Aftercare after crypto fraud: what to expect after your report

What is aftercare after crypto fraud and what does it involve?

Aftercare after crypto fraud is the whole set of steps after the report: securing and recording data, investigating the route your payment took, protecting your own wallets and accounts, and monitoring the address the holdings went to. It is practical work and not guidance.

What aftercare is not: a route aimed at getting money back. A transaction on the blockchain cannot be reversed, and once holdings have arrived at a service provider the action lies there and not with an investigator.

What happens after you have filed a police report?

After your police report your notification is entered in a file and the police can demand data from a service provider through criminal procedure, something you cannot do yourself. What you hear next and when depends on the interest of the investigation and not on the size of your loss.

In the meantime your own file stands still, unless you complete it yourself. That is exactly why it pays to have the route of your payment recorded independently: it makes an addition to your report concrete and gives you something in hand towards the service provider involved.

Which steps do you take in the first week after the report?

In the first week of aftercare after crypto fraud you do seven things, and the order is deliberate: first record, then secure, then investigate.

1. Export and keep the full conversation history with the counterparty, including profile names, telephone numbers and times.
2. Make screenshots of the platform and of your balance there, with the date visible in the image.
3. Note for each payment the amount, the time, the receiving address and the transaction hash.
4. Remove software that allowed someone to watch remotely and check whether unknown sessions or devices are attached to your accounts.
5. Switch on two factor verification on your email and on every trading platform where you have an account, and change passwords you reused.
6. Move holdings out of a wallet whose data you suspect has been seen, but only if you are certain that you are the only one with access.
7. File the report and have the route of your payments recorded, so that the notification rests on facts instead of on a reconstruction from memory.

What is often underestimated is step one. We regularly see that a chat conversation has already been deleted before someone looks for help, and it is exactly those conversations that complete the timeline. How to secure evidence without damaging it is set out in our explanation of keeping evidence after a crypto theft.

What can you do with the address your money went to?

An address your payment went to can be watched, so that you know when the holdings move and where they finally arrive. That is called address monitoring and it is useful because holdings often sit still for months before they go to a trading platform.

The practical use lies in the timing. As soon as the holdings arrive at a service provider, there is a concrete lead to follow up through the channels intended for it. If the address stays quiet, monitoring yields nothing, and we say so. More about that is in our explanation of monitoring a crypto address after an incident.

How does aftercare after crypto fraud prevent a second hit?

A large part of aftercare after crypto fraud is prevention, and you prevent a second incident by assuming that your data now circulates and acting accordingly. Anyone who has once deposited is on a list, and that list is reused.

• Assume that every unexpected message about your loss is a follow-up attempt, even if the sender names your file number or the correct amount.
• Do not click links in emails about your case and always look up the party involved yourself, because phishing after an incident is the most common second step.
• Never give out your recovery phrase or private key, not even to someone who says they can release your holdings.
• Never pay in advance for recovery, tax, a fine or a verification amount.
• Have a new wallet created instead of continuing to use an existing one whose data may have been seen.

What do you do if someone offers to get your crypto back?

You do not take it up, because an offer that guarantees return or recovery in exchange for payment is a recovery scam. Real services that guarantee access or return do not exist, and that is not a reservation but a technical fact.

Paucitas never asks of its own accord for your recovery phrase or private key. If you need help reading out or restoring your wallet, we guide you through that completely, without us having to see that data ourselves.

The difference is simple to test: a party that says in advance what the outcome will be makes a promise nobody can keep. A party that says what it can establish and where the limit lies does investigation.

What can aftercare after crypto fraud not solve?

Aftercare does not solve the fact that a transaction is final and that after the cash out point the action lies with a third party. That limit should be clear in advance, because an expectation that is not met does more damage than no expectation.

• Paucitas makes no commitment about the outcome of an investigation.
• Paucitas does not independently establish who is behind a crypto address. What is recorded is which service provider or party holdings went to, so that this information can be followed up through the channels intended for it.
• Paucitas holds no funds itself and carries out no transactions on behalf of clients.
• Transactions outside the blockchain, such as cash payments or internal bookings within an exchange, are not visible in blockchain data. They are only included if underlying documents are available.
• Where mixers or privacy oriented networks are used, the chain cannot always be followed in full. In that case it is stated explicitly up to which point the route can be established.
• A report by Paucitas is limited to factual observations and the investigation of those observations.
• Paucitas gives no tax or legal advice.

What can you do yourself and when is that not enough?

You can record, secure and file a report yourself, and together that is the largest part of aftercare after crypto fraud. With a single payment to an address you can find again, that is often enough.

It is no longer enough as soon as the route splits over several addresses or networks, as soon as a platform has been shut down, as soon as you can no longer establish which amount ended up where, or as soon as you want to add to your report in a way that has to rest on facts. From that point an independent recording is needed.

Data is supplied digitally or at the office. Per case a delivery list is provided which states what data is needed. Where necessary Paucitas guides the collection and delivery of that data.

Paucitas usually responds within a few minutes to an hour and in virtually all cases on the same working day.

What is in the report and how long does an investigation take?

A report by Paucitas follows a fixed structure: reason and description of the assignment, the questions, the scope, the starting points, the data supplied, the sources consulted, the method in outline, verification and quality assurance, reservations and limitations, findings per part, a chronological overview, analysis and coherence, conclusion, statement of independence and appendices. Not every report contains all parts, and the structure is matched to the purpose.

An investigation by Paucitas takes, depending on the size of the file and the urgency, between one working day and two weeks. An urgent report can be delivered within one working day and in exceptional cases on the same day. A regular investigation is usually ready within three working days. In files with many transactions, several wallets or missing history the lead time rises to around two weeks. A surcharge applies to urgent assignments.

Paucitas works with a fixed rate based on your situation. Sometimes we apply an hourly rate by agreement, but the hours are always fixed in advance, so that you never face surprises. No investigation is started before the costs have been discussed and agreed.

Paucitas uses no automated analysis software, in any role whatsoever. The investigation is done manually on the basis of publicly accessible block explorers. Every transaction and every transaction hash is verified one by one before it is included in a report.

How do you keep an overview in aftercare after crypto fraud with several payments?

You keep the overview with a simple timeline that holds four items per payment: date and time, amount, receiving address and transaction hash. More fields do not make the overview better and in practice cause it not to be kept up.

Add two columns to that timeline that are often forgotten: from which own address or which platform you paid, and which conversation or message preceded that payment. It is precisely that link between a booking and a message that later makes the difference between a series of loose payments and a traceable event.

If you work with several platforms, also note per platform the date on which you created the account and the date on which you were last able to log in. Accounts disappear, and those two dates determine which overviews you can still request. For the questions that come afterwards, our overview of frequently asked questions about blockchain investigation and aftercare is the logical next step.

Where does the work of the police begin and where does that of Paucitas?

The police take down your report and can demand data from a service provider, which Paucitas cannot do, and instead Paucitas establishes which route your payment took and up to which point that is certain. Which authorities may be involved beyond that is set out in our overview of authorities in crypto investment fraud.

For the wider context Europol publishes on the role of cryptocurrency in organised crime, and the European Commission on the European framework that crypto service providers fall under.

If you want to know what can still be established in your situation, you can go through your file calmly in a free intake. We say honestly when a route is expected to reach a dead end. More about this service is on personalised aftercare.

Date of last revision: 28 August 2026.