Scammers Impersonating Regulators and Police in Crypto

In a regulator impersonation scam, criminals pose as police officers, financial regulators, tax officials or court staff and use fear or false hope to make you send crypto, pay a "fine" or "release fee," or hand over your recovery phrase. Real authorities never ask you to move your crypto to a "safe wallet," pay penalties in crypto or share wallet keys, so any such request is a scam.

These scams work because authority is persuasive. People who would ignore a stranger often comply when someone claims to be from the SEC, the FCA, a national police force or the tax office. They often target people who already lost money in a scam and are desperate to recover it. This guide explains the common scripts, warning signs and what to do.

Common Versions of the Scam

The "your account is under investigation" call

A caller claims your exchange account or wallet is linked to money laundering or fraud. To "protect" your funds or avoid arrest, you must move everything to a secure government wallet. The address belongs to the scammer.

The fake recovery agency

After you lose money to a scam, someone contacts you claiming to be from a regulator, a police cybercrime unit or an international agency. They say the criminals were caught and your funds recovered, but you must pay a processing fee, tax or legal cost before release. This is closely related to recovery scams.

The regulatory fine or tax demand

You receive a letter or email saying you owe tax or a penalty on crypto gains, payable immediately in crypto or gift cards, often with a threat of arrest. Our article on crypto tax scams covers this variant.

The fake compliance check

A message styled as coming from a regulator says your wallet must be "verified" or "registered" under new rules, linking to a site that asks you to connect your wallet or enter your recovery phrase. It is a phishing site or a wallet drainer.

How the Scam Unfolds Step by Step

1. 1Contact: a phone call, email, text, letter or social media message, often using a spoofed number or official-looking logo.
2. 2Credibility: the scammer quotes a badge number, case reference or your personal details, sometimes taken from earlier data leaks.
3. 3Pressure: they create urgency — arrest, frozen accounts, a deadline for recovering funds — and tell you not to discuss it with anyone, sometimes claiming that talking would "compromise the investigation."
4. 4Instruction: you are told to move crypto, pay a fee, install remote-access software or share your recovery phrase.
5. 5Escalation: once you pay, new demands follow, such as a second fee or another "verification."

A Hypothetical Example

This is a composite illustration, not a real case.

Imagine James lost savings to a fake trading platform last year. One day he gets an email that appears to come from a national financial regulator, followed by a call from "Officer Patel" of a cybercrime unit. The officer knows the name of the fake platform and the amount James lost. He says the funds have been recovered and are held in a government wallet, but international rules require James to pay a release fee in crypto first. The caller ID shows a real government number. James is told the case is confidential.

Every detail was designed to feel legitimate: the details came from the original scammers' records, the number was spoofed and the "release fee" went straight to the criminals.

Warning Signs Checklist

• Someone claiming to be an official asks you to send crypto anywhere, for any reason.
• You are asked for your recovery phrase, private key or a wallet connection to "verify" anything.
• You must pay a fee, tax or deposit to receive recovered funds.
• Payment is requested in crypto, gift cards or wire transfer to an individual.
• You are told to keep the matter secret or not to contact your bank or exchange.
• The contact comes through WhatsApp, Telegram or social media rather than official channels.
• There is extreme urgency, threats of arrest or a short deadline.
• You are asked to install remote-access or screen-sharing software.

How to Verify Contact From an Authority

1. 1Hang up or stop replying. A real official will not object to you verifying.
2. 2Find the official website yourself. Type the address or use a trusted bookmark. Do not use links from the message.
3. 3Call the number listed on that website and ask whether the contact and case reference are genuine.
4. 4Check regulator warning lists. Many regulators publish lists of known impersonation scams and unauthorized firms.
5. 5Talk to someone you trust before acting on any demand.

What to Do If You Paid or Shared Details

1. 1Stop all payments and cut contact.
2. 2Move remaining funds to a new wallet with a fresh recovery phrase if you shared your phrase, keys or gave remote access. Follow our guide on what to do immediately if your wallet is compromised.
3. 3Contact your exchange or bank right away; they may be able to flag or freeze transfers.
4. 4Report the impersonation to your local police, your national fraud reporting service and the agency being impersonated. In the US, internet fraud can be reported to the FBI's Internet Crime Complaint Center.
5. 5Keep records: call logs, emails, wallet addresses and transaction IDs.

You can also flag scam websites, wallets and tokens through our report form, and our guide on how to report a crypto scam and what happens next explains each reporting route.

Bottom line

Authority is the scammer's disguise in these schemes. No genuine regulator, police force or tax office will ask you to move your crypto, pay a release fee or share your recovery phrase. Pause, verify through official channels you find yourself, and report any impersonation attempt so others are warned.