All articles·8 min read·April 27, 2026

The hard truth first

If money was sent via wire, crypto, or gift card more than 72 hours ago and the receiving institution has not yet frozen the account, the funds are usually unrecoverable.

Anyone promising to recover crypto sent to a scammer for a fee is running a second scam on you.

Block them.

If the scam escalated into deposits on a fake trading platform (pig butchering), crypto scam recovery covers the crypto-loss layer.

What forensic investigation can actually do

Identity verification. Confirm whether the photos, name, and biographical details belong to a real person. Almost always they do not. The photos are usually scraped from someone unrelated, and that person is also a victim.
Attribution research. Trace the digital infrastructure (phone numbers, email accounts, crypto wallet addresses, IP geolocation, language patterns) to identify the scam network, using the same OSINT identity verification methodology we run as a service. We rarely identify the individual operator; we routinely identify the country and group.
Evidence preservation. Capture and preserve every message, call log, financial record, and platform interaction in a forensically sound, court-admissible format, with chain of custody, hash verification, and an expert declaration ready for filing.
Civil and criminal case support. Some matters (especially when the victim is elderly or vulnerable) qualify for elder abuse, fraud, or wire fraud charges. Forensic findings are the evidentiary foundation for any of those filings.

The narrow window where money can be recovered

Recovery is genuinely possible only when:

The funds went through a US-regulated bank, exchange, or payment processor
The institution can be reached within ~72 hours of the transfer
The receiving account was flagged or frozen before funds were withdrawn
You have a police report, FBI IC3 filing, and (if elderly) Adult Protective Services contact

We will tell you honestly which of these apply to your case, and if recovery is impossible, we will tell you that too instead of charging for a doomed effort.

What to file in the first 24 hours

FBI IC3 complaint at ic3.gov, for federal jurisdiction, fast
FTC complaint at reportfraud.ftc.gov, for pattern data and civil enforcement
Local police report, required for many bank fraud claim processes
Your bank's fraud department, with written notice the same day; many banks have a 60-day claim window
Platform abuse report on the dating site, Telegram, WhatsApp, or wherever the contact occurred, establishing a complaint timeline

Why people get re-targeted

After a successful scam, your contact information ends up on a "suckers list" sold among scam networks.

Within weeks, you will be contacted by a "recovery agent" or "FBI investigator" who claims they can get the money back for an upfront fee.

This is the second scam.

It is run by the same network.

They know which buttons to push because they wrote your file.

If anyone calling themselves an investigator asks for an upfront fee paid by gift card, crypto, or wire transfer, hang up.

What we do

Romance scam and catfish investigation covers identity verification, attribution where possible, evidence preservation that holds up in court, and honest scoping.

If your case has a recovery path, we will help you pursue it.

If it does not, we will say so.

Related services

Self-serve forensic tool

Want professional help with recovering from a romance scam?

$995 once. Lifetime license

Run SleuthX yourself. Every tool unlocked, no subscription.

Start in the app Book a triage call

Quinnlan Varcoe

Founder & CEO

GIAC-certified · 9 industry certifications

With operational experience across Fortune 50 security programs and the defense industrial base, Quinnlan founded SleuthX in 2022 to provide clients with the caliber of expertise typically reserved for the largest enterprises. Her work in threat intelligence and digital forensics has earned the trust of 26,000+ cybersecurity professionals who follow her analysis.

“26,000 professionals follow my work because I say what others won't — and I can back it up technically.”

Fortune 50 BackgroundDefense IndustryThreat IntelligenceDigital PrivacyIncident Response

Romance scam recovery: frequent questions

Can a forensic investigator get my money back from a romance scam?

In most cases, no. The hard truth is that money sent via wire, crypto, or gift card more than seventy-two hours ago, when the receiving institution has not yet frozen the account, is usually unrecoverable. Recovery is genuinely possible only when the funds went through a US-regulated bank, exchange, or payment processor, the institution can be reached within roughly seventy-two hours, the receiving account was flagged before withdrawal, and you have a police report and IC3 filing in hand. We will tell you honestly which of these apply to your case rather than charge for a doomed effort.

What can a forensic investigation actually do for a romance scam?

Identity verification to confirm whether the photos, name, and biographical details belong to a real person, which they almost never do. Attribution research to trace the digital infrastructure including phone numbers, email accounts, crypto wallet addresses, IP geolocation, language patterns, and infrastructure overlap with known scam operations. Evidence preservation in a forensically sound, court-admissible format with chain of custody, hash verification, and an expert declaration. And case support for any civil, criminal, elder-abuse, or wire-fraud filing that follows.

Why is someone offering to recover my crypto for a fee a scam?

Because no one can recover crypto sent to an unknown attacker for an upfront fee. The blockchain transaction is final. Any service that claims otherwise, especially one that contacts you out of the blue after a scam and asks for payment by gift card, crypto, or wire, is a second scam run by the same network or a network that bought your file off a suckers list. Hang up. Block. If anyone calling themselves an investigator asks for an upfront fee paid by gift card, crypto, or wire transfer, it is fraud.

What should I file in the first twenty-four hours?

An FBI IC3 complaint at ic3.gov for federal jurisdiction. An FTC complaint at reportfraud.ftc.gov for pattern data and civil enforcement. A local police report, which is required for many bank fraud claim processes. A written notice to your bank's fraud department the same day, because many banks have a sixty-day claim window that starts ticking on the transaction date. And a platform abuse report on the dating site, Telegram, WhatsApp, or wherever the contact occurred, which establishes a complaint timeline that supports any later civil action.

Will the photos used by the scammer be of the actual person I talked to?

Almost never. The photos are usually scraped from someone unrelated, often a real person whose images were taken from public social media without their knowledge. That person is also a victim. Reverse-image search tools and forensic facial-recognition can identify the source person, which sometimes helps the source person take down the impersonating accounts. It rarely identifies the actual operator. Identity verification is part of the forensic deliverable but should not be confused with attribution of the scammer themselves.

Why do scam victims get re-targeted after the first scam?

Because your contact information ends up on a suckers list sold among scam networks. Within weeks of a successful scam, you will be contacted by someone claiming to be a recovery agent, an FBI investigator, an exchange compliance officer, or a lawyer with a class-action settlement. They claim they can recover the money for an upfront fee. This is the second scam. It is run by the same network. They know which buttons to push because they wrote your file. The single best protection is a firm rule never to pay anyone an upfront fee related to the loss.

Should I file a civil suit against the scammer?

Sometimes, when attribution leads to an identifiable individual or entity reachable by US process, when the dollar value justifies it, and when a police or IC3 case is already in motion. More often, the realistic legal path is supporting a federal criminal case, filing with Adult Protective Services for an elder victim, and pursuing the receiving financial institution if there is a documented compliance failure. A forensic evidence package supports all of these. Counsel should drive the decision after seeing what attribution surfaces.