📝 Scammed out of USDT? What to do in the first 24 hours

If you sent USDT to a scammer, or a transfer left your wallet without your approval, stop any further payment now. Do not pay an “unfreeze” or “recovery” fee. Do not give a helper your one-time code or wallet recovery phrase. Protect the assets and accounts you still control, preserve the transaction record, and report through official channels. Acting promptly helps preserve evidence and gives relevant providers a chance to review what they can, but it does not create a guaranteed recovery window.

The sender generally cannot reverse a confirmed USDT transfer on-chain. A platform or competent authority may be able to act in particular circumstances, depending on where the assets are, the evidence, its policies and the relevant jurisdiction. The US Internet Crime Complaint Center (IC3) explains why transaction hashes and wallet addresses matter, and warns about recovery services that demand an advance fee.

In the first minutes, identify the incident

Choose the description that fits, because it determines your first contact:

If the evidence instead points to a wrong network or an uncredited deposit without signs of fraud, use the wrong-network USDT guide. If the incident started with a fake support page or message, see the fake iCashy support guide.

Protect what remains before pursuing the missing funds

If you shared a password or one-time code, change the password from the official site on a device you trust. Start with the email account that receives password-reset messages. Review signed-in sessions, connected devices and recovery methods wherever those controls exist, and tell the provider about the unauthorized access. Do not use the link the scammer sent to reach security settings. If you installed an app or browser extension they supplied, stop using it and check the device before entering fresh credentials.

If you exposed a wallet recovery phrase or private key, assume the wallet is unsafe. MetaMask's compromise guidance describes damage limitation: create a new wallet with a new phrase in a trusted environment, move any remaining assets that can safely be moved, and stop using the old wallet. An automated sweeper may also take the native token you add to pay transaction fees; do not deposit more money merely to attempt a rescue. Follow your own wallet provider's official instructions, and never share either the old or new phrase with a “recovery expert” in a direct message.

If you did not reveal the phrase but approved a connection or spending permission, inspect it using your wallet provider's official guidance. Revoking a malicious contract approval may limit further withdrawals, but it cannot undo a transfer that already occurred. If you do not know which kind of compromise occurred, preserve the details and ask official support before signing another transaction requested by a stranger.

Preserve evidence that can be checked

Write a short timeline: when contact began, what was promised, when you sent funds or discovered the transfer, and when you reported it. Keep original copies of chats, receipts, emails and order pages, plus:

1. The TXID or hash of each transfer, copied from the sending provider's record, and the actual network.
2. The full sending and destination addresses, asset, amount, date, time and time zone.
3. The P2P order reference or support case number, if the incident occurred on a platform.
4. The accounts, domains and suspicious links involved, kept as non-clickable text or screenshots showing their context.
5. What you disclosed: only a payment, or also a password, code, private key or recovery phrase. Never include the secret itself in the report.

Open the TXID on an explorer for the actual network. Save the transaction link, status and displayed addresses. This can document an on-chain path, but it does not identify the person who controls an address by itself and does not guarantee a freeze. Preserve unedited originals. Make redacted copies for providers if needed, hiding codes, secrets and unrelated documents. IC3's victim guidance lists useful transaction and communication details and says to report even if some information is missing.

Report to the party that can review your case

The platform you used or where the scam happened: Open help from inside its app, or type its official domain yourself. Provide a concise summary, TXID, addresses and times. Ask what action is available for the account, order or recipient, and retain the case reference if one is issued. If this happened within a Binance P2P order, use the Appeal action from that order, following Binance's official instructions. Available actions depend on the order status, and Binance's dispute guidance does not guarantee a refund.

The competent authority where you are: Submit a report to the cybercrime unit, police or other responsible authority through a verified official channel in your jurisdiction. Include the timeline and transaction data, and keep the report reference. For incidents within its scope, IC3 provides an official US cryptocurrency-crime complaint route. Check an authority's jurisdiction and website before sharing identity documents. Do not rely on a phone number or account copied from a social post.

Where the asset is USDT: Tether's published recovery guidance separates mistaken transfers from theft, hacks, scams and law-enforcement requests. It directs the latter issues to its information-requests team. Tether's terms describe circumstances in which it may take freezing measures at its discretion and under applicable law. There is no published “72-hour window” that guarantees a freeze, and iCashy cannot instruct Tether to freeze an address. If the competent authority directs you to Tether, use Tether's official channels; do not send information or funds to an email or account copied from an old article or private message.

If funds appear to have passed through another exchange, include that evidence in an official report to the exchange when there is a sound basis to do so. Do not assume that a later address on an explorer belongs to the scammer or to a particular exchange solely because it appears in the transaction path; attributing addresses requires proper investigation. If the transaction involved an iCashy account, use the iCashy support center to document the part of the incident within iCashy, while also reporting to the wallet provider, platform or competent authority as appropriate.

After reporting, track the case and watch for a second scam

Keep each report number, current status and any next step communicated through the official channel. Add new evidence to the same case where possible. If an “investigator” or “recovery agency” asks for an advance fee, wallet phrase, screen sharing, or a USDT transfer to activate recovery, stop and preserve that message as further evidence. The US Federal Trade Commission (FTC) warns that scammers target previous victims with fake recovery services.

Do not publish your identity documents or full chat history in public groups. An address in the transaction path may be an intermediary or a service address shared by others; leave attribution to the investigating authority. Tell someone you trust if you need a second person to assess follow-up requests or protect household money. Avoid trying to “win back” the loss through new transfers or bets made under pressure.

FAQ

Can USDT be recovered after a scam?

An authority or platform may investigate, freeze or review funds in some cases. A confirmed on-chain transfer is not automatically reversible, however, and no general success rate or deadline applies. Protect remaining assets and submit the transaction data promptly through reliable channels.

Can Tether freeze a scammer's wallet within 72 hours?

Tether's terms and public announcements describe freezes in certain circumstances, especially in cooperation with authorities. Its published guidance does not promise to freeze every address on an individual's request within 72 hours. Report to the competent authority and use Tether's official channels without assuming an outcome or timeline.

What if I gave the scammer my wallet recovery phrase?

Treat the wallet as compromised. Create a new wallet with a new phrase in a trusted environment and move any assets you can safely rescue, following your wallet provider's instructions. If an automated sweeper is active, adding a fee token to the old wallet can create another loss. Never share the phrase with support.

Is the TXID enough to report a USDT scam?

It is important, but not the whole record. Include the network, addresses, amount, time, platform record, conversation and link that led to the payment. If you do not have a TXID, report what you have and ask the sending provider for the transaction reference and status.

Where do I appeal if the scam happened in a P2P order?

Open that order in the platform's official app or site and use the appeal or help action available for its status. Submit payment evidence and the in-platform conversation, and save the appeal reference. Do not follow a counterparty's message claiming that support moved to Telegram.

Should I post my identity document or password in a public report?

No. Provide only the information an official provider actually requests through its secure process. Remove passwords, one-time codes and wallet phrases from every screenshot. Do not publish identity documents or a complete financial history in public groups.

Someone offers to recover my USDT for a fee. Should I try it?

Do not pay someone who contacts you after a report or give them access to your account or device. Check for any procedure and disclosed fee only through the official provider handling the case. Preserve the offer and add it to your fraud report if it involves impersonation or a demand for money.