What's going on
Recovery fraud, sometimes called advance fee fraud, is what happens when criminals target somebody who has already lost money and charge them for the promise of getting it back. In the crypto version the approach arrives weeks or months after the original loss. Someone has identified funds linked to your case. A blockchain forensics firm has traced your wallet. A law firm is assembling a group claim. An investigation has frozen assets and yours can now be released.
None of it is real. Details of scam victims are recorded, traded and resold between criminal groups, and being defrauded once marks you out as a proven target. Frequently the people offering to recover your money are the ones who took it, or associates working from the same customer list. The FCA received almost 5,000 reports of scams involving fraudsters impersonating the FCA in the first six months of 2025 alone (FCA). One of the most commonly reported methods is a claim that the FCA has recovered funds from a crypto wallet opened illegally in your name.
Why the regulator is the disguise of choice
The business model here is simple. Buy or reuse a list of people who have already lost money, contact them wearing the uniform of the body they would most want to hear from, and charge fees against money that does not exist.
The FCA is the most useful uniform available, which is why almost 5,000 reports of FCA impersonation reached the regulator in six months. Two methods dominate. In the first, the caller or message says the FCA has recovered funds from a cryptoasset wallet that was opened illegally in your name, and you need only verify your identity and settle a charge to receive them. In the second, victims of earlier investment or loan scams are told the FCA can help recover what they lost.
Here's the thing: the FCA is a regulator, not a claims service. It supervises firms, publishes registers and takes enforcement action. It does not hold consumers' money, does not return it, and does not invoice anybody for the privilege. Once you know that, every version of this scam falls apart at the same point, which is the moment a payment is mentioned.
How the scam works
This one runs more slowly than most, because it is rebuilding trust that has already been broken once.
1. They already know what happened to you
The opening message is specific in a way ordinary scam texts never are. It may name the platform that took your money, quote roughly the right amount, or reference when it happened. That precision is the hook, because it feels like proof a genuine investigation has found you. In reality it comes from the original fraudsters' own records, sold on or reused under a new name.
Knowing the details proves nothing
Ask who could possibly know how much you lost and where. A legitimate investigator would not, certainly not before speaking to you. The people who definitely do know are the ones who took it. Detailed knowledge of your loss is evidence you are talking to the criminals, not evidence that you are not.
2. The borrowed authority
They arrive wearing somebody else's credibility. The FCA. A real solicitors' firm whose name and registration number have been copied off the internet. A blockchain analytics company. Occasionally a foreign regulator or a court. There will be a professional website, a case reference, headed documents, and sometimes a video call with a person in an office. Every part of that can be manufactured cheaply.
Cloned firms are the hardest version
A clone uses a genuinely regulated firm's real name, address and reference number, changing only the contact details. So checking the name against a register appears to confirm them. The defence is to ignore every contact detail you were given, find the firm independently through the FCA Register or the Solicitors Regulation Authority, and ring the number published there instead.
3. The fee that unlocks nothing
Eventually there is a payment, and it is always framed as the last small obstacle between you and money that is already yours. A court filing fee. A tax liability on the recovered sum. An escrow deposit. A money laundering check. A wallet activation cost. Pay it and another obstacle appears, then another. Victims are bled in escalating instalments for as long as they keep believing, and some lose more in the recovery than they lost in the original fraud.
The dashboard showing your money
Many run a portal where you log in and watch your recovered balance sitting there, waiting for release. It is a web page with a number typed into it. Seeing the figure makes each new fee feel worth paying, because you are only ever one payment away from something you can already see on screen. Nothing behind it exists.
4. The second harvest
Money is not the only thing being collected. To process your claim they will ask for identity documents, proof of address, bank statements and details of your remaining crypto holdings, which is the exact package required for identity fraud and a fresh map of what you still own. Some versions skip the fee entirely and go straight for wallet access under the cover of tracing your funds. Either way, when this one ends your details go back onto the list and a third approach can follow.
What these texts look like
These are examples based on reports to Action Fraud and the FCA. All four offer the one thing you want most, which is why they work on people who would spot any other scam instantly.
"Regulator investigation"
Impersonates the FCA directly, and matches one of the methods the regulator reports most often. The suggestion that your money has already been seized and merely awaits return is the most powerful version of this scam.
"FCA: Funds recovered from a cryptoasset wallet opened in your name are available for release. Ref FCA-XXXXX. Verify your identity to proceed: [link]"
"Group legal claim"
Uses a real firm's name and SRA number. Being one claimant among many feels safer than acting alone, and there is always a deadline to join.
"You are eligible to join a group claim against [platform]. Registration closes 14 days from today. Reply CLAIM or visit: [link]"
"Blockchain tracing"
Leans on technical language such as wallet clustering, chain analysis and asset freezing. Tracing funds across a public blockchain is genuinely possible, which is what gives this one cover. Getting them back is another matter entirely.
"Our forensic team has traced 78% of the assets taken from your wallet to an exchange we work with. Free consultation: [link]"
"Compensation scheme"
Invents a payout fund and quotes an exact figure, because a specific amount is what makes people engage. Crypto is not covered by the Financial Services Compensation Scheme, so no such fund exists.
"You have been awarded £14,280 from the victim compensation fund for [platform]. Verify your identity to receive payment: [link]"
Why this catches people who know better
Losing money to a scam is expensive and humiliating, and a great many people never tell anybody. That silence matters, because the usual safety net has already been removed. Describing something out loud to a friend who would say "that sounds like a scam" is the check most of us rely on, and a recovery offer arrives to somebody carrying a loss they have not shared.
It also exploits a piece of reasoning that sounds sensible. If you have lost £20,000, a £500 fee for a genuine chance of recovery looks like reasonable odds. The calculation is only wrong because the chance is zero, and by the time the second and third fees arrive, the money already paid makes stopping feel like giving up. It is a well understood trap, and falling into it says nothing about your intelligence.
What makes it convincing
- • They know real details about a loss you may never have discussed
- • Real regulators, real firms and real registration numbers get cloned
- • Blockchain tracing genuinely exists as a discipline
- • A fake portal lets you see the money waiting to be released
- • Each fee feels small next to the sum you are trying to recover
What should make you stop
- • Any upfront payment before anything is recovered
- • Contact you did not initiate about a loss you did not report to them
- • A guarantee of recovery, or a percentage already traced
- • The FCA, police or HMRC offering to get your money back
- • Requests for wallet access, ID documents or bank statements
How to check who is really contacting you
Every check below rests on the same principle: never use the contact details you were given.
Search the FCA Register and the Warning List yourself
Type fca.org.uk into your browser rather than following any link. The Financial Services Register shows who is authorised, and the Warning List names firms already known to be operating without permission. Ring the firm on the number the Register lists, never the one from the message.
Check solicitors against the SRA, not their letterhead
The Solicitors Regulation Authority publishes a searchable record of every regulated firm in England and Wales, with genuine contact details. A cloned firm's paperwork matches the register perfectly except for the phone number and email, which is precisely the part you must not use.
Apply the fee test
Nobody legitimate asks a fraud victim for money upfront to release funds. Not a regulator, not the police, not a court, not an exchange. If a payment of any kind is required before you see a penny, you have your answer and no further investigation is needed.
Report it to the right place
Reporting matters here, because FCA impersonation is tracked and acted on.
- • Anyone claiming to be the FCA: report to the FCA
- • Scam texts: forward to 7726
- • Fraud and attempted fraud: Action Fraud on 0300 123 2040
- • In Scotland: Police Scotland on 101
- • The sending number: report it on CallerCheck
Tell one other person
Say the offer out loud to somebody you trust. Recovery fraud depends on shame and secrecy, and describing it to another person is the single most reliable way to see it for what it is.
What can genuinely be done after a crypto loss
Less than anybody would like, and all of it free at the point of contact. Being honest about that is the best protection against the people promising more.
-
1
Report to Action Fraud and get a crime reference
Ring 0300 123 2040 or report at actionfraud.police.uk, or Police Scotland on 101. It is free, and the reference number is what other organisations will ask you for. Reports also feed the national intelligence picture that drives enforcement.
-
2
Tell your bank, quickly
Dial 159 or use the number on your card. Where money left your account as a bank transfer, reimbursement rules for authorised push payment fraud may apply (PSR Policy Statement PS24/7), and speed materially affects the outcome. A card payment used to buy crypto may sometimes be disputable too.
-
3
Tell the exchange if funds passed through one
Contact them through their official app or website. If the destination address belongs to an exchange still holding the funds, they may be able to freeze them. This only works early, and only sometimes.
-
4
Take advice from a solicitor you found yourself
Civil recovery is occasionally possible for very large losses where funds can be traced to an identifiable party. A genuine firm will be honest about the odds, will never guarantee recovery, and will be found by you through the SRA register rather than finding you through a text message.
-
5
Get support, and do not carry it alone
Victim Support offers free, confidential help to anybody affected by crime, whether or not you have reported it. The financial loss is often not the hardest part, and talking to somebody also makes the next approach far easier to recognise.
The short version
Red flags
- • Any fee before anything is recovered
- • The FCA, police or HMRC offering to recover money
- • They know your loss but you never told them
- • A guaranteed outcome or a percentage already traced
- • Requests for ID, bank statements or wallet access
What to do
- • Check the FCA Register and Warning List yourself
- • Never use the contact details you were given
- • Report to Action Fraud on 0300 123 2040
- • Forward the text to 7726
- • Tell one person you trust before doing anything
Being scammed once puts you on a list. The rescue is the next scam.