ScamLensCrypto Scam Field Guide
Recovery scam

Crypto Recovery Scams: “We Can Get Your USDT Back”

ScamLens Editorial ✓ Last reviewed October 2026
A person staring at an emptied account after a scam, while someone behind holds out a sign reading 'we'll recover it'
When "we'll get it back" is offered to you after a scam, go through the checklist below before you reply.

Tether's terms of service say it can freeze USDT held by users, so "your USDT has been frozen" does not sound false. The false part is what follows: pay an unfreezing fee, a deposit or a tax and it will be released. People who seek you out after a scam and say they can "unfreeze" your coins or "get them back" are running a recovery scam, a second fraud aimed at people who have already lost money.

In three sentences:
  • Freezing and unfreezing are done by the issuer under its own terms or at the request of law enforcement. Nobody can do it for you privately for a fee.
  • They contacted you first, they guarantee recovery, they want payment up front: any one of these and you stop and don't pay; all three together, treat it as a recovery scam. If they ask for a private key or seed phrase, or tell you to install remote-control software, that alone is reason to cut contact.
  • Report it: in the US to IC3 or the FTC, in the UK to Report Fraud, in Australia to ReportCyber, in Canada to the Canadian Anti-Fraud Centre.

Can USDT really be frozen? Who can freeze it, and who can unfreeze it

It can, but only the issuer can do it. Tether's terms of service state that it may freeze Tether tokens held by a user as required by applicable law, or where Tether, in its sole discretion, determines it is prudent to do so. The terms also list reporting to governments and law enforcement, and the freezing or confiscation of tokens.

Where the real thing and the fake part ways

Freezing and unfreezing are the issuer's own actions, taken because the law requires it, at the request of law enforcement, or under its own terms. No step in that involves a user privately paying someone. So no "support agent" will message you to collect an unfreezing fee, no "team" will have you send a deposit, and no countdown will push you to pay today.

Not everyone who charges is a scammer. Lawyers, blockchain forensics firms and litigation counsel can charge for their services. The difference is that they charge for the work and don't guarantee recovery, and that you went looking for them and checked their credentials. They did not message you first.

How "pay an unfreezing fee" and "we'll get it back" are pitched

The five lines below are examples. The wording you meet will vary, but it ends up in the same place:

Example lines

  • "We have a professional team of hackers / lawyers / technicians who can locate the scammer's wallet and get your money back."
  • "Your USDT has been frozen by the system's risk controls. You need to pay an unfreezing fee / deposit before it can be released."
  • "Recovery requires you to pay a tax / handling fee / cross-border fee first. It will be refunded together with your money."
  • "We have recovered funds for many people. Here are screenshots of successful cases." (Followed by a batch of edited transfer images.)
  • "Places are limited. If you don't act today the on-chain records will be overwritten, so hurry."

The name may be an unfreezing fee, a deposit, a handling fee, a tax, an activation fee or a channel fee. Each one ends with you paying again. The US Federal Trade Commission (FTC) is direct about this on its page on refund and recovery scams: if someone contacts you and asks for an upfront fee, that is a scammer, and government agencies and legitimate organizations will never ask for money to help you get a refund.

Checklist: how many of these fit the "recovery service" contacting you

Hold the person or "firm" that is in touch with you against this list, one item at a time:

  1. They contacted you first (a direct message, a comment, an ad that found you), saying they can recover or unfreeze your funds.
  2. They guarantee the result: "100% recovery", "success guaranteed", or a specific recovery percentage or payout date.
  3. They want payment up front: a handling fee, deposit, unfreezing fee, tax, channel fee or activation fee.
  4. They ask for your wallet's private key or seed phrase, or for an exchange password or verification code.
  5. They say they are hackers, or claim an "internal partnership" with an exchange or the police, or "officially authorized recovery credentials".
  6. They have you install remote-control software, or bring you into an encrypted chat group to keep "cooperating".
  7. They have you download a particular app or connect your wallet.
  8. They offer transfer screenshots of "successful recoveries" and "customer reviews" as proof.
  9. They hurry you: "the on-chain records will be gone if this isn't handled today", "there is only one place left".

How to read the result: if one item fits, stop and don't pay; if items 1–3 fit together (they contacted you first, they guarantee recovery, they want payment up front), treat it as a recovery scam; if item 4 or item 6 turns up, even on its own, cut contact at once. Someone who asks for your private key or seed phrase is no longer after a "service fee". They are after whatever is left in your wallet. Remote-control software lets the other side operate your device directly. Some "recovery services", once paid, go on to ask for these in the name of "handling it for you", or bring you into an encrypted chat group to keep "cooperating".

One more word on item 8: transfer screenshots, chat logs and "customer reviews" can all be forged. However real a screenshot looks, it is not proof.

I didn't tell anyone. How do they know I was scammed?

  • Lists of victims are bought and sold. The FTC page cited above says scammers buy, sell and trade these lists, expecting that people who have been scammed once are good targets for being scammed again.
  • Victim support groups, reporting groups and chat groups for people who were scammed. If you said in a group how much you lost and how, direct messages may follow.
  • Public posts asking for help. You left contact details, or information that can be linked to you, on a forum, a social platform or in a comment thread.

If they open by reciting how much you lost and how it happened, that shows only that the information is in their hands. It does not show that they are professionals or have any special channel.

Law enforcement gets impersonated too. In a public service announcement dated July 20, 2026, the FBI's Internet Crime Complaint Center (IC3) warned that scammers are impersonating FBI personnel who handle IC3 complaints, and that their tactics include targeting previous victims. The announcement states that IC3 will never directly communicate with individuals by phone, email, social media, phone apps, online chat or public forums, and will never ask for payment to recover lost funds.

Can USDT be recovered after it has been sent?

A confirmed on-chain transfer cannot be reversed, and no platform's support team can "refund" it. The one route that does exist is the issuer freeze described above: for a stablecoin with an issuer, such as USDT, law enforcement can make a request to the issuer. Whether it freezes the tokens, and what happens to them afterwards, is for the issuer and the investigating authority to decide, and nobody can give a guarantee. Native coins such as ETH and BTC have no issuer to approach.

So someone who "guarantees recovery" and wants to be paid first is promising something the investigators themselves don't promise. What you can do is report it and hand your evidence to the authorities. What you control is not sending a second payment.

What to do now, and where to report

Pay nothing more

As soon as the conversation turns to you paying first, stop and block them. If you have already paid a "recovery team", add that payment, their accounts, the receiving address and the chat history to your report.

Ask about your case yourself

After you report, if someone contacts you about "progress on your case" or a "compensation channel", do nothing on that call or in that chat. To check, call the authority that took your report yourself.

For saving evidence and changing passwords, follow Scammed in Crypto? What to Do and Where to Report It, which also has the details for each of the channels below. Use the one for where you live:

Related pages