a coin expert analyzing an old coin

Fake solicitor and WhatsApp crypto-recovery messages: how to verify the warning

Freshness note: Checked 23 September 2026. The SRA, FCA and Report Fraud pages can change, so use the linked official pages rather than relying on copied details in a message.

Fake solicitor and WhatsApp crypto-recovery messages: the short answer

Treat an unexpected offer to recover lost cryptocurrency as a possible recovery-room scam until you have checked it independently. Do not pay a fee, share a recovery phrase or private key, click an unsolicited link, or rely on a solicitor’s name, logo or SRA number supplied in the message.

Open the official SRA Solicitors Register yourself and check the firm or person. If the message also claims to involve a financial firm, check the FCA Firm Checker using the FCA website, not a link or phone number in the message. Keep the messages and payment records, then report suspected fraud through Report Fraud where that service covers you.

This is general safety information, not legal advice. Checking a register does not prove that a particular message is genuine or that any money can be recovered.

What the SRA warning shows

The Solicitors Regulation Authority has warned about emails, WhatsApp messages and a website that misused the name and details of a genuine solicitors’ firm in connection with recovering lost cryptocurrency. The alert says recipients were asked to pay a conversion fee. It also says the people and contact details described in the alert were not authorised or regulated by the SRA.

The lesson is broader than that single alert. A scammer can copy the identity of a real firm or solicitor, use a genuine address, and quote a real registration number. That copied information can make a message look convincing without proving who sent it.

The SRA’s alert advises people to carry out their own checks and to contact a law firm through reliable, established means. Do not use the contact details supplied in an unsolicited WhatsApp message to verify the message. Find the firm through the SRA Register or another trusted source, then use details you obtained independently.

Read the SRA scam alert for the current example. It contains identifying details that are useful to investigators but should not be copied into a reply, social post or contact list.

Why a recovery message can be a second scam

After a person loses money to a crypto scam, their details may be passed around or used again. A new contact may claim to be a solicitor, regulator, investigator, bank representative or specialist who can retrieve the funds. The message may refer to the earlier loss to sound informed.

The FCA describes this as a recovery-room scam. Its guidance warns that fraudsters may offer to get money back after a fee has been paid. The promised fee may be described as a conversion charge, tax, release payment, administrative cost or insurance. Different wording does not change the basic warning: a demand for money before an alleged recovery is a serious risk sign.

Tracing a transaction is not the same as reversing it. A person who says they found a transaction on a blockchain has not thereby shown that they control the recipient’s funds or can return them. Be wary of anyone who promises a result, asks for secrecy or says you must act immediately.

Red flags in a fake solicitor or recovery message

Look for several warning signs together. One sign may be a mistake; a cluster should make you stop.

  • The contact arrives unexpectedly on WhatsApp, by email or through social media.
  • The sender claims to be a solicitor but will not let you verify the firm independently.
  • The message uses a real firm’s name, address, logo or SRA number but the email domain, website or telephone details do not match the official record.
  • It asks for an upfront fee, a conversion payment, tax, a release charge or cryptocurrency before explaining a clear, independently verifiable process.
  • It promises a guaranteed recovery or gives a precise deadline.
  • It asks you to keep the matter secret or says other organisations cannot help.
  • It sends a link to a register, document or payment page and tells you to use that link immediately.
  • It asks for a seed phrase, private key, wallet password, one-time code, remote access or a transfer to a “safe” address.
  • It uses copied documents, official-looking letterheads or references to a genuine bank, regulator or law firm as proof of identity.

A professional tone is not evidence. Neither is a video call, a polished website or knowledge of your previous scam.

How to verify the warning safely

1. Stop the conversation

Do not reply to argue or test the sender. Do not click links, open attachments or download an app. If you have already shared a password, contact the relevant service through its official website and change it from a safe device. Never share a wallet recovery phrase or private key with anyone. If one has been exposed, treat the wallet as at risk and use the wallet’s official security guidance rather than instructions from the message.

2. Check the solicitor through the SRA

Type the SRA website address into your browser or use a saved bookmark. Search the SRA Solicitors Register for the firm and person.

Compare the result with the message, including:

  • the exact firm and person’s name;
  • whether the firm or person is regulated;
  • the firm’s published address and contact details; and
  • whether the claimed role matches the register.

The SRA says its register is the definitive impartial source for the firms and people it regulates. It also warns that no search result is not safe proof that a firm or person is regulated. If the details do not match, stop. If they do match, contact the genuine firm using details you found independently and ask whether the message came from them.

3. Check any financial firm through the FCA

If the sender mentions an investment business, financial adviser, broker or other financial service, use the FCA Firm Checker. Check the firm reference number and contact details against the record. The FCA warns that scammers can impersonate authorised firms, so use the contact information on the FCA site rather than the message.

An FCA listing is not a promise that a recovery offer is genuine, suitable or successful. It does not turn an unsolicited approach into a safe one.

4. Use official reporting routes

The FCA’s scam guidance says to report suspected fraud to the FCA when it concerns something the FCA regulates, and to Report Fraud if money has been lost or the matter is outside the FCA’s remit. Use Report Fraud for the current reporting route and guidance. Report Fraud covers England, Wales and Northern Ireland; its homepage says people in Scotland should report through 101. If you are elsewhere, use the relevant local police or fraud-reporting route.

Do not use a telephone number, email address or web form supplied by the suspected sender. If you are unsure, start from the official regulator or reporting website.

What to preserve before deleting anything

Keep a copy of the evidence in its original form where possible. Preserve:

  • the full WhatsApp conversation, including dates and profile information;
  • emails with their headers, attachments and links;
  • screenshots showing the profile, claims and payment request;
  • the website address as displayed, without visiting it again;
  • payment receipts, bank records and exchange records;
  • transaction IDs, wallet addresses and the network used, if you already have them;
  • documents or letters sent by the contact; and
  • a short timeline of what happened and when.

Do not forward suspicious messages to friends or publish the sender’s contact details. Redact personal information before sharing evidence publicly. Investigators may need the original files, so keep an untouched copy and work from a duplicate if you need to annotate it.

A quick checklist

  • [ ] Stop replying and do not pay an alleged recovery fee.
  • [ ] Do not share a recovery phrase, private key, password or one-time code.
  • [ ] Do not click links or use contact details supplied in the message.
  • [ ] Search the SRA Register independently for any claimed solicitor or firm.
  • [ ] Use the FCA Firm Checker independently if a financial firm is mentioned.
  • [ ] Contact a genuine firm only through details found independently.
  • [ ] Preserve messages, documents, records and transaction information.
  • [ ] Report suspected fraud through the current official route.
  • [ ] Be cautious about further recovery approaches after reporting the first scam.

For wider background, see The Coin Expert’s guide to crypto scams, rug pulls, phishing and fake support, the explanation of crypto wallets, private keys, addresses and seed phrases, and the crypto explained hub.

Sources

Leave a comment