The FCA recovered your crypto: recognising a second recovery scam

If you have already lost money or crypto to a scam, an unexpected message promising to recover it may be a second scam. The sender may claim to be from the FCA, a solicitor, a tracing team, a government body or a firm that has “located” your funds. The message may use details from the first fraud to sound convincing.

A blockchain trace, transaction report or claim that funds have been found is not a recovery guarantee. It does not prove that the person contacting you is authorised, that they control the funds, or that money can be returned. Do not pay an upfront release, tax, processing, court or verification fee, and do not share a private key or recovery phrase.

The FCA says people who have invested in a scam may be targeted again, or their details may be sold to other criminals. It describes follow-up offers to get money back, or to buy back an investment after a fee, as a type of follow-up scam. Read the FCA’s crypto investment scam guidance.

How a second recovery scam works

The first scam supplies the story. The second caller or message may know the name of the platform, the amount you lost, a wallet address, a transaction date or the name of someone who contacted you before. That information can come from the original scammer, a lead form, a hacked account, a public post or data shared between criminals.

The approach may begin with a claim that:

the FCA, police, a court or a solicitor has frozen or recovered your crypto;
a tracing analyst has located your funds on a blockchain;
a wallet or exchange is ready to release the balance;
a legal or enforcement action has identified money belonging to you; or
you only need to pay one final charge before the money is sent.

The story can be dressed up with a case number, a copied logo, a forged letter, a familiar name or a website that looks official. The detail is not proof. A genuine organisation will not become genuine because a message contains your transaction hash or uses a real person’s name.

A tracing claim is not a recovery guarantee

Public blockchain records can show transactions and addresses on networks that expose those records. That is different from proving who controls an address, whether assets remain there, whether they can be seized or whether they can be returned to you.

A person who says they can trace funds may still be unable to recover them. The claim may be vague, unsupported or based only on information you supplied. It may also be used to make a fee request sound technical. Treat “we found your crypto” as an unverified claim until you have independently checked the organisation and its contact details. Do not treat it as money held for you.

There is no safe reason to hand over wallet credentials to prove ownership. A private key is secret signing data that can authorise spending. A recovery phrase, also called a seed phrase or mnemonic, can restore access to a compatible wallet. Anyone who obtains the necessary recovery information may be able to control the associated funds. Our crypto glossary explains the difference between a wallet, address, private key and recovery phrase.

Red flags in the second approach

Be cautious if the contact:

asks for an upfront release, tax, customs, court, insurance, gas, processing or verification fee;
says the fee must be paid in crypto, by a bank transfer to a personal account, or through a new wallet;
promises a fixed recovery, a guaranteed result or a deadline that will make you lose the funds if you do not act;
asks for your private key, seed phrase, wallet password, one-time code or remote access to your device;
asks you to connect your wallet to a website or approve a transaction “just to verify” it;
tells you not to contact the FCA, your bank, an exchange or the police;
uses a free email address, an address that does not match the organisation, or a domain that differs by a letter;
provides a firm reference number, SRA number, badge or case number but will not let you verify it independently; or
contacts you through an advert, social media account, WhatsApp or an unexpected call after you have posted about your loss.

A request for another payment is the clearest practical warning. Paying once does not make a second request legitimate. It can give the sender more information about you and confirm that you are likely to respond.

Check the organisation without using its message

Do not use the phone number, email address or link supplied by the caller. Type the official website address into your browser yourself or use a trusted government source.

For financial firms, use the FCA Firm Checker to check whether the firm is authorised and has permission for the service it is offering. Match the exact legal name, website, telephone number and other contact details. Registration or authorisation is not a guarantee that a particular offer is genuine, and the Firm Checker cannot confirm whether Financial Services Compensation Scheme or Financial Ombudsman Service protection will apply.

Also check the FCA Warning List. If a firm is not on the list, that does not prove it is safe: the FCA says unauthorised firms may change names and may not yet be listed. A match on the Warning List is a strong reason to stop contact, but a clean search is not clearance.

The FCA has published warnings about businesses using recovery language, including a warning headed Crypto Asset Recovery. The warning says the firm was not authorised and advises people to check the FCA Register and use independently verified contact details.

If someone claims to be a solicitor, check the name and firm through the Solicitors Regulation Authority rather than using the details in the message. The SRA scam alerts include alerts about emails, WhatsApp messages and websites misusing solicitor names and details in relation to recovering lost cryptocurrency funds.

Protect your wallet and accounts

Do not send a private key or seed phrase to anyone. No legitimate investigation requires you to disclose the secret that controls a wallet. Do not paste it into a form, upload a screenshot of it or type it into a website offered by a caller.

Stop using links and files sent by the suspected recovery contact. If you entered a password, shared a one-time code, connected a wallet or approved a transaction, contact the relevant wallet provider, exchange, bank or payment service through its official website or app. Explain what happened and ask what account-security steps are available. Do not rely on the person who first contacted you to secure anything.

If you still control a wallet and believe its credentials may have been exposed, avoid making rushed transfers based on instructions from a stranger. Record what happened first, then use the wallet provider’s official support route or another independently verified source for account-security guidance. This article does not provide technical, legal or financial advice.

Preserve evidence before deleting anything

Keep the material that may help a bank, platform, regulator or police service understand the sequence of events. Save copies in a safe place, without opening suspicious attachments again. Useful records may include:

messages, emails, caller numbers, usernames, profiles and website addresses;
screenshots showing the claim, fee request, payment instructions and dates;
transaction hashes, wallet addresses, network names and timestamps;
bank, card, exchange or payment records, including references;
documents, invoices, letters and case numbers sent by the contact; and
a short timeline of the first scam, the later approach, payments made and information shared.

Do not edit screenshots in a way that removes the original context. Keep the original email where possible, including its headers, and do not forward a suspicious link to someone else as a test. You can describe the link without opening it.

Report the contact and the loss

If you are in England, Wales or Northern Ireland and have lost money or been hacked through an online scam, report it to Report Fraud. The service is the national place to report cyber crime and fraud. GOV.UK says you can report online or call 0300 123 2040. If you are in Scotland, GOV.UK directs victims of online fraud to Police Scotland.

Report an unauthorised financial firm or promotion to the FCA using its consumer reporting route. If the contact claims to be a solicitor or misuses a solicitor’s details, use the SRA alert information and its reporting options. Contact your bank, card provider, exchange or payment service through an official channel as soon as possible. Reporting does not guarantee that money or crypto will be recovered, but it creates a record and may help organisations warn others.

If you have received a suspicious email, text, advert or website but have not lost money, GOV.UK explains how to report it. Do not pay a recovery fee while waiting for a response from any reporting body.

Printable checklist

Print or save this checklist if someone offers to recover lost crypto:

[ ] Stop replying and do not pay a release, tax, processing or verification fee.
[ ] Do not share a private key, seed phrase, wallet password or one-time code.
[ ] Do not connect a wallet, approve a transaction or install remote-access software at the caller’s instruction.
[ ] Save the messages, emails, websites, phone numbers, documents and payment records.
[ ] Record transaction hashes, wallet addresses, network details and a dated timeline.
[ ] Check the exact organisation and contact details through the FCA Firm Checker, FCA Warning List or SRA register, using an independently found website.
[ ] Contact your bank, card provider, exchange or wallet provider through its official route if you shared information or made a payment.
[ ] Report the fraud to Report Fraud, or to Police Scotland if you are in Scotland.
[ ] Report suspected unauthorised financial activity to the FCA and solicitor impersonation to the SRA.
[ ] Treat every recovery promise as unverified. A tracing claim is not a recovery guarantee.

Internal links

Sources

FCA: Crypto investment scams (follow-up scams and fee-based recovery offers; checked 23 September 2026).
FCA: Firm Checker (authorisation, permissions and limitations of the checker; checked 23 September 2026).
FCA: Warning List of unauthorised firms (warning-list limits and clone-firm cautions; checked 23 September 2026).
FCA: Crypto Asset Recovery warning (example of an unauthorised recovery-related warning; checked 23 September 2026).
Solicitors Regulation Authority: Scam alerts (alerts about misuse of solicitor identities in crypto recovery approaches; checked 23 September 2026).
Report Fraud (official reporting route for cyber crime and fraud in England, Wales and Northern Ireland; checked 23 September 2026).
GOV.UK: Avoid and report internet scams and phishing (Report Fraud route, Police Scotland direction and evidence-safety guidance; checked 23 September 2026).
The Coin Expert: Crypto glossary (wallet, private key and recovery phrase terminology; checked 23 September 2026).

This article is general safety education, not legal, tax, financial or recovery advice. It does not recommend commercial recovery services or promise that funds can be recovered.