keep original evidence separate from working copies. Create a folder structure based on dates or evidence categories. Another useful principle is to keep this step separate from conclusions about the identity of the perpetrator. At this stage, document what can be independently established: the account used, the instruction received, the payment made, the date and time, and the resulting record. This approach reduces errors and makes later review much easier.
It is also worth preserving the context around the event. A single screenshot may show an amount or message, but surrounding conversation, timestamps, account identifiers, and related records can explain why the transaction occurred. When information is missing, mark it as unknown rather than filling the gap with assumptions. A reliable record is more valuable than a confident but unsupported explanation.
Step 4: Build a Loss Summary
Calculate the total amount sent and separate it by payment method. For crypto, record the asset and network used. For bank or card payments, record the institution and transaction reference.
A precise loss summary prevents confusion when multiple payments occurred over weeks or months. Another useful principle is to keep this step separate from conclusions about the identity of the perpetrator. At this stage, document what can be independently established: the account used, the instruction received, the payment made, the date and time, and the resulting record. This approach reduces errors and makes later review much easier.
It is also worth preserving the context around the event. A single screenshot may show an amount or message, but surrounding conversation, timestamps, account identifiers, and related records can explain why the transaction occurred. When information is missing, mark it as unknown rather than filling the gap with assumptions. A reliable record is more valuable than a confident but unsupported explanation.
Step 5: Contact Providers
Notify banks, card companies, exchanges, wallet providers, and payment services involved in the transactions. Ask what fraud-reporting procedures are available.
Do not assume that a cryptocurrency transaction can be reversed. Ask the provider what specific actions are possible. Another useful principle is to keep this step separate from conclusions about the identity of the perpetrator. At this stage, document what can be independently established: the account used, the instruction received, the payment made, the date and time, and the resulting record. This approach reduces errors and makes later review much easier.
It is also worth preserving the context around the event. A single screenshot may show an amount or message, but surrounding conversation, timestamps, account identifiers, and related records can explain why the transaction occurred. When information is missing, mark it as unknown rather than filling the gap with assumptions. A reliable record is more valuable than a confident but unsupported explanation.
Step 6: Report the Incident
Use the cybercrime, law-enforcement, financial-regulatory, or consumer-protection reporting channels appropriate to your jurisdiction.
Keep copies of report numbers and submitted evidence. Another useful principle is to keep this step separate from conclusions about the identity of the perpetrator. At this stage, document what can be independently established: the account used, the instruction received, the payment made, the date and time, and the resulting record. This approach reduces errors and makes later review much easier.
It is also worth preserving the context around the event. A single screenshot may show an amount or message, but surrounding conversation, timestamps, account identifiers, and related records can explain why the transaction occurred. When information is missing, mark it as unknown rather than filling the gap with assumptions. A reliable record is more valuable than a confident but unsupported explanation.
Step 7: Document the Blockchain Trail
For crypto transfers, use the transaction hash to document where the funds moved. Record subsequent destinations without making unsupported claims about who controls them.
If funds appear to reach a known service, preserve the evidence and use the service’s official fraud or legal reporting route. Another useful principle is to keep this step separate from conclusions about the identity of the perpetrator. At this stage, document what can be independently established: the account used, the instruction received, the payment made, the date and time, and the resulting record. This approach reduces errors and makes later review much easier.
It is also worth preserving the context around the event. A single screenshot may show an amount or message, but surrounding conversation, timestamps, account identifiers, and related records can explain why the transaction occurred. When information is missing, mark it as unknown rather than filling the gap with assumptions. A reliable record is more valuable than a confident but unsupported explanation.
Step 8: Assess Recovery Providers Carefully
Do not hire a recovery provider simply because it contacted you first. Verify the provider independently and demand a written scope of work and transparent fees.
Reject guaranteed recovery claims and any request for wallet seed phrases or private keys. Another useful principle is to keep this step separate from conclusions about the identity of the perpetrator. At this stage, document what can be independently established: the account used, the instruction received, the payment made, the date and time, and the resulting record. This approach reduces errors and makes later review much easier.
It is also worth preserving the context around the event. A single screenshot may show an amount or message, but surrounding conversation, timestamps, account identifiers, and related records can explain why the transaction occurred. When information is missing, mark it as unknown rather than filling the gap with assumptions. A reliable record is more valuable than a confident but unsupported explanation.
Step 9: Protect Yourself From a Second Scam
Do not post your complete transaction details, phone number, or personal information publicly. Recovery scammers may target victims who announce that they have lost cryptocurrency.
Be cautious with unsolicited messages that appear to know details about your original case. Another useful principle is to keep this step separate from conclusions about the identity of the perpetrator. At this stage, document what can be independently established: the account used, the instruction received, the payment made, the date and time, and the resulting record. This approach reduces errors and makes later review much easier.
It is also worth preserving the context around the event. A single screenshot may show an amount or message, but surrounding conversation, timestamps, account identifiers, and related records can explain why the transaction occurred. When information is missing, mark it as unknown rather than filling the gap with assumptions. A reliable record is more valuable than a confident but unsupported explanation.
Step 10: Take Care of the Practical Aftermath
Update passwords, review credit or financial-account security where appropriate, preserve tax and accounting records, and inform trusted family members if their accounts may be affected.
The objective is to prevent the original incident from becoming a broader compromise. Another useful principle is to keep this step separate from conclusions about the identity of the perpetrator. At this stage, document what can be independently established: the account used, the instruction received, the payment made, the date and time, and the resulting record. This approach reduces errors and makes later review much easier.
It is also worth preserving the context around the event. A single screenshot may show an amount or message, but surrounding conversation, timestamps, account identifiers, and related records can explain why the transaction occurred. When information is missing, mark it as unknown rather than filling the gap with assumptions. A reliable record is more valuable than a confident but unsupported explanation.
