If you have just realised you have been scammed, act now — calmly and in order. The first hours are when a trace has the best chance of reaching the money before it is cashed out, and when the evidence is freshest. Follow these steps first; the explanations come after.
What should I do first? (Step-by-step action plan)
- Stop all contact and send no more money. Block the scammer. Do not pay any "fee," "tax," "deposit" or "release" charge to withdraw or recover funds — that demand is itself part of the scam.
- Preserve every piece of evidence. Save transaction hashes (TXIDs), wallet addresses, the platform URL or app, all messages, and full, uncropped screenshots of your account and any "dashboard." Export chat histories where you can.
- Secure your accounts. Change passwords, enable two-factor authentication, and move any remaining crypto in a wallet the scammer may have touched to a new, secure wallet with a fresh seed phrase. If you shared remote access, disconnect and scan your device.
- Tell your bank or card provider immediately if any payment used a card, transfer or your bank. Ask about chargebacks or recall — speed is critical.
- Notify the exchange you sent crypto from, and any exchange you can identify as receiving it, so they can flag or freeze the receiving account.
- Report to the authorities — your national police/cybercrime unit, financial-markets regulator, and Financial Intelligence Unit (see country list below).
- Start a forensic trace early. Tracing can run in parallel with reporting; the sooner it begins, the better the chance of supporting a freeze.
- Beware the second scam. Anyone who now contacts you offering to recover your money for an up-front fee is almost certainly a recovery-room fraud.
Why does acting fast matter so much?
Because stolen crypto moves. In the first hours and days, funds are often still in transit between wallets and exchanges — the window in which a trace can reach a regulated, cooperating venue before the money is cashed out, and the only window in which a voluntary freeze is realistically possible. After that, funds are typically consolidated, swapped across chains and off-ramped, and the focus shifts from freezing live money to building documentation. The threat is large and fast-moving: the FBI's IC3 2024 report recorded USD 9.3 billion in cryptocurrency-related losses, up 66% year on year, much of it from investment scams. None of this means a later report is pointless — the blockchain record is permanent — but every hour counts toward the best realistic outcome, so work through the steps above without delay.
What evidence should I keep, and how?
Keep originals, untouched. The most valuable items are the wallet addresses and transaction hashes for every transfer — on a public blockchain these are your strongest evidence. Add the dates and amounts, the platform or app name and exact URL, the names, phone numbers and channels the scammer used, and the full message history (export rather than screenshot where possible). Screen-record the fake dashboard before it vanishes, and note how you were first contacted. Do not crop, edit or annotate the originals; make copies and work from those. Store everything in one place. This is exactly the material a forensic analyst needs to reconstruct the flow of funds and that a bank, exchange, regulator or court will ask to see — and it is far harder to gather later.
Who do I report a crypto scam to?
Report to all three local bodies, contacting each through details you find on its own official site:
- Police / national cybercrime unit — opens the criminal case.
- Financial-markets regulator — maintains warning lists; your report protects others.
- Financial Intelligence Unit (FIU) — coordinates with exchanges and foreign FIUs.
By country: Spain — Policía Nacional / Guardia Civil (GDT), regulator CNMV, INCIBE helpline (017), FIU SEPBLAC. Germany — Polizei (Landeskriminalamt), regulator BaFin, FIU within Customs (Zoll). France — THESEE and PHAROS platforms, regulator AMF, FIU TRACFIN. Italy — Polizia Postale, regulator CONSOB, FIU UIF. Netherlands — Politie, regulator AFM, FIU-Nederland. Cross-border cases are coordinated by Europol and Eurojust behind your national police, so reporting locally is what connects you to that wider effort.
What should I NOT do after being scammed?
Avoid the mistakes that turn one loss into two:
- Do not pay anyone to "recover" your funds, especially up front. Recovery-room scams target recent victims; the FBI warns that almost all crypto investment-fraud victims are later approached this way.
- Do not share your seed phrase, private keys or remote access with anyone — no legitimate firm or authority ever needs them.
- Do not let anyone take custody of your remaining crypto into a "recovery wallet."
- Do not trust unsolicited contact claiming to be a regulator, police force or law firm; verify independently using official contact details.
- Do not delete anything — even embarrassing messages are evidence.
- Do not rush into a "guaranteed recovery." No honest party promises an outcome.
What can a forensic firm do for me?
A legitimate forensic firm can trace where your funds went, attribute the receiving entities, and build a documented, court-admissible evidence package for your counsel, bank or the relevant authority — and, where the trail reaches a cooperating exchange quickly, support a request to freeze funds. What it cannot do is promise recovery; no honest firm can. A real firm begins with a free, no-obligation review, agrees terms in writing before any work, never charges a release fee, never asks for your keys, and never takes custody of your assets. AssetTrace is built around exactly those constraints. If you are still inside the early window, getting a trace started quickly — alongside your reports — gives you the best realistic chance, with no guarantees attached.
Sources
Lost crypto to a scam or theft?
Start with a free, confidential review. We'll tell you honestly whether a trace can help — recovery is never guaranteed.