Identify the problem before looking for help
“Recovering inherited crypto” can mean finding instructions, opening an encrypted file, restoring a wallet, completing an exchange's deceased-customer process, or investigating theft. These are different jobs. A service that can explain a transaction is not necessarily able to restore a missing key or obtain control of funds.
Write one sentence describing the blocked step without including secrets: “We have a device but do not know which documented recovery method applies.” That is more useful than posting photographs of everything you found. Keep account records, technical access, and authority to act separate. This guide is a safety checklist, not legal advice or a recovery guarantee.
Use a stop and verify decision table
The table is an editorial triage tool, not a certification of any provider. A reassuring answer is a starting point for verification, not proof of safety.
| Situation | What to check | Immediate boundary |
|---|---|---|
| A stranger promises a guaranteed refund after an upfront payment | Independently verify the organization and the claim | Do not pay or provide identity documents through that conversation |
| A supposed support agent asks for seed words, a private key, or a wallet passphrase | Compare with the manufacturer's support policy | Do not send the secret or type it into their form |
| Someone asks to control your computer while recovery documents are open | Why access is needed and whether a less intrusive method exists | Decline unsolicited remote access; close sensitive material |
| A professional offers a clearly scoped review | Identity, relevant qualifications, written scope, fees, data handling, and limitations | Share only the minimum non-secret facts needed to evaluate the engagement |
| An exchange asks for estate documents | Its independently reached official deceased-customer process | Verify the destination before uploading private documents |
| A report shows where stolen coins went | Whether it demonstrates tracing or an actual legal recovery route | Do not treat a transaction diagram as a promise of repayment |
The FTC describes refund scams in which unexpected contacts offer recovery in exchange for money or personal information. The FBI warns that private recovery businesses cannot issue seizure orders. Neither a professional-looking report nor a claimed law-enforcement connection establishes that someone can return assets.
Verify assistance without giving away the recovery material
Some paid work has a legitimate, limited purpose: estate advice, device assessment, documentation, or technical troubleshooting. Payment alone does not determine legitimacy. Equally, a registered business or signed contract does not prove technical competence or make a guaranteed outcome credible.
Before engagement, ask for a description of the deliverable, prerequisites, excluded work, fees if unsuccessful, and how the provider handles sensitive data. Confirm professional credentials through the relevant independent register when applicable. Avoid relying only on testimonials or contact details supplied in the original message.
For vendor support, start from a previously verified bookmark or independently established official domain. Trezor's phishing guidance says its support will not request your wallet backup and warns against urgent unsolicited instructions. A manufacturer-documented restoration that you deliberately initiate is different from disclosing a backup to a support agent. Most wallet makers offer no phone support at all; see which crypto wallet support numbers are real.
Remote support deserves its own review. The FTC documents fake technicians who seek computer access through invented problems. Legitimate remote-support software does not establish that the person using it is legitimate. Do not display recovery secrets during a screen-sharing session.
Walk through a fictional family example
This example is invented, not a customer case. Lina finds her late uncle's hardware wallet and a folder labeled “recovery.” She asks an online group how to identify the device. A stranger offers to “synchronize the inheritance wallet” if she installs a support tool and pays an activation fee.
Lina stops. She records the message without replying or opening its attachment, then consults the contact already named in the family's instructions. Together they identify the device model using non-secret information and read the official support material. They do not open the sealed backup for the stranger.
The useful outcome is not an instant recovery. It is a clearly defined next step, with the materials still protected. If the plan names no helper, use the inheritance-contact selection guide to establish a verified route rather than choosing the first person who responds.
If you were contacted but shared nothing
Stop the conversation. Do not download a proposed tool, open an attachment, connect a wallet, or send a small “test” payment. Preserve the sender identifier, message, claimed organization, and time if you can do so without interacting with suspicious content. Then report and block through the messaging platform.
Tell the family member coordinating the recovery so others do not answer the same approach. If a real company was impersonated, report the message through its verified support channel. Record a simple status: “Unsolicited contact; no documents, secrets, money, or access shared.” Receiving a message alone does not establish that your wallet is compromised.
If information or access was already exposed
Treat exposure as time-sensitive and stop following the sender's instructions. What happens next depends on what was shared.
Account credentials or computer access. End the remote session and stop using the affected device for sensitive recovery work. Use a separate trusted device to reach genuine support. The FTC's incident guidance covers compromised-password changes, two-factor authentication, and malware checks. For an estate account, coordinate recovery through the authorized representative and provider's process rather than impersonating the deceased.
Wallet backup or private key. Treat it as potentially compromised even if the balance has not changed. A device PIN is not a replacement for protecting the backup; see the PIN, seed, and passphrase distinction. Trezor's compromised-backup guide describes urgent migration to a new backup and notes that a one-device procedure is complicated. Obtain verified, model-specific assistance promptly. Do not improvise a reset, destroy the only backup, or send funds to a “safe wallet” supplied by the caller. Technical urgency does not remove the need to establish authorization and a correctly verified destination.
Money or identity documents. Contact the relevant payment provider, exchange, or institution through its official channel and describe the incident. Ask what protective or recovery options remain; a report is not a guarantee of reversal. Preserve transaction identifiers and receipts, not additional copies of secrets. US reports can go to the FTC and FBI IC3; elsewhere, use the appropriate local reporting authority.
Put a stop rule inside the inheritance instructions
Add a short page that recipients can find before encountering the secrets:
- The primary helper, alternate, and independent way to verify each.
- The exact problem each helper can address and who may authorize action.
- Materials that must never be sent in chat, email, or a support ticket.
- Official starting points for the wallet and relevant account providers.
- What to do if a request contradicts these instructions.
- A private incident-record location that does not contain recovery secrets.
Practice a suspicious-message scenario during a family recovery drill. Passing means the recipient pauses and finds the verified help route, not that they can diagnose every scam.
PingVaults can carry encrypted instructions; it does not recover missing wallet secrets, certify advisers, or reverse blockchain transfers. Read the security model and limitations before deciding what belongs in a recovery package.
Common questions about recovery assistance
Does a padlock icon prove a recovery website is genuine?
No. It does not establish the operator's identity or competence. Verify the destination independently and judge the requested action, not just the page's appearance.
Can I share a screenshot instead of typing the seed?
No. A readable image discloses the same secret. Do not photograph or screenshot seed words, private keys, or backup material in the first place. If legitimate troubleshooting needs a device photo or an error message, remove all secret material from view before making the image. Do not send it if you cannot confirm that it contains no secrets.
Should a helper promise success before seeing the case?
Treat that promise as a warning. A scoped assessment should distinguish what is known, what is missing, and what cannot be concluded. Do not let confidence substitute for evidence.