Fake support and fake crypto recovery scams: how they work, FBI warnings and signs to recognize

A wrong USDT transfer is irreversible, and scammers know it. That is why crypto scams come in two stages. In the first, the criminal gets the money, often by posing as the support team of someone the victim trusts. In the second, he comes back with an offer of help to recover what was lost. Both prey on people who are already vulnerable.

Losses in crypto-related complaints received by the FBI's IC3 in 2024; up 66%

US$ 9.3 bn

Losses from fake tech support scams reported to the IC3 in 2024, across 36,002 complaints

US$ 1.46 bn

Of financial scam victims who contacted Brazil's securities regulator CVM in 2020 reported crypto asset fraud (CVM, cited by InfoMoney)

43.3%

How the fake support scam works

The scam starts with an unexpected contact: a phone call, message, email or a window that pops up in the browser. The other party says they are from the exchange, the bank or a technology company and claims there is a serious problem, such as an attempted break-in to the account. Urgency is the main tool.

The FBI described a three-phase version, called "Phantom Hacker," in an alert dated September 29, 2023. First, a fake technician gets remote access to the computer and asks the victim to open their financial accounts. Then, a fake bank or brokerage employee says a foreign hacker has accessed the accounts and tells the victim to move the money to a "safe" account, by transfer, cash or cryptocurrency. Finally, a fake government agent sends official-looking letters and emails and insists on moving the money again. The FBI stresses that the U.S. government never asks for money to be sent in cryptocurrency. In Brazil, the version in the government's name appeared in the wave of fake messages about a Pix tax, with payment slips and threats in the name of Brazil's Federal Revenue Service (Receita Federal).

The same logic shows up in the Brazilian market in smaller forms: the "support" agent who calls to confirm a supposed purchase, the fake login link that imitates the exchange dashboard, the request for a verification code to "cancel" a withdrawal. In May 2025, Coinbase disclosed that outsourced support agents were bribed to leak customer data, which fuels more convincing scams because the fake agent knows the victim's name and balance (see the Coinbase case).

How the fake recovery scam works

Victims of a crypto scam usually look for help on social media, forums and news comment sections. That is where the scammers show up. In an alert dated August 11, 2023, the FBI described a rise in companies claiming to trace and recover funds lost in crypto investment fraud, which in 2022 alone took more than US$ 2.5 billion from victims, according to the agency. The script repeats:

1. The fake recovery agent contacts the victim by direct message, advertises in search results or comments on news about large scams.
2. He promises to trace the criminal's wallet and return the money, sometimes citing police, lawyers or exchange employees.
3. He charges an upfront fee for the tracing or for legal costs.
4. He disappears after payment or delivers an incomplete report and asks for more money.

The FBI is direct on the central point: private recovery companies cannot issue seizure orders for cryptocurrency. Exchanges only freeze accounts through internal processes or in response to a legal order, and a transfer confirmed on the blockchain cannot be undone. Anyone who charges upfront with a promise to return the cryptocurrency is selling a service they cannot deliver.

Warning signs your team can learn

The landscape and what the research says

The FBI's Internet Crime Complaint Center (IC3) annual report for 2024 counted 149,686 complaints tied to cryptocurrency and US$ 9.3 billion in losses, 66% more than the year before. Fake tech support scams totaled 36,002 complaints and US$ 1.46 billion, and fake government official scams, 17,367 complaints and US$ 405.6 million, across all payment methods. In Brazil, a 2020 CVM survey of about a thousand people who contacted the regulator over fraud showed that 43.3% of financial scam victims reported crypto asset fraud, that 27.5% of the scams were spread through WhatsApp and that, in half of the cases, the seller was someone the victim knew. The numbers show that the contact channel is often a person or an account that seems trustworthy.

What your company should do

• Establish in writing that no one in finance shares codes, passwords or recovery phrases, with anyone, under any circumstances.
• Use a single, known channel to talk to the exchange and the bank, such as the number printed in the app or on the website typed in by hand.
• Require approval from two people to move significant amounts and to register a new wallet.
• Prohibit installing remote access software without IT approval.
• In case of a loss, notify the bank and the exchange immediately, file a police report and report it to the Federal Police or the specialized police unit; do not hire a recovery agent who charges upfront.

For supplier payments, the rule of confirming through a second channel also applies, as it protects against swapped payment details. The same discipline applies to wallet addresses, as explained in address poisoning scam.

• Scams
• Social engineering
• Cybersecurity
• Wallets
• Exchanges
• Hacks