The short answer
No legitimate wallet or exchange asks for your recovery phrase, asks you to move funds to a "safe" address, or contacts you first to offer recovery of lost crypto. Treat any of those three requests as proof of a scam regardless of how convincing the source looks, and reach support only through an address you typed yourself.
The recovery phrase request
Your recovery phrase reconstructs your wallet. Anyone holding it holds your funds, immediately and irreversibly. There is no support process, verification step or migration that requires it.
MetaMask states the rule and the exceptions together: anyone asking for your Secret Recovery Phrase outside official channels is a potential scammer, and the only legitimate reasons to enter it are creating a wallet for the first time or restoring one. Anything else is likely a scam.
This includes websites that look exactly right, forms labelled "validate wallet", and support agents who have already been helpful for twenty minutes. The request itself is the tell.
The "move your funds to a safe address" call
The second script does not ask for a phrase. It tells you your account is compromised and that you must move funds immediately to a secure address the caller provides.
The FBI has warned specifically about scammers impersonating cryptocurrency exchange staff and creating urgency to get funds moved. Consumer protection guidance makes the same point about business impersonators more generally: the claim is that there is fraud on your account and that the fix involves you sending crypto somewhere.
Legitimate exchanges do not phone or message you with a new address to move funds to. A genuine security problem is handled inside your account, not by an outbound transfer to an address a stranger supplied.
The recovery service that contacts you
The third script targets people who have already lost money. Someone offers to recover it, often claiming a legal, governmental or specialist-firm identity, and asks for a fee, personal information or wallet access.
Consumer protection guidance is unambiguous: scammers offer recovery services to people who have lost money to fraud, impersonating a government agency or company and claiming they can recover the crypto — and they cannot. The FBI has issued warnings about fictitious law firms running exactly this play against earlier victims.
There is no service that can reverse a confirmed blockchain transaction. Anyone who says otherwise is selling a second loss.
How the contact is made
The channel is usually a search result, a social media reply, a support form on a lookalike site, or a direct message that arrives suspiciously soon after you post about a problem in public.
Two defences cover most of it. Reach support only by typing the service’s address yourself or using a bookmark you saved earlier — never through a link, number or handle that arrived in a message. And do not describe your problem publicly with details that identify you as someone currently holding funds and currently confused.
Spoofed phone numbers, spoofed email domains and spoofed sites are all cheap. The channel proves nothing.
If you have already engaged
Stop the conversation. If you shared a recovery phrase, assume every account derived from it is compromised: create a new wallet with a new phrase and move what you can, immediately, accepting the fees. If you granted an approval, revoke it — see token approvals.
Report it to the platform through its official route, and to the relevant national fraud or cybercrime reporting body. Then expect a second wave: victim lists circulate, and the recovery-scam script is aimed at exactly the people who have just been through the first one.
Frequently asked
Will a wallet or exchange ever ask for my recovery phrase?
No. The only legitimate times you enter it are when creating a wallet or restoring one, in your own wallet software. Any other request, from any source, is a scam.
Someone from my exchange called about suspicious activity. Is that real?
Treat it as not real. Hang up and reach the platform through an address you type yourself. Caller ID and email domains can be spoofed, and legitimate security handling does not involve you sending funds to an address someone gives you.
Can anyone recover crypto sent to the wrong address?
Not by reversing the transaction. Where recovery exists at all, it is a discretionary process run by a platform that controls the receiving address. Unsolicited recovery offers are themselves a documented scam.
Is it safe to ask for help in a public group?
Be careful. Public posts about a stuck transfer attract direct messages within minutes, and those messages are the scam. Use official support channels.
Before you act
- Never enter your recovery phrase anywhere except your own wallet, when creating or restoring it.
- Never move funds to an address supplied by someone who contacted you.
- Reach support only through an address you typed or bookmarked yourself.
- Treat any unsolicited recovery offer as a second scam aimed at the first loss.
Sources & further reading
- MetaMask: spoofing scams
Recovery-phrase requests outside official channels, and the only legitimate uses of the phrase.
- Coinbase: technical support and impersonation scams
How impersonation contact is made and what support never asks for.
- FBI IC3: scammers impersonating cryptocurrency exchanges
Public warning about exchange impersonation and urgency to move funds.
- FTC: what to know about cryptocurrency and scams
Business impersonation patterns and fake recovery services.
- FBI IC3: fictitious law firms targeting scam victims
Recovery scams aimed at people who have already lost funds.
Sources checked on 18 September 2026. Network features and platform support can change; check the relevant provider before acting.
AI-assisted editorial content; no independent expert review or transaction verification is claimed. Tokens and bridges carry issuer, market and smart-contract risks. This is educational information, not investment advice. Read our editorial policy.