The Second Knock: Assessing Unsolicited Offers to Recover Lost Crypto Funds

Losing money to a crypto fraud is rarely a single, clean event. There is the loss itself, then the reporting, then the long quiet period in which very little appears to happen. It is in that quiet period, often several weeks or months after the original incident, that a second contact frequently arrives. Someone has found your case, they say. They can get the money back. They need a fee to begin.

This pattern, sometimes described as the recovery scam or the second-wave fraud, is one of the more persistent features of the UK crypto fraud landscape. It is also one of the more cruel, because it targets people who have already lost money and who are, quite reasonably, looking for a way out. The purpose of this article is not to frighten anyone further. It is to set out what these approaches tend to look like, how to check them, and what to do with the evidence if you suspect one.

Why a second approach happens

Fraud is an information business. Details of people who have reported a crypto loss circulate: sometimes sold, sometimes leaked, sometimes simply harvested from public forums and social media where victims describe what happened. A person who has already demonstrated a willingness to send funds to an unfamiliar recipient is, from a fraudster's perspective, a qualified lead.

The second approach therefore often arrives with an unsettling level of specific detail. The sender may know the exchange involved, the approximate sum, the date, or the name of the token. This is designed to feel like proof of authority. In practice it usually proves only that the sender has read something you wrote, or bought a list that contains it.

The shape of a recovery offer

Most recovery approaches follow one of a small number of forms. There is the supposed law firm, often with a name that sounds plausible but proves hard to locate on a professional register. There is the blockchain investigator, offering tracing services and a report. There is the regulator or ombudsman impersonator, warning that a claim must be lodged quickly. There is the friendly contact on WhatsApp or Telegram who says they were defrauded too and have since been helped.

The common thread is the request for money before any recovery takes place. It may be described as a court fee, a tracing fee, an insurance premium, a tax clearance, an anti-money-laundering deposit, or a release charge. Occasionally the request is not for money at all but for a document or a signature, which can be more damaging still.

Checking who is actually writing to you

In the UK there are several registers worth consulting before you engage with anyone who contacts you out of the blue about a crypto loss.

The FCA register should be the first stop. Firms offering financial services in the UK generally need authorisation, and the register will show whether a named firm or individual is authorised and what they are permitted to do. Check the reference number directly on the FCA site rather than following a link in the message, and check the firm's own contact details against those on the register. Crypto asset activity itself remains largely unregulated in the UK, which means a firm offering crypto-related services may not appear at all; that absence is informative.

For solicitors, the Solicitors Regulation Authority maintains a register, and the Law Society of Scotland and the Law Society of Northern Ireland cover their respective jurisdictions. For insolvency practitioners, the Insolvency Service publishes a register. Companies House will tell you whether a company exists, when it was incorporated and who its officers are, which is often enough to reveal a firm that was set up a matter of weeks ago.

Action Fraud, the national reporting centre, is the correct place to report a suspected fraud or a suspicious approach, and it is also the body that issues reference numbers used by banks and insurers. If someone claims to be acting on your Action Fraud case, the reference number can be checked independently. Action Fraud does not charge for its work and does not contact victims to demand payment.

The upfront fee is the tell

There is a simple rule that covers most of these approaches: legitimate recovery work is normally paid for after the fact, or under a regulated fee arrangement that is documented in writing before anything is signed. Requests for payment by bank transfer, crypto transfer, gift card or payment app, made before any work has begun, are the clearest single warning sign.

Be equally cautious of the no-win-no-fee framing that then asks for a smaller sum to cover administrative costs or insurance. The structure is designed to reduce resistance, not to reflect how regulated firms actually operate.

Preserving the paper trail

If you have been contacted and you suspect the approach is fraudulent, do not delete the messages. Screenshots, email headers, phone numbers, wallet addresses, bank details and timestamps are all useful, both to Action Fraud and to your bank. Keep the original messages as well as copies. If any payment has already been made, contact your bank immediately; the sooner a transfer is flagged, the greater the chance it can be recalled, though there is no guarantee.

If you have not already done so, report the original fraud to Action Fraud and tell your bank that you have been approached a second time. Some banks will place additional monitoring on an account once a second approach is known.

Bringing the bank in early

UK banks have become considerably more attentive to crypto-related transfers, and the reimbursement rules for authorised push payment fraud now give customers a clearer route to a claim in some circumstances. That route depends on prompt reporting. If a recovery firm has asked you to send money to a UK account, tell your bank before the transfer, not after.

A short checklist before you reply

• Confirm the identity of the sender independently, using contact details you have found yourself.
• Check the FCA register, the relevant professional register and Companies House.
• Refuse any request for an upfront fee, a deposit or a crypto payment.
• Do not share identity documents, bank credentials or wallet seed phrases.
• Keep every message, screenshot and reference number.
• Report the approach to Action Fraud and inform your bank.
• Take your time. A genuine firm will not press you to decide today.

Recovery from a crypto fraud is possible in some cases, but it is rarely quick and almost never initiated by a stranger who contacts you first. Treating that second knock with the same caution you would apply to any unsolicited financial offer is not cynicism. It is simply the sensible position for a UK reader in 2026.