Crypto recovery scam South Africa: warning signs and next steps
A crypto recovery scam in South Africa often targets someone who has already lost money or cryptocurrency. A person claiming to be an investigator, regulator, lawyer or specialist promises to recover the funds, then asks for an upfront payment, wallet deposit, password or seed phrase. The Financial Sector Conduct Authority (FSCA) has warned about impersonators who tell fraud victims to create and fund crypto wallets for supposed recovery. The regulator says it does not provide this kind of recovery service.
That warning gives South African consumers a clear first check: a message that uses an official name or logo is not proof that it is genuine. Do not send another payment because someone says it will unlock a refund. Pause, save the evidence and contact the relevant organisation through contact details you find independently.
How the follow-up scam works
After an initial investment or wallet scam, victims may receive unsolicited messages through social media, WhatsApp, Telegram, email or a phone call. The sender may claim to have traced a transaction or discovered funds held in a wallet. They may use screenshots, formal-looking documents or copied regulator branding to make the offer feel credible.
The next request can be framed as a tax, verification deposit, network fee, legal charge or refundable security payment. A demand to pay more before a recovery is released is a serious warning sign. So is any request to share a seed phrase, private key, one-time password or remote access to a device. These details can give another person control over an account or wallet.
Check the claim independently
Do not use a phone number, link or email address supplied in the recovery message. Find the FSCA website or the relevant firm’s official site yourself and use its listed contact channel to ask whether the person and service are genuine. The FSCA’s 2025 public warning describes an impersonator falsely presenting himself as a “Chief Executive Investigator” and requesting wallet funding. Its earlier advisory also says the regulator does not request fees before investigating misconduct and is not mandated to recover investors’ funds.
A firm’s online presence, registration document or confident explanation is not enough to establish that it can recover a particular blockchain transaction. Even a legitimate financial-services authorisation does not prove that a promised recovery outcome is possible. Treat guaranteed refunds, urgent deadlines and “inside access” claims as reasons to stop and verify.
If you have already replied or paid
- Stop the conversation: do not send more money, codes, passwords, identity documents or wallet recovery information.
- Secure accounts: change passwords from a trusted device, enable multi-factor authentication and contact your exchange or bank through its official app or website.
- Protect the wallet: if a seed phrase or private key was shared, assume the wallet is compromised. From a safe device, seek guidance from the wallet provider and consider moving any remaining assets to a new wallet that uses a fresh recovery phrase.
- Preserve evidence: keep messages, usernames, phone numbers, email headers, wallet addresses, transaction IDs, payment receipts and dates. Do not edit screenshots or delete the original chat.
- Report promptly: contact your bank or exchange about the payment and report suspected crime to the South African Police Service (SAPS).
Blockchain transfers are generally difficult to reverse, and a report cannot guarantee that funds will be returned. Quick contact with a bank or exchange may help it review a payment or protect an account, but do not let anyone claim that reporting automatically means recovery.
Where to report in South Africa
SAPS advises people affected by cybercrime to report it at a local police station. Its crime-reporting guidance says reporting is free and a complainant should obtain a CAS number. Keep that reference with the evidence you gathered and ask the station how to provide additional information. If the suspected service concerns a financial product or provider, the FSCA also has a complaints and enquiries process that accepts matters related to crypto assets.
Contact organisations only through independently verified channels. The FSCA’s contact page lists its contact centre and complaint process; the regulator’s warning pages explain impersonation risks. Reporting to an authority is different from paying a private “recovery agent”. No person should ask for your seed phrase as part of a report.
Reduce the chance of a second loss
- Keep recovery phrases offline and never share them with support staff or investigators.
- Use official exchange and wallet apps obtained from the provider’s verified website.
- Do not approve a wallet connection or transaction while someone is pressuring you on a call.
- Search the exact company name and verify claims using a regulator’s own site.
- Be cautious if a stranger contacts you after you post about a loss; scammers monitor public comments.
- Talk to a trusted person before making an urgent payment connected to a promised refund.
Useful official sources
Read the FSCA’s public warning on impersonation and fraudulent schemes and its complaints and enquiries information. SAPS explains how to report cybercrime and how to report a crime and obtain a CAS number. For more wallet-security explainers, see the CryptoSigy risk-management hub and the South African crypto guides.
Remember
A genuine regulator will not ask you to fund a crypto wallet so it can return money. The safest response to an unsolicited recovery promise is to pause, verify independently, preserve the evidence and report through official channels. Never pay an additional fee or disclose wallet secrets because a stranger says recovery is guaranteed.
