How an impersonation scam works and where the money goes

A payment leaves your account on a Friday afternoon. By Monday it has cleared three hops on-chain, passed through a centralised exchange, and the wallet on the other end shows zero. The victim's first instinct is that the money is simply gone. In our experience, that instinct is wrong more often than it is right – and the window to act is shorter than most people realise.

Impersonation scams work because they exploit a gap between trust and verification. The perpetrator does not break a technical system; they break a human one. Once funds move, the trail is not erased – it is recorded permanently on a public ledger. On-chain tracing can follow that trail to a cash-out point, and legal instruments including a worldwide freezing order, a proprietary injunction, or a disclosure order against a virtual-asset service provider (VASP) can interrupt the conversion of stolen assets into cash. The question is always timing: every hour the funds travel further, and the tools available to a practitioner narrow.

This analysis explains how impersonation scams are constructed, how the money moves after the fraud, and what recovery options exist at each stage of that movement. As of early 2026, the regulatory environment for VASPs is tightening across major jurisdictions, which is changing – cautiously but meaningfully – what can be done.

What an impersonation scam actually is – and why it succeeds

An impersonation scam is a social-engineering fraud in which the perpetrator presents a false identity that the victim has reason to trust. That identity might be a senior executive inside the victim's own organisation, a government regulator, a bank representative, a tech-support agent, or – increasingly – a romantic partner developed over months of scripted interaction. The common element is not the identity itself but the authority or relationship it conveys. The victim acts because the instruction or appeal appears to come from a legitimate and trusted source.

Why does it succeed at scale? Three structural reasons stand out. First, the perpetrator invests time. A well-constructed impersonation builds over days or weeks; by the time a payment instruction arrives, the victim has already developed confidence in the persona. Second, the instruction creates urgency. A "CEO fraud" wire request or a "your account is compromised" call invariably carries a deadline that inhibits verification. Third, the payment method requested is typically irreversible – a crypto transfer, a wire to a new beneficiary, or a gift-card purchase. Crypto is now the preferred collection mechanism in impersonation fraud because settlement is final in minutes and pseudonymous wallets are easy to create.

We regularly advise clients who assumed they were communicating with someone they had verified. The sophistication of AI-assisted voice and video synthesis means that even audio or video confirmation is no longer a reliable safeguard. The verification failure is often not negligence – it is the rational response to a well-designed deception.

The anatomy of the payment trail – from victim to cash-out

Once a victim transfers funds, the money follows a relatively predictable laundering pathway. Understanding that pathway is the foundation of any crypto asset recovery effort – because each stage corresponds to a different set of recovery options.

Stage one is collection. The victim sends to a wallet controlled by the perpetrator or a money mule. This wallet is often freshly created and has no prior history. The address is pseudonymous, not anonymous: every transaction to and from it is visible on the public blockchain. Blockchain-analytics tools can immediately begin clustering related addresses – identifying which other wallets have interacted with the collection address and building a map of the perpetrator's infrastructure.

Stage two is layering. The funds are split, mixed, or swapped. The perpetrator may use a series of intermediate wallets, a decentralised exchange, a cross-chain bridge, or a privacy-enhancing protocol. Each hop is an attempt to break the audit trail. None of them fully succeeds on a public blockchain: every transaction leaves a record, and wallet clustering and attribution techniques can often re-link fragmented transactions. The layering stage is where time matters most – the more hops, the more analytical work required, but on-chain tracing remains viable at each node.

Stage three is cash-out. The perpetrator converts the crypto into fiat currency, usually at a centralised exchange or through an over-the-counter desk. This is the critical choke point. A centralised exchange operating under know-your-customer obligations holds identity records for account holders. If the funds can be traced to an account at such an exchange before the conversion is complete – or if a disclosure order against the VASP can be obtained quickly enough – the cash-out can be interrupted. A disclosure order compels the exchange to identify the account holder; a freezing order or a stablecoin issuer freeze can then lock the balance.

Is cash-out always the end of the road? No. Some perpetrators withdraw to a bank account directly. The receiving bank becomes the next choke point, and a Bankers Trust order can compel disclosure of account information in appropriate circumstances. Others convert into physical assets. That trail is harder to follow, but not impossible – it becomes a question of coordinating corporate disclosure and UBO register searches in the relevant jurisdiction.

How do perpetrators avoid detection at each stage?

This is the question practitioners on the other side of the table are always working through. The perpetrator's toolkit has three layers, and understanding each one explains why early action produces better outcomes.

The first layer is structural separation. The impersonator who conducts the social engineering rarely controls the collection wallet directly. A network of money mules – recruited through their own scam operations – handles the first hop. This creates deniability and forensic distance. The mule's wallet appears between the victim and the perpetrator's infrastructure, and identifying the ultimate beneficial controller requires clustering analysis across multiple wallet generations.

The second layer is jurisdictional fragmentation. The mule may be in one country, the exchange in a second, the perpetrator in a third. This is deliberate. It forces a recovery effort to operate across multiple legal systems simultaneously, each with its own procedural requirements, timelines, and thresholds for urgent relief. A worldwide freezing order granted in one common-law forum can, in principle, reach assets held in another jurisdiction – but the practical enforcement depends on whether local courts will recognise that relief or whether separate applications are required.

The third layer is speed. A sophisticated impersonation fraud moves funds through five to eight wallets within hours of receipt. The perpetrator's operating assumption is that no recovery effort can mobilise legal process in that window. That assumption is not always correct – but it requires a practitioner who can make urgent applications on the same day that a client first contacts them.

What can actually be done – and what the options depend on

The honest answer to "can we recover this?" is: it depends on four variables. Where did the funds go? How fast did they move? Which forums have jurisdiction over the relevant choke points? And how quickly can the victim engage competent recovery practitioners?

Where a cash-out choke point can be identified – typically an exchange or a bank account – the toolkit is well-developed. A proprietary injunction or a worldwide freezing order can be sought, often without notice to the defendant, to prevent the balance being dissipated. A Norwich Pharmal order or a disclosure order against the VASP can compel identification of the account holder. If the funds are held in stablecoin, direct engagement with the stablecoin issuer under appropriate legal process can result in a token freeze, preventing conversion entirely. These instruments move quickly: urgent applications in receptive forums are measured in hours to days, not weeks.

Where the funds have already been cashed out and converted, the picture changes. The recovery effort becomes a judgment enforcement exercise: identifying the perpetrator, establishing their assets, and pursuing those assets under the applicable regime. That process is longer and more uncertain. This is why we have traced matters in both scenarios and consistently found that the difference between a day and a week at the outset is often the difference between a viable interim remedy and a contested enforcement.

Consider a matter in South-East Asia in late 2024, involving funds in the mid-six figures transferred under an executive impersonation. The victim contacted recovery practitioners within 36 hours of the transfer. On-chain tracing identified a collection wallet that had subsequently deposited a substantial portion of the funds at a centralised exchange. A disclosure order application was prepared within 48 hours. The exchange cooperated with that process, and the identified account holder's balance was the subject of a freezing application before the funds were fully withdrawn. Outcome was partial, not total – some funds had already moved on. But the early engagement materially narrowed the loss.

Contrast a matter in Western Europe in spring 2025, involving a romance-impersonation fraud over several months, with funds in the high six figures transferred in staged tranches. By the time the victim engaged a recovery practitioner, the funds had cleared at least twelve wallet hops and were distributed across multiple exchange accounts. On-chain tracing reconstructed the layering pathway, but the exchange accounts had all been liquidated. Recovery required identifying beneficial ownership of offshore entities through which fiat had been routed – a longer, more expensive process with narrower prospects. The cross-border dimension – involving three separate legal systems – meant that each step required coordination with local counsel in the relevant jurisdictions.

These two patterns capture the core strategic tension: speed at the interim stage vs. resilience at the enforcement stage. Neither guarantees recovery. Both illustrate why the first call matters.

Cross-border and on-chain: where jurisdiction becomes the hard problem

Impersonation fraud is almost always a cross-border problem. The perpetrator is rarely in the same jurisdiction as the victim. The collection wallet, the exchange, and the cash-out point are typically in different countries from each other. This is not accidental – it is engineered to exploit the gaps between legal systems.

The core difficulty is coordination. A practitioner seeking a freezing order in one forum needs to satisfy the threshold conditions of that forum's law, identify the defendant (or obtain disclosure first), and then either enforce the order in the jurisdiction where the assets sit or pursue parallel proceedings there. Each forum has its own procedural timeline. Each adds cost. Each creates an opportunity for the perpetrator to move funds ahead of the process.

How do practitioners address this? In our experience, the most effective approach is to identify the single forum that combines jurisdictional reach with procedural speed, and to lead there while building the parallel threads. A common-law forum with a developed freezing-order regime – and where the exchange or bank has a local nexus – is often the pivot. From that pivot, letters of request and mutual legal assistance channels can be used to extend reach into civil-law or less accessible jurisdictions. The New York Convention facilitates enforcement of arbitral awards where the matter has been resolved by arbitration, though most impersonation fraud recovery begins in court rather than before a tribunal.

On-chain, the jurisdictional problem looks different. A public blockchain does not sit in any jurisdiction. But the entities through which crypto converts to fiat – exchanges, VASPs, banks – do. That is where legal process attaches. The regulatory tightening of VASP licensing requirements across multiple jurisdictions in recent years has, paradoxically, made recovery easier: exchanges operating under licence have compliance obligations that make them more responsive to properly served legal process than they were five years ago. Our analysis of the regulatory environment as of early 2026 suggests that this trend is continuing, though the speed and depth of cooperation still varies considerably by jurisdiction.

For detailed analysis of how VASP regulation interacts with crypto recovery in a specific offshore context, see our examination of crypto recovery and VASP regulation in the Cayman Islands.

The recovery-scam problem – a specific risk for impersonation fraud victims

There is a particular irony in the landscape of impersonation fraud: victims are disproportionately targeted by secondary scams promising to recover their stolen funds. This is not a marginal risk. It is a documented, systematic pattern.

How does the secondary scam operate? The victim's details – email address, disclosed loss amount, contact preferences – are typically shared within criminal networks. Within days of a fraud, the victim may receive unsolicited contact from an operator claiming to be a "crypto recovery specialist" or a "blockchain forensics firm". The operator will often reference the victim's specific loss, creating a false impression of prior knowledge. They will typically ask for an upfront payment – framed as a "legal fee", a "processing deposit", or a "guarantee fund" – before any work is done. They deliver nothing.

What distinguishes a legitimate recovery practitioner from a recovery scam? Several markers. A legitimate firm will not guarantee recovery or promise a specific percentage return. It will not demand unsolicited upfront payment before completing due diligence on the matter. It will explain, honestly, the conditions on which recovery is viable and the instruments that would apply – without inventing case numbers, citing invented precedents, or naming fabricated regulators. We have traced matters where the victim lost a secondary sum to a recovery scam before engaging legitimate assistance, compounding both the loss and the delay.

The myth that "once crypto leaves your wallet it is untraceable" is the hook that recovery scammers use. They exploit the victim's resignation – persuading them that no legitimate route exists and that only their particular method (always accompanied by a fee) can help. The reality is the opposite: public blockchains are transparent, movement leaves a trail, and legitimate practitioners use that trail in coordination with properly constituted legal process. No upfront payment guarantee is needed to explain what that process involves.

The steps above map the typical pattern of an impersonation fraud and its aftermath. Your matter will turn on specific facts – where the funds went, how quickly, and which forums can reach the relevant choke points. A confidential case review tells you whether the options described here are realistically available to you. Contact info@axiomtracel.com to arrange one.

Contrasting views on traceability and the limits of on-chain analysis

It would be misleading to suggest that all impersonation fraud losses are traceable to a usable recovery point. There is a legitimate debate among practitioners about the realistic limits of on-chain tracing, and that debate deserves honest treatment.

The optimistic position holds that public blockchains are permanently transparent, that blockchain-analytics tools continue to advance, and that regulatory pressure on VASPs is closing the gaps that perpetrators have historically exploited. On this view, the question is not whether the funds can be traced but whether they can be traced quickly enough and whether legal process can be brought to bear before cash-out.

The more cautious position notes several genuine limitations. Privacy protocols can substantially degrade the traceability of funds that pass through them. Cross-chain bridges remain analytically difficult, particularly where they involve chains with lower transparency standards. Jurisdictions where VASPs operate with minimal regulatory oversight may be unresponsive to foreign legal process entirely. And where the perpetrator is located in a jurisdiction that does not cooperate with mutual legal assistance requests from the victim's forum, identification and enforcement against the perpetrator personally may be impractical regardless of how well the funds are traced.

The practical synthesis is this: on-chain tracing is a prerequisite, not a guarantee. It tells you what happened to the money. Whether you can then do something about it depends on where the money ended up and which legal systems govern that endpoint. A freezing order over digital assets, or a disclosure order against a VASP, is an effective instrument where the exchange operates in a cooperative jurisdiction and holds an identifiable balance. Neither instrument is effective against a balance that has already been liquidated through a non-custodial pathway in a non-cooperative jurisdiction.

This honest reckoning is what separates a real viability assessment from a speculative pitch. We do not take matters where the realistic analysis is that no enforceable choke point can be reached. For a preliminary read on whether your situation presents a viable choke point, use the asset tracing service overview or contact us directly.

What to do in the first 48 hours after discovering an impersonation fraud

Speed is the only variable that the victim can control after the fraud has occurred. Everything else – the perpetrator's location, the forum's procedural rules, the exchange's cooperation posture – is given. The timeline the victim sets in the first 48 hours determines which instruments remain available.

First: preserve every record of the interaction that preceded the payment. Message threads, emails, voice recordings, call logs, screenshots of profiles, any identifying information offered by the perpetrator. These are evidence. They deteriorate quickly as platforms purge data. Do not delete them, and do not alert the perpetrator that you have identified the fraud.

Second: record the transaction details precisely. Wallet addresses to which funds were sent, transaction hashes, timestamps, amounts. A recovery practitioner can begin on-chain tracing from a transaction hash within minutes. The sooner that information is in their hands, the sooner the mapping of the payment trail begins.

Third: do not attempt to contact the exchange or bank yourself before engaging a recovery practitioner. Ad hoc contact can alert the account holder and accelerate the cash-out. A properly coordinated approach – using legal process served through the exchange's compliance function – is both more effective and less likely to be counterproductive.

Fourth: assess the realistic picture. Not every impersonation fraud presents a recoverable position, and no practitioner can tell you the outcome before they have conducted a proper analysis. What a good practitioner can tell you quickly is whether a viable choke point exists and whether the cost of pursuing it is proportionate to the amount at stake. That assessment is the starting point, not a guarantee.

For broader context on the crypto asset recovery process across different fraud typologies, the crypto recovery insight series covers the principal scenarios we encounter in practice.

If funds have already moved and time is short, do not delay. Request a confidential case review at info@axiomtracel.com.

Frequently Asked Questions

Q: Can stolen crypto really be traced and frozen?

A: Yes, in many cases – but the answer depends on how quickly the victim acts and where the funds end up. Public blockchains are permanently transparent; every transaction is recorded and on-chain tracing can follow funds through multiple hops to a cash-out point. Where funds reach an exchange or a VASP with identifiable accounts, a disclosure order against the VASP can compel identification of the account holder, and a freezing order or a stablecoin issuer freeze can lock the balance before conversion. These instruments are most effective when engaged within hours to days of the transfer, before cash-out is complete.

Q: How quickly do I need to act after a crypto theft?

A: As quickly as possible – measured in hours, not days. Impersonation fraud perpetrators typically move funds through layering stages within hours of receipt. Each stage of layering makes the analysis more complex and narrows the window for interim relief. A worldwide freezing order or a proprietary injunction can be sought without notice to the defendant, and urgent applications in receptive forums are measured in hours to days. The longer the delay between the transfer and the engagement of a recovery practitioner, the higher the probability that funds have already been cashed out and the interim choke-point options are closed.

Q: How is a real recovery specialist different from a recovery scam?

A: A legitimate recovery specialist will not guarantee a specific outcome or a recovery percentage. They will not demand unsolicited upfront payments before completing an honest assessment of the matter's viability. They will explain, in plain terms, which legal instruments apply to your situation – such as a disclosure order against a virtual-asset service provider or a Norwich Pharmal order against a third party – and why. If an operator contacts you without your initiation, promises recovery for a fee payable upfront, and cannot explain the specific legal process they intend to use, that is a recovery scam. The best protection is to engage a specialist you have independently identified and verified, not one who has approached you.

Related Insight

• Crypto Asset Recovery – Insight Series: Analysis and guides covering the principal scenarios in digital asset tracing and recovery.
• Asset Tracing Service: How Axiom Trace conducts follow-the-money investigations across banking and on-chain layers.
• Crypto Recovery and VASP Regulation in the Cayman Islands: How offshore VASP licensing interacts with freezing and disclosure process.

About Axiom Trace

Axiom Trace is an independent boutique focused on cross-border and crypto asset recovery. We trace assets that have moved across borders or on-chain and coordinate their freezing and recovery – working with defrauded principals, insolvency practitioners, and the lawyers and funders who refer them. We work lawfully and within applicable sanctions regimes, alongside local counsel where proceedings must be filed. We have traced impersonation fraud proceeds across multiple jurisdictions and on-chain pathways, and we provide honest viability assessments before any engagement proceeds. We do not guarantee outcomes – recovery depends on the specific facts of each matter and the forums available to act on them. To discuss a matter, contact info@axiomtracel.com.

Disclaimer: This publication is for general information only and is not legal advice, nor a promise or prediction of recovery. No outcome is guaranteed. Asset recovery depends on the specific facts and on the law and procedure of each relevant jurisdiction, where local admitted counsel must act. Axiom Trace assumes no liability for actions taken or not taken based on this material. For advice on your situation, contact info@axiomtracel.com.