A “police officer” says your crypto must be moved for safekeeping: real investigations never ask you to move it

This entry covers one moment: the first contact. Someone says they are police, or from a prosecutor’s office, and that your account or wallet is tied to fraud or money laundering. If you have already lost money and a “police officer” now calls to say the funds were recovered and only a release fee stands in the way, that is a later stage, covered in the recovery scam entry.

Badges, papers and case numbers prove nothing

The Australian Cyber Security Centre published an advisory on exactly this: scammers impersonating police to go after people’s crypto and seed phrases. One detail in it is worth reading twice: “Cybercriminals have then contacted their victims and quoted an official report reference number to ultimately trick the victims into transferring their cryptocurrency into the criminals’ account.”

So a real reference number is not proof of a real officer. Neither is the number on your screen: the same advisory notes that “In some cases, criminals have also used techniques such as ‘spoofing’ (impersonating) legitimate phone numbers.”

Photos of warrant cards and official-looking letters fall into the same bin. Anything they can show you, they can prepare in advance.

That leaves two things worth judging: who started the conversation, and what they are now asking you to do.

They called you: hang up and dial back yourself

The easiest point to get out is before any request has been made — when all they have said is that you are “involved”.

The ACSC’s advice is plain: “hang up and call the organisation back on the official number listed on their website.” The important word is website. Not the number they read out, and not the extension they offer to transfer you to.

Our rule is shorter than that. The moment someone official-sounding uses the word “safekeeping” about your money, end the call. You don’t need the next sentence to know where it goes.

“Move it to a safe wallet”

This is the line the whole script is built around. The name changes — safe wallet, secure account, cold storage — and the request underneath does not: you withdraw your coins and send them to an address they give you.

It helps to know how a real freeze works at an exchange. The exchange’s support page on reporting stolen funds says: “Binance is unable to unilaterally freeze any user’s assets without an appropriate official freezing order from law enforcement or a court of competent jurisdiction.” When funds need reporting, it asks you to “please ask law enforcement officials to contact Binance via the following methods”, and states that “Binance will liaise directly with law enforcement”.

Read those together. An order goes from the authorities to the exchange, and the exchange freezes the account. At no point in that description does the account holder move anything. That is one exchange describing its own process — other platforms publish their own — but it is already enough to see that “move it to our wallet first” does not fit.

The US Federal Trade Commission describes the same pitch from the victim’s side: they say “your accounts or benefits are frozen as part of an investigation”, and tell you to protect your money by buying crypto and sending it “to a wallet address they give you — for ‘safe keeping.’”

“Go and buy crypto” — the ATM version

If you hold no crypto, they will have you buy some. The FTC page describes how physical this can get: “Some scammers even stay on the phone with you as they direct you to a cryptocurrency ATM and give step-by-step instruction on how to insert money and convert it to cryptocurrency.” The last step is a QR code they supply, “which directs the payment right into their digital wallet”.

The hard part is the few minutes standing at the machine. The call is still open, they are still talking, and there is no gap in which to think. Hang up first, then walk away from the machine, and do both before the next note goes in.

The FTC does not leave room for an exception here: “No legitimate business is going to demand you send cryptocurrency in advance – not to buy something, and not to protect your money. That’s always a scam.”

“Read me your seed phrase”

Some versions skip the transfer and ask to “check” things instead: read out the recovery phrase, or log in while they watch.

The ACSC advisory lists what the Australian Federal Police and legitimate law enforcement officials will never do. Two of the items line up with this script exactly: “Ask you to transfer money or cryptocurrency to any accounts” and “Ask to access your cryptocurrency accounts, wallets, bank accounts or cryptocurrency wallet seed phrases.”

Once a seed phrase has been read out, treat that wallet as no longer yours. Whoever holds the words can restore the wallet on any device, without your phone or your password. What to do next is in fake wallets and seed-phrase scams. If what they want is for you to install an app so they can “look at the account”, that is a different route, covered in the remote access entry.

The second caller, from “the exchange”

The ACSC advisory spells out the relay: “The scammer then advised that another contact would come from a representative of the cryptocurrency platform, who would provide the same reference number to verify legitimacy.” Then: “This second caller then tried to get the target to transfer money from their platform wallet to a ‘Cold Storage’ account.”

Two voices, one number. It sounds like two organisations confirming each other, and it is one team with two phones.

Set that against the exchange page quoted above, which says the exchange “will not be able to share any of this information with you as they are confidential”, customer service included. A platform “representative” who calls you unprompted, knows the case, and wants your coins moved to cold storage does not match that description.

If the coins have already gone

Once the coins have reached their address, move on to what to do first after a crypto scam, which puts reporting, notifying the exchange and saving evidence in order.

Keep everything: the chat history, the “documents” they sent, the address you sent to and the time. If they told you to delete something, keep that above all.

And expect a second approach. Some time later, someone may call claiming to be police with good news — the money was traced, a fee releases it. That is the second scam, taken apart in the recovery scam entry.

What comes before and after

• A close relative of this one: the caller claims to be exchange support rather than police, and your account needs “unfreezing”. See how to spot fake support.
• They insist they work for the exchange: don’t argue it on the phone, check it. The method is in how to verify an official account.
• After the loss: the first steps, then the recovery scam that tends to follow.

FAQ

They knew my name and details. Could it still be fake?

Yes. In the cases the Australian Cyber Security Centre describes, the callers quoted an official report reference number. Knowing things about you shows that information got out somewhere; it does not show the caller has any authority. Go back to what they are asking you to do.

They said the case is confidential and I must stay on the line. What now?

Hang up. The same advisory lists threatening you or pressuring you to stay on the line among the things legitimate law enforcement will never do. Being told not to talk to anyone is how they keep you deciding alone.

If police really needed my crypto frozen, how would I be told?

The official material we worked from does not say how police would notify you, so we will not guess. What it does cover is the exchange side: a freeze needs an official order, law enforcement contacts the exchange directly, and the exchange will not share the details with you. If you want to check, look up the agency’s number on its own website and call it yourself.