Seed phrase entered in a fake app or on a fake site? What happens and what you can do now
Date: | Week 45 | Reading time: 6 minutesAuthor: Simcha Schrijver
In brief
Whoever has your seed phrase has your wallet. Scammers try to get that recovery phrase through fake apps, fake sites, letters with a QR code or a so-called helpdesk. If you entered it somewhere that was not genuine, every hour counts.
Paucitas sees that people often feel ashamed, while these tricks are made to be very convincing. Unsure whether you entered your seed phrase somewhere, or is your wallet already empty? Paucitas finds out what happened and where your crypto went.
Contact Paucitas. A no-obligation introduction is always possible.
Put simply
A real wallet, exchange or helpdesk never asks for your seed phrase. If you did enter it somewhere, move whatever is left straight away to a new wallet you create yourself. Let Paucitas take a look with you.
A message saying your wallet needs an update. An app that looks exactly like the one you know. A friendly agent in a chat who helps you. You type in your words, nothing happens at first, and then you suddenly see that your balance is gone. That feels like a blow. It also happens to people who have used crypto for years.
What is a seed phrase and why does it matter so much?
A seed phrase, also called a recovery phrase, is a list of usually 12 or 24 words. With those words you can reopen your wallet on any device. That makes them useful, but also vulnerable: anyone who knows the words can move your crypto without your phone or password. A real wallet, exchange or helpdesk therefore never asks for them.
How do scammers get hold of your seed phrase?
Paucitas sees the same routes again and again in practice:
- A fake app in the app store with the same name, the same logo and even good reviews.
- A fake site at the top of the search results through an advert, or through a link in an email or text.
- A letter or email about a mandatory update or security check, with a QR code leading to a copied site.
- A so-called support agent in a chat or on social media who helps you and asks to check your words.
- A photo or file of your seed phrase on your phone, in the cloud or in your email, found when an account is broken into.
Recognising one of these points does not automatically mean your crypto is gone. But it is a reason to act straight away and let someone take a look.
Why are these tricks so convincing?
The fake apps and sites sometimes match the real thing down to the smallest detail. The name is right, the logo is right, and the request for your words often comes at a logical moment, such as an update or a security notice. There is often a sense of urgency too: do it today or you will lose access. That urgency is exactly what stops people from pausing. Paucitas sees that victims often say afterwards that it felt like an ordinary step, like logging in to the bank.
I entered my seed phrase. What now?
If there is still something in the wallet, move it as quickly as possible to a new wallet you create yourself, with new words. Never use the old words again. Stop responding to the app, site or person involved, and keep everything: screenshots, the name of the app, the link, messages and your wallet address.
If the wallet is already empty, the money has often been moved within minutes. That feels hopeless, but a blockchain is public. Every transfer remains visible. Paucitas follows that route step by step and sees whether the crypto was passed on, split up or ended up at a platform that can cooperate. Read more about blockchain analysis.
What does Paucitas investigate?
Paucitas first looks at exactly what happened: through which app or site, at what moment, and which transactions followed. Paucitas also reads the messages, emails and documents, builds a timeline and maps where all the money went. That gives you one complete picture in a report anyone can follow step by step. Paucitas does not promise that crypto will come back. But afterwards you know exactly where you stand.
The report shows whether anything can still be reached and what logical next steps are. If it turns out to be a scam, it is a strong attachment to a report to Report Fraud or the police, because everything is set out completely and clearly. Report Fraud points out that most crypto activity is unregulated, so the Financial Ombudsman Service and the FSCS usually cannot help. Meanwhile, be careful with people who approach you after such a theft offering to get your crypto back; the FCA warns about these recovery room scams.
Why people trust Paucitas
Paucitas is an independent firm of experts based in Amsterdam, with its own office where you are welcome. Paucitas carries out all investigation itself, has many client reviews and regularly appears in the media. An honest picture comes first. Before starting, Paucitas discusses a tailored quote, with no surprises afterwards.
Paucitas can be reached 24/7 on +31 20 244 5774; the phone is answered in English. Through the form you will hear from us within 1 to 3 hours, and emails are answered within 24 hours, usually the same day.
Sources: Report Fraud, cryptocurrency investment fraud; FCA, recovery room scams.
Do you have questions about this blog?
Feel free to get in touch with Paucitas. Paucitas can be reached by phone 24/7, including evenings and weekends. Through the contact form we usually reply within 1 to 3 hours, and we answer e-mail within 24 hours.
Contact form
Usually a reply within 1 to 3 hours
"*" indicates required fields
We only use your details to contact you about your request. You can read more about this in our privacy statement.
Frequently asked questions about a stolen seed phrase
Does a wallet or exchange ever ask for my seed phrase?
Paucitas: no. A real wallet, exchange or helpdesk never asks for your seed phrase. You only use the words yourself, to restore your own wallet on a new device.
I entered my seed phrase but nothing is gone yet. Am I safe?
Paucitas advises not to wait. Whoever has the words can strike at any moment. Move what is there to a new wallet with new words that you create yourself, and stop using the old words.
Can I get my crypto back?
Paucitas: it depends on your situation. If you still have access to your own wallet or account holding funds, there are sometimes options. If everything was transferred to the scammers, things are different. That cannot be judged from a distance. Paucitas first looks at your situation and tells you honestly what is and is not possible. Be careful with parties that promise in advance that your money will come back. In doubt? Contact Paucitas and you will know where you stand.
What should I keep for an investigation?
Paucitas asks for everything you still have: the name of the app or the link, screenshots, messages, your wallet address and the time you entered the words. With that, Paucitas reconstructs the route of your crypto and a timeline.
How quickly can Paucitas look into it?
Paucitas can be reached by phone 24/7, in English. Through the form you will hear from us within 1 to 3 hours. An investigation usually takes from the same day to about two weeks, depending on the case.
From Amsterdam, for the whole of the UK
Everything can be done fully online. Prefer to meet in person? You are very welcome at our office in Amsterdam, by appointment.
Paucitas is an independent expert firm based in the Netherlands that, for clients across the UK, investigates investment fraud and crypto fraud, establishes the origin and legitimacy of crypto assets and prepares expert reports for legal proceedings and compliance.
Your own situation
If you are reading this, you probably have a question about your own situation. That is exactly what Paucitas does.
The first step is contact by phone. You can book that call by phone or through the contact form, so you do not have to wait. In the call we look together at what can factually be established in your case and what Paucitas can examine for you.