Beware of recovery scams

No legitimate service can guarantee it will get your money or account back for an up-front fee.

The FBI warns that “recovery scheme fraudsters charge an up-front fee and either cease communication with the victim after receiving an initial deposit or produce an incomplete or inaccurate tracing report and request additional fees to recover funds.” These schemes deliberately target people who have already been scammed once. Never pay an up-front fee to a company that contacts you promising to recover lost funds, accounts, or cryptocurrency, especially if they ask for payment in gift cards, wire transfer, or cryptocurrency. FBI sources: IC3 Public Service Announcement I-081123-PSA · FBI San Diego — Seizes Cryptocurrency Recovery WebsitesNo legitimate service can guarantee it will get your money or account back for an up-front fee. The FBI warns that “recovery scheme fraudsters charge an up-front fee and either cease communication with the victim after receiving an initial deposit or produce an incomplete or inaccurate tracing report and request additional fees to recover funds.” These schemes deliberately target people who have already been scammed once. Never pay an up-front fee to a company that contacts you promising to recover lost funds, accounts, or cryptocurrency, especially if they ask for payment in gift cards, wire transfer, or cryptocurrency. FBI sources: IC3 Public Service Announcement I-081123-PSA · FBI San Diego — Seizes Cryptocurrency Recovery Websites

For Individuals, Executives, and Crypto Holders

SIM Swap Attack Investigation
Telecom forensics. Identity hardening. Carrier accountability.

For individuals whose phone number was hijacked by a criminal who then took over email, banking, brokerage, crypto, and corporate accounts. We deliver telecom forensics, account-access timeline reconstruction, identity hardening, and the FCC carrier-grievance package that supports civil action against the wireless provider. We investigate and document. We do not recover lost money. SleuthX, Inc. is an independent digital-forensics company; regulated investigative work is handled by our licensed Florida PI partner network under their own licenses.

Call (239) 241-8095

Your phone went silent. Your bank texted to confirm a transfer you did not make. Your email started rejecting your password.

Within hours, the wallets were drained, the brokerage account was liquidated, and the email that anchored every other account in your life was being used by someone in another time zone.

By the time you got the line back from the carrier, the damage was already cascading. This is the moment we step in.

Quinnlan Varcoe, Founder and CEO, sets the methodology every SIM swap scam investigation runs under and reviews case findings before they leave the practice. The practitioner team executes the technical work.

Engagements are confidential and NDA-protected. Start early, because the cleanup window for cascading account compromise is short.

Most cases run as a done-for-you device package. Fixed fee by number of devices. You see your exact price before you sign. Work beyond the packages, including litigation and expert testimony in Quinn's certified areas of incident response and intrusion analysis, is priced in writing before it starts.

Call (239) 241-8095

Optional fixed-fee tracks for well-bounded scope are available.

What this is

A forensic SIM swap attack investigation produces the documented evidentiary record that the FBI Internet Crime Complaint Center, the FBI Cyber Division and Secret Service Cyber Fraud Task Force, the Federal Communications Commission, your state public utilities commission, your wireless carrier's executive escalation channel, your cyber and crime insurance carrier, civil counsel pursuing the carrier under 47 U.S.C. §222 (enforced through the private damages action in §§206–207) and state-law negligence theories, and where applicable, plaintiff trial counsel can act on.

The investigation traces how the swap was authorized (in-store insider, call-center social engineering, online portal compromise, stolen carrier credentials), reconstructs the cascading account-takeover timeline across email, banking, brokerage, crypto exchanges, and corporate accounts, identifies any persistent criminal access, and produces the carrier-grievance and civil-action package that the institutions with subpoena power use to act on your case.

Who this is for

Cryptocurrency holders whose hot wallet, exchange account, or seed-phrase storage was compromised in the cascading account-takeover that followed a SIM swap.
Executives and senior employees whose carrier-side compromise unlocked corporate single-sign-on, email, and access to sensitive workplace systems, frequently triggering a parallel corporate cybersecurity incident.
High-net-worth individuals and family-office principals whose phone number is the recovery factor on a substantial concentration of financial accounts and who lost meaningful sums in the cascading compromise.
MFA-protected high-value account holders who believed SMS-based two-factor authentication was sufficient and discovered the limits of that assumption in the worst possible way.
Anyone who lost access to email, banking, or workplace accounts after a sudden phone outage and needs a forensic examiner to determine the scope of the compromise and document it.

One boundary worth naming: this page assumes a criminal stranger.

If the person with your number or your accounts is someone you know, a partner or ex who had your phone and knows your passwords, the order of changes is different, because cutting off their access is visible to them: what to do if someone has access to your phone walks that case.

For the platforms' own sign-in steps, start with our free guides to the big platforms' own steps. If an account is still taken over, our account takeover examination documents what happened.

How the engagement works

A written description. NDA-protected. Read directly by Quinn, the founder and CEO who sets the methodology behind every engagement. We hear the timeline, identify the immediate triage actions (port-freeze, the order of account changes, evidence preservation), and tell you whether forensic investigation will help or whether the situation can be resolved by going straight to the carrier and your bank.
Scoped engagement with a written proposal and pricing. Choose the self-serve tool at $200/mo or a done-for-you device package; an engagement retainer covers intake, immediate identity-hardening triage, and the first round of account-takeover and carrier-side evidence preservation, on terms set out in the letter. Anything beyond a package is priced in writing before it starts.
Forensic acquisition of relevant artifacts. Wireless carrier account history (CPNI request, port-history, account-change logs), email account login and device-fingerprint history, banking and brokerage account exports, cryptocurrency exchange account exports and transaction history, hardware security key and authenticator-app provisioning logs, and where applicable, corporate single-sign-on access logs (with employer authorization).
Investigation and reconstruction. Source of the SIM swap (in-store insider, call-center social engineering, online portal compromise, stolen carrier credentials), full cascading account-takeover timeline mapped against the swap window, identification of any persistent criminal access (residual mail rules, OAuth tokens, recovery-factor pollution), and where crypto was stolen, the wallet addresses and exchange records for law enforcement and counsel.
Identity hardening. Migration off SMS-based authentication for every account that supports it, hardware security key deployment, recovery-factor rotation to clean accounts the criminal does not know about, carrier-side port-freeze and porting PIN configuration, eSIM transition where supported, data-broker scrub to reduce the public attack surface that enables the next swap.
Written report that records the hash values, the method, the tools and their versions, and the exhibits, with a clear chain of custody; admissibility is the court's call. It is structured for the specific pathways that apply: FBI IC3 and Cyber Division referral, FCC and state PUC formal carrier complaints, civil action against the wireless carrier under 47 U.S.C. §222 (enforced through §§206–207) and state-law negligence theories, cyber insurance claim, and where crypto was stolen, the wallet and exchange records for law enforcement and counsel.
Coordination with the wireless carrier's executive escalation channel, FBI Cyber Division, Secret Service Cyber Fraud Task Force, FCC and state PUC, your insurance carrier, and civil counsel.

We examine only a device you own. Before we start, you sign a form stating that you own it.

How we work a SIM swap case

Written scope before any work. You see a written scope covering deliverables, timeline, and price, and you approve it before we begin. You are never billed for work you did not authorize.
We commit to findings, not outcomes. We tell you up front what the evidence can and cannot establish. Recovery, attribution, and prosecution are decided by banks, platforms, insurers, and courts. We produce the record they act on, and we put that distinction in writing.
Every case is investigated, not just scanned. A credentialed examiner reviews every case before findings leave the practice. You get a documented investigation with the hashes, method and tool versions recorded, not a single automated scan and a one-line answer.
We will tell you if you do not need us. If a free or simpler step would resolve your situation, whether a police report, an IC3 filing, or a platform's own recovery flow, we point you there first.
No fees contingent on recovery. We charge for the forensic and coordination work at standard rates, never a percentage of funds recovered. Getting the money back is controlled by your bank, the carrier, your insurer, civil counsel, and law enforcement. We produce the case file and the FCC carrier-grievance package that make their work tractable, and we charge for that work whether or not the funds come back.

Two ways to work a case

Hand it to an examiner, or run it yourself.

Both keep a chain of custody from the first file. The difference is who does the work.

Done for you

An examiner takes the case

A credentialed examiner works the case end to end and stands behind the report.

Who it is for: anyone in a crisis, on a deadline, or who wants the case off their plate
What you get: a credentialed examiner, the same forensic output and chain of custody
Your effort: hand over the devices or accounts, and we do the work
Price and billing: Fixed fee by number of devices. You see your exact price before you sign.

Call (239) 241-8095

Self-serve

Run it yourself

Fully automated digital forensics you run yourself. SleuthX automates a digital investigation end to end, from collecting and analysing the evidence to a report with every finding cited.

Who it is for: hands-on people who want to see what happened for themselves
What you get: A SHA-256 hash of every file as it is added, re-checked against the stored copy; An append-only chain-of-custody log; Every finding cited to the evidence it came from; An examiner's review when you want one
Your effort: you add the evidence and steer the investigation
Price and billing: $200/mo, billed monthly and renews until you cancel. Includes $200 of usage credit each month. The credit resets at the start of each billing month and does not carry over. Usage beyond it draws down a prepaid balance you top up in-app, and top-ups never expire.

Create your account

Automated output is prepared to evidentiary standards. Before you rely on it in court, a qualified examiner has to review it and be able to certify the work.

SIM swap protection is structural, not behavioral

The hardest lesson from a SIM swap is that the protections most people have are inadequate against a determined attacker. SMS-based two-factor authentication is not a meaningful defense against a criminal who can take over the phone number itself. Carrier-side port-freezes and porting PINs are useful but defeated by insiders. The defense that works is structural:

every high-value account moved off SMS to a hardware security key or app-based authenticator
recovery factors rotated to clean accounts that no public profile or data broker connects to your name
the carrier account locked down to in-store-only authentication
and the public attack surface (data brokers, social media, professional profiles) reduced to make the next swap operationally harder

We deliver this hardening as the second deliverable of every SIM swap engagement, after the timeline reconstruction. It is the work that makes a second swap far harder to pull off.

Evidence for a bank dispute, a Regulation E claim, or a carrier lawsuit

Where a SIM swap led to a fraudulent transfer, the forensic record is what turns a denied claim into a documented one. We assemble the carrier-side and account-access evidence in the form your bank's fraud team, a Regulation E error-resolution claim, or your cyber-insurance carrier actually asks for, namely the swap timeline, the unauthorized-change logs, and the account-takeover artifacts, preserved under a documented chain of custody. Regulation E is the right tool for a narrow slice: unauthorized electronic fund transfers on a consumer bank account, covering debit-card and ACH fraud, where you generally have 60 days to notify the bank and it has roughly 10 business days to investigate. It does not reach wire transfers, brokerage liquidations, or crypto withdrawals, which fall outside Reg E and run on other tracks. If you are weighing a civil suit or arbitration against the carrier, that same package is the forensic report your attorney needs: plaintiffs' firms that litigate SIM-swap cases under 47 U.S.C. §222 (via the §§206–207 damages action) and state negligence theories require exactly this evidence, and we coordinate the hand-off to counsel you retain. We investigate and document. Whether funds come back is up to your bank, your insurer, and counsel.

Fixed fee by number of devices. You see your exact price before you sign.

Call (239) 241-8095

How We Work

A confidential, structured engagement.

Confidential Consultation

A direct conversation with Quinn, the founder and CEO who oversees every engagement. NDA-protected. No sales process.

Signed Engagement

The price is fixed by the number of devices. Before any work starts, you sign the agreement and the chain-of-custody form.

Examination and Report

A named examiner works the devices and accounts you sent and writes a report with the hash values, the method, the tools and their versions, and the exhibits.

Frequently asked about SIM swap attacks

My phone went dead and now my accounts are gone. What is happening and what do I do first?

What is almost certainly happening is a SIM swap attack: a criminal social-engineered your wireless carrier (or paid an insider at the carrier) to transfer your phone number to a SIM card the criminal controls. Once the criminal owns your number, they own every account that uses SMS as a recovery factor or as a second factor of authentication: email, banking, brokerage, crypto exchanges, payment apps, and frequently the corporate single-sign-on you use at work. The first three actions matter enormously and are time-sensitive. First, call your carrier from a different phone immediately, identify yourself in person at a retail store if possible, and demand the line be returned to your control with a port-freeze and a porting PIN added to the account. Second, from any device you still control, change passwords on email first, then financial accounts, then crypto exchanges, and rotate every recovery email and recovery phone number to a new account the criminal does not know about. Third, file an FBI IC3 complaint and a complaint with the Federal Communications Commission and your state public utilities commission against the carrier. Then contact us. The window for preserving the carrier-side evidence is short.

How is a SIM swap investigation different from a carrier complaint?

A carrier complaint is a customer-service ticket filed against the company that let the swap happen. A SIM swap attack investigation produces the documented forensic record that turns that complaint into a documented claim. We acquire the carrier's account-history records (CPNI, port logs, account-change logs), reconstruct the timeline of unauthorized account changes, identify the channel through which the swap was authorized (in-store insider, call-center social engineering, online portal compromise, account-takeover via stolen carrier credentials), correlate the swap timing with the downstream account takeovers (email, banking, brokerage, crypto), and produce a chain-of-custody package that supports civil litigation against the carrier under 47 U.S.C. §222 (a carrier duty a private plaintiff enforces through §§206–207) and state-law negligence theories, FCC and state PUC formal complaints, IC3 and FBI Cyber Division referral, cyber insurance claims, and where crypto was stolen, the wallet and exchange records for law enforcement and counsel.

Can you get back crypto stolen in a SIM swap?

No. We do not recover lost money. Getting your phone number back from the carrier is usually fast. Money or crypto drained while the attacker controlled your number is a separate and much harder problem, and stolen crypto is frequently gone for good once it leaves your control. It is typically moved through exchanges, mixers, and chain-hops soon after the takeover. Whether any of it comes back depends on exchanges, law enforcement and licensed counsel, and frequently on international cooperation. What we deliver is the forensic case file: the timeline of the SIM swap, the account-takeover artifacts on every wallet and exchange account that was compromised, the carrier-side evidence for a civil action against the wireless provider, and an IC3 and FBI Cyber Division referral package. We do not take fees contingent on recovery. And be wary of anyone who guarantees they can get your crypto or drained funds back for an up-front fee, because that guarantee is itself a scam, and the FBI and FTC warn that these fake recovery operators specifically target people who were just hit.

What about my email account, my banking, my work accounts? How bad is this and how long does cleanup take?

How bad it is depends on how long the criminal had control of your number before you noticed. A swap that lasted ninety minutes typically results in two or three primary account takeovers (most commonly the email account that anchors everything else, plus one or two financial accounts). A swap that lasted twelve hours typically results in cascading compromise across twenty or more accounts as the criminal works systematically through every service that uses SMS-based password reset. Cleanup is not a one-day job. The scope depends on how many accounts were reached. The work runs in order: account-takeover triage, the full timeline reconstruction, identity hardening (moving every recovery factor away from SMS, hardware security keys on every account that supports them, carrier-side port-freezes and porting PINs), and the FCC/PUC carrier-grievance package and civil-action documentation. Run it yourself in the SleuthX tool for $200/mo once, or have our team do it for you in a done-for-you device package. Fixed fee by number of devices. You see your exact price before you sign. Anything beyond a package is priced in writing before it starts.

Should I sue my wireless carrier for the SIM swap?

Talk to a plaintiffs attorney who handles telecommunications-fraud cases before answering that question. There is a body of case law (T-Mobile, AT&T, Verizon have all been sued repeatedly for SIM swap negligence) and the legal theories include the carrier's duty to protect customer proprietary network information under 47 U.S.C. §222, a duty a private plaintiff enforces through the damages action in §§206–207 and the theory the Ninth Circuit allowed to proceed in Terpin v. AT&T (2024), where it survived summary judgment rather than winning on the merits. Others are state-law negligence and gross negligence, breach of contract against the carrier's customer agreement, and where the swap was facilitated by a corrupt insider, agency-theory claims that hold the carrier responsible for the insider's conduct. That is persuasive authority, not a settled nationwide right to sue, and many carrier agreements compel arbitration, which can keep the dispute out of court entirely. Whether a suit is viable in your case depends on the specific facts: how the swap was authorized, what the carrier knew or should have known, whether port-freeze or PIN protections were in place and bypassed, and the size of the loss relative to the cost of litigation. Our forensic report is the foundation of any such case. We do not provide legal advice and we do not represent clients in litigation; we produce the evidence and refer to plaintiffs counsel where appropriate.

Can you actually identify the people behind the SIM swap?

An examination can show what happened on your phone line and accounts, and when. It often cannot show who was behind it, and we will not tell you it can. Carrier-side records can be subpoenaed, and the criminal's downstream account activity (email logins, exchange logins, IP and device fingerprint logs) is often preserved on the platforms they touched. Naming a specific person usually requires law-enforcement subpoena power. The report documents what you have for the FBI Cyber Division, the Secret Service Cyber Fraud Task Force, and state attorneys general.

How do I prevent this from happening again after the cleanup?

SIM swap protection is structural, not behavioral. The single highest-leverage change is moving every account that supports it off SMS-based authentication and onto either a hardware security key (YubiKey, Google Titan) or an app-based authenticator (Google Authenticator, Authy, 1Password) with the recovery factors rotated to a new email address that the criminal does not know about and that itself has hardware-key authentication. The second is locking the carrier account: port-freeze enabled, porting PIN set to a value not derivable from public information, account-PIN rotation, in-store-only authentication for any future account changes, and where supported, eSIM-only operation that prevents physical-SIM transfer entirely. The third is reducing the public attack surface: removing personal information from data brokers, scrubbing the phone number from social media and professional profiles, and reducing the number of services that have your number on file. We deliver this hardening as part of every SIM swap engagement, and it is the deliverable that makes a second swap far harder to pull off. Follow-on targeting, including repeat swap attempts and fake "recovery" scams that circle back to fresh victims, is a known risk after a first attack.

What does it cost, and can I pay over time?

A device examination is a fixed price set by the number of devices: one, two to three, or four to five. Each price includes a set number of examiner hours. You can start with one device, and you can ask about paying over time. You see your exact price before you sign.

Where are you, and do I have to send my phone?

We are based in Naples, Florida, and examine devices in Naples and in California. Before any work starts you sign one page: the agreement and the chain-of-custody form. The agreement you sign explains how to hand over or ship your device.

What if the examination finds nothing?

We do not promise a result. You get a written report on completion covering each device and each account you sent, whatever it shows.

Can you show who did it?

An examination can show what happened on a device or account, and when. It often cannot show who was behind it, and we will not tell you it can.

Will police, a court or my lawyer take it seriously?

We cannot promise how police, a court or a lawyer will treat the report. We can tell you what it contains: the hash values, the method, the tools and their versions, and the exhibits.

What happens next, and how long does it take?

You sign the engagement letter, and your card is charged when you sign. Most examinations are finished one to two weeks after you sign, provided your devices reach us promptly. If you need it sooner, ask us to rush it.

Is this a person or an AI?

This line is answered by the SleuthX team, and by the SleuthX assistant, an AI, when the team cannot pick up. A named examiner examines your device and signs the report.

Whose device can you examine?

We examine only a device you own. Before we start, you sign a form stating that you own it. If that statement is false, the evidence can become unusable in court.