Fake support and “recovery” scams

How impostors in Discord, Telegram and search results pose as support, why upfront-fee recovery offers are usually another scam, and where to report them.

Updated 15 Sept 2026 · Beginner · 3 min read

In short

Fake support starts where people are already stressed: after a failed withdrawal, a frozen account, a wallet issue or a theft.
Nobody legitimate needs your seed phrase, screen share, remote-access tool or “verification payment” to help you.
Recovery services that ask for upfront fees, taxes or tracing deposits almost always target people who have already lost money once.

Why support scams work so often

The victim already believes there is a problem, so urgency is built in. An exchange app is down, a withdrawal is pending, a wallet signature looked odd, or money has already gone. In that state people stop checking who is talking to them. Scammers know this and move quickly to private channels where no one else can contradict them.

Crypto support scams rarely rely on technical trickery. They rely on trust signals: a copied logo, a display name that matches the project, a “moderator” badge in a busy chat, or a sponsored search result above the real help centre.

How fake support usually appears

Discord and Telegram. You ask a public question and receive an instant DM from “support”, “admin” or “ticket desk”.
Search adverts. You search for a wallet or exchange and the advert leads to a fake help desk or a phone number answered by a scammer.
Replies under hacked posts. A compromised project account posts a fake incident notice and the replies direct users to a mirror site.
Recovery contacts after a loss. Once a scam is public, other scammers approach victims claiming to know investigators, forensic analysts or lawyers who can retrieve the funds.

Things real support does not need

Your seed phrase, ever.
A remote-access session to your computer or phone.
A screen share while you open your wallet or email.
A “test payment”, gas deposit, tax, insurance bond or recovery fee before help starts.

Recovery scams after a theft

Once money has gone, many victims want to believe that a specialist can still pull it back. That hope is what recovery scammers sell. They use language such as wallet synchronisation, legal release or tracer fee, none of which gives them any real power over the chain.

A legitimate lawyer, investigator or exchange compliance team may help gather evidence or freeze funds that reach a service they control. They cannot reverse a public-chain transaction because a fee was paid to them. Anyone who promises recovery in exchange for upfront payment is selling certainty they do not have.

Where to report and what to keep

Keep the wallet addresses, transaction hashes, site URLs, usernames, phone numbers and screenshots.
Report the impersonator to the platform where you found them: Discord, Telegram, X, Google Ads, the wallet maker or the exchange.
If funds reached a centralised exchange, contact that exchange immediately with the transaction hashes.
Report the crime to the police or your national fraud reporting service. In the US that usually includes the FBI’s IC3; in the UK, Action Fraud.

If the scam involved a phishing page or a suspicious download, you can also run the URL through our link checker to see how old the domain is, where it redirects and what the page asks for. Note those details in your report before the site disappears.

Safer ways to get help

Start from the project’s own website, typed by you or opened from a bookmark you already trust.
Use public help channels where possible, so moderators and other users can see the advice.
If you must open a support ticket, check the domain first and never follow a ticket link sent in a DM.
After any suspected compromise, review token approvals and wallet health from trusted pages, not from a support message.

Put it into practice

Link checker →Token approvals →Wallet health →