An impersonation scam: can the funds be traced and frozen?

A payment leaves your account on a Friday. By the time you realise the "investment manager" was an impersonator, the funds have cleared two exchanges and you are staring at a wallet address you do not recognise. The question is not whether you have been defrauded. The question is whether anything can still be done.

Yes – stolen funds moved through an impersonation scam can, in many cases, be traced on-chain and frozen before they are cashed out. Public blockchains are transparent: every transaction is recorded and movement leaves a trail, even when the person behind the wallet is not immediately known. The window to act is measured in hours to days, not weeks, and the tools available – on-chain tracing, disclosure orders against virtual-asset service providers (VASPs), and proprietary injunctions – are real, court-tested instruments. Outcome is never guaranteed, but the trail rarely vanishes entirely.

This guide walks through how an impersonation scam works, what the tracing process looks like, which legal instruments apply, where cross-border complexity bites, and what you need to do in the next 48 hours.

How Impersonation Scams Move Money – and Why That Matters for Recovery

An impersonation scam works because the victim trusts the sender. The fraudster poses as a known party – a bank, a regulator, a colleague, a platform – and instructs a transfer that looks legitimate. The funds move before doubt sets in.

What matters for recovery is the movement pattern. In most impersonation scams we examine, the stolen funds travel a predictable route: fiat into a centralised exchange, conversion to crypto, an on-chain hop through one or more intermediary wallets, and then an attempt to cash out or convert to a privacy-preserving asset. Each hop is visible on a public blockchain. The fraudster's anonymity does not erase the footprint; it just means the footprint needs to be read by someone who knows how.

Speed matters precisely because the fraudster knows the same thing. Rapid conversion into a privacy coin, or movement across multiple chains in quick succession, is designed to narrow the window before legal process can reach an exchange. In our experience, the most important single variable is how quickly the victim reports the loss and engages a specialist. Hours spent waiting are hours during which cash-out becomes more feasible for the other side.

What Does On-Chain Tracing Actually Reveal?

On-chain tracing maps where the funds went after they left the victim's wallet – and identifies the point at which they hit a recoverable choke point.

Blockchain-analytics tools allow a specialist to follow the transaction hash from the sending address through each intermediate wallet. Wallet clustering and attribution techniques link addresses to known entities – often centralised exchanges or VASPs that have conducted their own know-your-customer checks. That linkage is the critical step: it converts an anonymous wallet address into an identified account holder at a regulated institution.

The trail can be interrupted. A fraudster who moves funds through a mixing service, bridges to a chain with limited analytics coverage, or converts to a privacy coin creates genuine friction. Does that end the matter? Not always. In our experience, a significant proportion of retail impersonation-scam proceeds still pass through at least one identifiable VASP on their way to cash. Recovery specialists look for that choke point – the place where the on-chain trail meets a regulated entity obliged to hold customer records.

What on-chain tracing cannot do, on its own, is identify the human behind the wallet. That requires a disclosure order against the relevant VASP or exchange. The two tools – technical tracing and legal disclosure – work in sequence, not in isolation.

For a broader view of what the on-chain recovery process involves, see our Crypto Asset Recovery resource hub.

Which Legal Instruments Apply – and When Can They Be Used?

The legal toolkit for crypto asset recovery is more developed than most victims expect. The key instruments work in sequence: first identify, then freeze, then disclose, then enforce.

Proprietary injunction. Where the victim can show that the stolen funds are their property – or that traceable proceeds of those funds are identifiable on-chain – a court can grant a proprietary injunction to freeze those assets. Courts in several common-law jurisdictions have extended this instrument to digital assets, including grants against "persons unknown" where the fraudster's identity has not yet been established. The application is typically made without notice, so the fraudster does not learn of it before the freeze bites.

Disclosure order against a VASP. A disclosure order – functionally similar to a Bankers Trust order directed at a bank – compels a VASP or centralised exchange to provide account information about the wallet holder. This converts on-chain tracing into an identified defendant. The order is served on the exchange directly; the fraudster need not be notified at that stage.

Worldwide freezing order. Once a defendant is identified, a worldwide freezing order can, in principle, reach assets held across multiple jurisdictions, subject to local safeguards and the willingness of foreign courts to recognise and give effect to the relief. Cross-border coordination is essential at this stage.

Norwich Pharmal order. Where the fraudster's identity is genuinely unknown, a Norwich Pharmal order compels a third party – the exchange, the receiving bank, or another intermediary – to disclose information that helps identify the wrongdoer. This is a disclosure-before-litigation tool; it does not require a claim against the third party itself.

Stablecoin issuer freeze. If stolen funds are held in a stablecoin, the issuing entity may, on appropriate legal process, freeze the specific token balance. This is one of the fastest routes to immobilisation – but it depends on the token in question and the responsiveness of the issuer.

None of these instruments guarantee recovery. Each depends on the specific facts, the forum chosen, and how quickly the application is made. A confidential case review is the right starting point before committing to any one route.

Cross-Border Complexity: What Happens When the Money Crosses Jurisdictions?

For a claimant chasing funds across two legal systems, the hard part is not the claim – it is timing the relief in the right forum before the asset moves again. Impersonation scam proceeds rarely stay in one jurisdiction.

The practical challenge is that freezing relief in one court does not automatically bind an exchange or institution in another country. A worldwide freezing order obtained in an English court, for example, creates obligations on parties within the court's personal jurisdiction, but enforcement against a VASP in a different regulatory zone requires local process. That means coordinating parallel applications – or sequencing them – across forums.

In our experience, the most common cross-border pattern in impersonation fraud looks like this: funds leave a bank account in one jurisdiction, convert at an exchange regulated in a second, hop on-chain through wallets attributable to intermediaries in a third, and attempt to cash out in a fourth. Each step potentially requires a different instrument, a different filing, and a different timeline. The window in which all of those can align is narrow.

Where local proceedings must be filed, we coordinate closely with local counsel in the relevant jurisdiction. We direct the tracing, structure the application strategy, and identify the sequencing that maximises the chance of freezing assets before they move again. The substantive legal filings are made by admitted local counsel.

What about enforcement of an award or judgment once funds are frozen? Recognition and enforcement of foreign judgments, and enforcement of arbitral awards under the New York Convention, are separate considerations – relevant once assets are located and secured, not at the urgent tracing stage.

The 48-Hour Action Plan: What to Do Right Now

The first 48 hours after discovering an impersonation scam are the most consequential. Here is what should happen, in sequence.

Step one: preserve everything. Screenshot every communication – messages, emails, platform interfaces, transaction confirmations. Do not delete anything. Do not try to contact the fraudster again; that alerts them that you have noticed the loss. Preserve the wallet addresses, transaction hashes, and any usernames or phone numbers used by the impersonator.

Step two: identify the on-chain transaction. If you have the wallet address to which funds were sent, that is the starting point for tracing. Note the timestamp and the amount. If you used a centralised exchange to send funds, note the exchange, the account used, and the time of the transaction.

Step three: contact your bank or exchange immediately. If any part of the payment was fiat-denominated and has not yet settled, a recall instruction to the sending bank may still be effective. Once funds are on-chain, the bank's direct role is limited – but it can still provide records essential for any legal proceedings. Request those records in writing, immediately.

Step four: engage a specialist, not a recovery scam. This is where the second-stage fraud risk is highest. Victims of impersonation scams are actively targeted by fraudsters claiming to offer "crypto recovery services" who demand upfront fees and return nothing. A legitimate specialist does not promise recovery, does not demand large upfront fees before any tracing has been done, and does not contact you unsolicited. We address this directly in the FAQ below.

Step five: request a tracing and viability assessment. Before any legal application, the question is whether the on-chain trail leads to a recoverable choke point. That assessment requires a specialist with access to blockchain-analytics tools and knowledge of VASP disclosure processes. It is the foundation for every decision that follows.

The steps above cover the typical pattern. Your matter turns on specific facts: where the money went, how fast it moved, and which forums can act. A confidential case review tells you whether recovery is worth pursuing and what it would realistically involve. Contact Axiom Trace at info@axiomtracel.com to request one.

What Makes a Crypto Recovery Viable – and What Does Not?

Not every impersonation scam leads to a viable recovery. Understanding the viability signals helps a victim or their lawyer make an informed decision before committing to the cost of legal proceedings.

Positive viability signals include: funds moved through at least one identifiable VASP; the transaction is recent (days to weeks rather than months); the amount involved justifies the cost of cross-border legal process; and the on-chain trail has not been obstructed by mixing or cross-chain bridging into a chain with poor analytics coverage.

Factors that reduce viability include: the fraudster converted immediately to a privacy coin with no subsequent VASP interaction; substantial time has passed and funds have moved through many hops; the amount involved is below the threshold at which litigation costs are proportionate; or the relevant VASP is in a jurisdiction with no meaningful legal process available.

A decision matrix in plain terms:

• Recent loss, VASP-identified choke point: on-chain tracing leading directly to a disclosure order and proprietary injunction against the identified account. Timeline measured in days to weeks. Priority action.
• Recent loss, choke point not yet confirmed: immediate tracing engagement to locate the choke point. Parallel evidence preservation. Legal application held ready pending tracing outcome.
• Older loss, complex chain: tracing still possible but timeline and cost assumptions change significantly. Viability depends heavily on whether any recoverable holding exists.
• Privacy-coin conversion, no VASP interaction: conventional tracing routes are severely limited. Ancillary remedies against identifiable parties in the transaction chain may still be available.

We use our asset-tracing service to map the on-chain route before advising on which legal instruments to deploy. The sequence is always: trace first, then apply.

A micro-case illustrates the difference timing makes. In a matter in the Asia-Pacific region in the autumn of 2024 involving funds in the mid-six figures, the victim contacted a specialist within 36 hours of the impersonation transfer. On-chain tracing located the funds at a VASP in a disclosure-friendly jurisdiction within hours. A disclosure order was served on the VASP before the fraudster's withdrawal request was processed. The account was frozen pending proceedings. Had the victim waited a further 72 hours, the withdrawal would likely have completed.

Common Misconceptions – and the Recovery Scam Threat

The most persistent myth in crypto fraud is that once digital assets leave a wallet, they are untraceable and nothing can be done. That is false. Public blockchains are transparent: every transaction is recorded, permanently, on the chain. The identity behind a wallet is not always immediately known, but the wallet's activity is visible. That visibility is the foundation of every successful on-chain tracing engagement we conduct.

The second misconception is that the legal tools available for conventional fraud do not apply to crypto. That is also false. Courts in multiple jurisdictions have granted proprietary injunctions, disclosure orders, and worldwide freezing orders over digital assets. The instruments exist. They are not exotic. They are applied routinely in the right forum with the right evidence.

The third misconception – and the most dangerous – is that the first message you receive offering to recover your stolen crypto is from a legitimate specialist. It is almost certainly not. Recovery scams are a well-documented second layer of fraud targeting impersonation-scam victims. They operate by identifying victims from public reports, forum posts, or data traded between fraud networks, then contacting them with promises of near-certain recovery in exchange for an upfront fee. No legitimate recovery specialist promises a specific outcome, demands a large upfront payment before any work is presented, or contacts a victim unsolicited.

What distinguishes a legitimate engagement is methodology: a real specialist starts with tracing, presents findings before asking for a significant commitment, and is transparent about what can and cannot be done at each stage.

For a more detailed account of what the first hours after a crypto fraud loss should involve, see our guide: A fake investment platform: the first 24 hours toward recovery.

Related Topics

• Crypto Asset Recovery: full resource hub covering on-chain tracing and VASP process
• Asset Tracing Service: how we map on-chain movement to recoverable choke points
• Fake investment platform fraud: the first 24 hours toward recovery

Frequently Asked Questions

Q: Can stolen crypto really be traced and frozen?

A: Yes – in many cases, and more often than victims expect. Public blockchains record every transaction permanently. Blockchain-analytics tools can follow the on-chain trail to a virtual-asset service provider (VASP) holding the stolen funds. Once identified, a disclosure order can confirm the account holder's identity, and a proprietary injunction or freezing order can immobilise the asset. Outcome depends on how quickly the victim acts, the route the funds took, and the jurisdiction of the relevant VASP. Recovery is never guaranteed, but the trail rarely disappears entirely.

Q: How quickly do I need to act after a crypto theft?

A: Urgently. The window between a fraudster receiving stolen funds and successfully cashing them out can be hours to days. Each passing hour allows further on-chain movement, potential conversion to a privacy coin, or withdrawal from an exchange before legal process reaches it. Immediate steps – preserving transaction records, contacting the sending bank or exchange, and engaging a specialist – materially improve the chances that a choke point can be reached before funds disappear. Treating this as a slow-moving matter is one of the most common errors victims make.

Q: How is a real recovery specialist different from a recovery scam?

A: A legitimate specialist begins with tracing and presents findings before requesting a significant financial commitment. They do not promise a specific outcome, do not demand large upfront fees before any work is done, and do not contact victims unsolicited. Recovery scams – a documented second layer of fraud targeting impersonation-scam victims – do the opposite: they promise near-certain recovery, ask for fees immediately, and often identify victims from public complaint forums or data shared between fraud networks. If someone has approached you offering to recover your stolen crypto and is asking for money first, treat that approach with extreme caution.

About Axiom Trace

Axiom Trace is an independent boutique focused on cross-border and crypto asset recovery. We trace assets that have moved across borders or on-chain and coordinate their freezing and recovery – working with defrauded principals, insolvency practitioners, and the lawyers and funders who refer them. We work lawfully and within applicable sanctions regimes, alongside local counsel where proceedings must be filed. In our experience, the difference between a recoverable matter and a closed file is almost always speed and specialist engagement in the first 48 hours. We have traced impersonation-scam proceeds across multiple exchange layers and multiple jurisdictions, and we know where the choke points are. To discuss a matter in confidence, contact info@axiomtracel.com.

Disclaimer: This publication is for general information only and is not legal advice, nor a promise or prediction of recovery. No outcome is guaranteed. Asset recovery depends on the specific facts and on the law and procedure of each relevant jurisdiction, where local admitted counsel must act. Axiom Trace assumes no liability for actions taken or not taken based on this material. For advice on your situation, contact info@axiomtracel.com.