Red flags of fake crypto recovery help
The longer playbook of refund fraud is documented separately. This page is the field guide for the messages that arrive after you search a missing deposit: fake Binance support, a dashboard that already 'found' your hash, a site that wants a wallet signature to verify you.
A legitimate process asks for a public transaction ID and sends you to the destination platform's own URL. Everything else on this list is a disqualifier.
The impersonation pattern
- A Telegram, WhatsApp or X account that messages you first, using a Binance, Coinbase, Kraken or TXLens logo.
- A 'senior recovery specialist' who already knows your hash because you posted it in a forum.
- A support ticket number they generated, not one that appears when you are logged into the real exchange.
- A URL that is almost the official help centre, with an extra subdomain or a swapped character.
- UK NCSC: phishing attacks — Government guidance on impersonation, lookalike domains and why unexpected contact is a warning.
- Action Fraud: recovery fraud — UK reporting-centre description of criminals who charge to recover money already lost to a scam.
The wallet-connect and seed-phrase tells
No exchange recovery form, and no TXLens diagnosis, requires a wallet connect, a signature, a seed phrase, a private key, or a 2FA code. Those secrets move funds. A missing deposit is a reading problem plus a platform policy problem.
Sites that ask you to 'prove ownership' by pasting the twelve or twenty-four words are draining the rest of the wallet. Sites that ask you to sign a Permit or infinite approval are draining the tokens that remain.
| Request | Legitimate recovery | Fraud |
|---|---|---|
| Transaction ID | Yes, it is public | They already have it from your post; they still ask for keys |
| Seed phrase / private key | Never | Always framed as verification or 'wallet sync' |
| Wallet connect signature | Never for an exchange deposit | Typed as 'connect to trace' |
| Upfront crypto fee to an individual | No | Gas, tax, unlock, or insurance |
| Official platform URL you typed yourself | Yes | Replaced by a chat link |
Fake dashboards
A page that shows your hash, a progress bar and a 'recovered' amount before you have authenticated to the real exchange is a prop. The chain is public, so displaying your hash proves nothing. The progress bar is not a miner, not Binance, and not Coinbase.
TXLens shows the same public fields an explorer shows, then a diagnosis you paid a fixed sterling price for. It does not display a recovered balance, because it cannot recover a balance.
The test that ends the conversation
The existing guide on avoiding recovery scams covers the wider refund-fraud industry and the FTC and FBI warnings. Use that when you want the playbook. Use this page when you are staring at a chat that already has your hash.
- If they contacted you, stop.
- If they want keys, a seed, a signature or a connect, stop.
- If they guarantee recovery or quote a success rate, stop.
- If they want payment to a personal wallet before showing the destination's official form, stop.
What you get, and what it costs
Free, always
The transaction check: network, asset, amount, both addresses, timestamp, on-chain status, confirmation count, and a copyable evidence message for support. No diagnosis.
£9.99, one-off
The diagnosis: the likely cause, recovery outlook, step-by-step instructions, the official support route, wording written for that case, and 72-hour monitoring. No subscription.
Questions
Someone from 'Binance Recovery' already has my TXID. Could they be real?
Having the TXID proves they can read a public chain or your post. It does not prove they work for Binance. Real Binance recovery happens after you sign into binance.com and open Binance's own form.
They asked me to connect a wallet only to view the diagnosis. Is that TXLens?
No. TXLens asks for a transaction ID in a text field. It never connects a wallet. A connect prompt is the drain.
Related
Platform requirements on this page were last reviewed 2026-08. They change without notice, which is why every diagnosis is phrased as a likely cause rather than a certainty.
TXLens is read-only. We only use your transaction ID and public blockchain data. We never ask for your private keys, seed phrase or exchange login.