“An adviser told me to send another payment to withdraw my profits.” “Someone claiming to be your support team asked for my wallet recovery phrase.” These messages call for careful, timely handling.
Handling crypto scam reports means understanding the customer's concern, checking whether further harm may be occurring and routing the case to the right specialists. It also means preserving useful details without blaming the customer or making promises the business cannot keep.
This guide explains a practical approach for customer support and operations teams. It covers warning signs, first-response priorities, evidence collection and communication with people who may have lost funds.
Recognise Common Crypto Scam Patterns
The US Federal Trade Commission's cryptocurrency scam guidance describes fraudulent investment promises and impersonation schemes. Common examples include guaranteed profits and instructions to move money because an account is supposedly at risk.
For a support team, a customer's explanation may reveal the concern before a technical alert does. Ask focused questions under the approved process and record what the customer says.
| Customer report | Concern to route for assessment |
|---|---|
| A stranger promises guaranteed investment profits | Possible investment fraud |
| An apparent employee asks for a recovery phrase | Possible support impersonation or wallet compromise |
| A third party controls the customer's device during a transfer | Possible coercion, scam activity or account compromise |
| An unexpected withdrawal appears in the account | Possible unauthorised access or transaction |
| A payment is demanded to recover earlier losses | Possible recovery scam |
These categories help route a case. They do not establish who committed an offence or determine the customer's liability. 
Check for Immediate Risk
First, use the approved authentication process before discussing protected account information. At the same time, establish whether the customer reports active access by another person or an imminent payment under pressure.
If the firm's urgent fraud or security criteria are met, use that route promptly. Do not delay an urgent handoff until every screenshot or transaction detail is available. The initial report can be supplemented afterwards.
Protective measures should follow the platform's incident process and the employee's authority. For example, a security team may need to assess account access while fraud operations reviews a pending transfer. Support should coordinate the handoff and explain the approved customer actions.
If the customer reports immediate danger or threats to personal safety, use the organisation's emergency process and the appropriate local emergency services route. Financial crime review alone is insufficient for an immediate safety concern.
Preserve Useful Transaction Information
Ask for the relevant details through approved channels. These may include the platform case reference, asset, network, transaction reference, destination address, amount and date.
The FBI's guidance for cryptocurrency scam victims identifies addresses, amounts, cryptocurrency types, dates, times and transaction hashes as useful reporting information. It also encourages reporting when complete transaction details are unavailable.
Operationally, distinguish a public wallet address or transaction hash from secrets that control access. Never request a private key, recovery phrase, password or one-time authentication code in a support conversation. 
If a customer sends an access secret without being asked, follow the approved security procedure for exposed credentials and sensitive records. Avoid copying it into case summaries or ordinary messages.
Screenshots and message histories may help show what the customer was told. Store relevant evidence securely, identify its source and record when it was received. Follow the firm's process for handling suspicious links or attachments.
Separate Customer Reports From Confirmed Facts
An accurate note makes the case easier to assess. Label the customer's account of events clearly, then describe any information independently confirmed in the platform.
For example:
Customer reports that an online adviser requested a payment to unlock investment profits. Platform records show a pending withdrawal to the address identified by the customer. Ownership of that destination address has not been verified in this support case.
This note preserves the concern without claiming the reviewer has proved fraud or identified the address owner. Furthermore, it shows which facts remain uncertain.
If the transfer status is unclear, use our guide to crypto withdrawal holds and support responses to structure the status check.
Respond With Care and Clear Limits
Customers may feel embarrassed, frightened or angry. Acknowledge their report and give one clear next step at a time. Avoid suggesting that the loss happened because they were careless.
An illustrative response could read:
Thank you for telling us. I understand why this is worrying. I have recorded your report and referred it through our fraud review process. Please use our verified support channel for further communication and provide any requested transaction information through the approved secure route.
Where the approved process allows it, explain how the customer can secure their account and avoid further contact with the suspected scammer. Adapt the advice to the confirmed circumstances and the relevant security team's instructions.
Recovery expectations also need care. Explain what the business can review or attempt, without guaranteeing that funds will return. A case reference, blockchain trace or referral to law enforcement should not be presented as a recovery promise.
Keep customer updates separate from sensitive internal reporting decisions. Share the approved service information and ask the designated team about any disclosure uncertainty.
Handle Recovery Scam Concerns
A customer who has lost funds may receive another message offering to recover them. The FTC's recovery scam guidance warns about unsolicited offers and upfront payments connected with supposed refunds or recovery assistance.
If the customer reports such an approach, capture the relevant message and route the concern. Avoid recommending an unverified recovery provider or suggesting that payment is necessary to progress the platform's review.
Use the organisation's approved warning language. For instance, advise the customer to verify contact details independently and to communicate through the platform's official channels.
Reporting and Internal Escalation
The firm's fraud, security and compliance teams may have different responsibilities. Clearly identify which team is assessing account compromise, which is reviewing the transfer and who owns customer updates.
External reporting depends on jurisdiction and case circumstances. The UK National Crime Agency distinguishes suspicious activity reports from crime reports. A SAR does not replace the appropriate fraud or police reporting route.
For US cases, the FBI guidance linked above describes reporting to IC3. Use current official local guidance when helping customers find a reporting route, and follow the firm's policy for any external information sharing.
After escalation, confirm the receiving owner and record the next communication checkpoint. New evidence should remain linked to the original case, even when a different specialist team becomes involved.
To build staff awareness of fraud concerns and customer communication, explore our frontline compliance course.
Frequently Asked Questions
Should support wait for proof before escalating a scam report?
Follow the firm's escalation criteria. Where active harm may be occurring, a timely initial report is useful even if details are incomplete. Record the gaps and supplement the case afterwards.
Can a platform reverse a crypto scam payment?
The available options depend on transaction status, the service and the circumstances. Staff should explain confirmed capabilities and avoid guaranteeing a reversal or recovery.
Which transaction details are most useful?
The asset and network, amount, date, relevant addresses and transaction hash can help specialists identify the transfer. Include platform references where available.
Should support request a recovery phrase?
No. Recovery phrases and private keys control wallet access. Use the approved security process if the customer reports that one has been exposed.
