Fake crypto recovery sites: our warning list
Fake recovery services target people who have already lost money to a scam. Our Fraud Intelligence Unit tracks them and reports every one we find to the companies that host, register and advertise them. This page lists the sites we have evidence on, so you can check a name before you trust it.
Last checked
Talking to one of these sites? Stop paying and stop sharing documents. Forward what you have to hello@vanortonrecovery.com and we'll tell you what we know.
How to spot one
Every site on this list shows several of these signs:
- It contacted you first, by WhatsApp, Telegram, social media or email.
- It uses a famous law firm’s name, or a government agency’s, but its web address doesn’t match that firm or agency.
- Its address turns out to be a government building, another company’s office or a virtual mailbox.
- It moves you to WhatsApp or a private chat as soon as you make contact.
- It promises a guaranteed recovery, or asks for a “release fee”, “tax” or payment in crypto.
For the checks that tell a real firm apart, see how to choose a legitimate crypto recovery company.
Lookalike law firm and “anti-fraud alliance” sites
Active since December 2025, in English, Chinese and Japanese. What we found:
- Made-up names such as “Global Recovery Alliance” or “Fair Rights Legal Group”, shortened to look-alike web addresses.
- Addresses that belong to the FBI’s and the Justice Department’s headquarters in Washington, or to real law firms’ offices.
- Names of real attorneys at large U.S. law firms, presented as the site’s own “recovery consultants”.
- The name of the Global Anti-Scam Alliance, a real nonprofit that has warned about this misuse.
- Chat windows presented as “Susan from Kirkland & Ellis LLP”, “Latham & Watkins Law Firm” or “ic3.gov”, which then move the conversation to WhatsApp.
- The same website code and the same chat accounts across sites. When one site is taken down, a near-identical copy appears within weeks.
Still online on 8 November 2026
- art-bengoshi[.]com
- gafahk[.]com
- gafalaw[.]com
- globalrecoveryteam[.]com
- grightsguard[.]com
- ia-ro[.]com
- uaraid[.]com
Taken down, suspended or flagged
- frlg-help[.]com
- gafa-help[.]com
- gafa-safe[.]com
- gafaclaim[.]com
- gafahelp[.]com
- gasa-legal[.]com
- gasalegal[.]com
- gasalegi[.]com
- gasaone[.]com
- gf-ar[.]com
- gfa-legal[.]com
- gfrahelp[.]com
- gfralaw[.]com
- gl-fa[.]com
- glfacounsel[.]com
- glfarights[.]com
- globallossrecoveryteam[.]com
- gr-case[.]com
- gra-legal[.]com
- hkgafa[.]com
- intlawyerassn[.]com
- tholbz[.]com
- ua-ra[.]com
- uaralliance[.]com
- uf-ar[.]com
- uf-rn[.]com
- ufrnlaw[.]com
Recovery sites that claim a U.S. office
Active since at least November 2024. What we found:
- Ads for at least one of these sites ran under an advertiser identity verified in India, while the site listed a U.S. office that is a virtual address.
- Shared form wording and the same domain provider across the sites.
- Replacement sites registered within days of a takedown, including one whose address differs from the suspended original by a single letter.
Still online on 8 November 2026
- financialoptionsrecoveryllc[.]com
- financialsscamsrecovery[.]com
- fundsregain[.]com
Taken down, suspended or flagged
- directfundsrecovery[.]com
- financialfundschargeback[.]com
- financialscamsrecovery[.]com
- firstfundsrecovery[.]com
In 2025 we took down a related service, FinancialOptionsRecovery. Read how. It has since returned under a new address, listed above.
About this list
This list records what we observed on the dates shown: the names, addresses and contact details the sites used, who advertised them, and the technical traces they share. The law firms, agencies and organizations whose names or addresses appear on these sites are victims of impersonation, not part of it. If you believe a site is listed in error, email hello@vanortonrecovery.com and we'll review it.
Seen a site that belongs here?
Send the web address, and any messages or payment details you have, to hello@vanortonrecovery.com. Every report helps us get the next copy taken down faster.