Most crypto scam victims do not file reports. Shame and low recovery odds push the case into a drawer. That is the wrong tradeoff. Filing does not always recover the funds, but it opens later paths: insurance claims, tax loss deductions, exchange compliance freezes, and FBI Operation Level Up outreach. Without a case number, those paths stay closed.
What you'll learn
Why reporting matters even when funds seem unrecoverable
Where to file in the United States (5 agencies)
Where to file in other countries
What paperwork you need before you file
How to file with the FBI IC3 in particular
What Operation Level Up is and what enforcement is active in 2026
How tax loss treatment works for crypto theft
Why report a crypto scam if the funds are gone?
Reporting opens later paths even when direct recovery is unlikely. Case numbers open insurance claims, tax loss deductions, exchange compliance freezes, and FBI Operation Level Up outreach. From Blofin's compliance work, the case numbers our users file create real recovery paths when the attacker eventually touches a regulated venue.
The argument against reporting is usually about effort or shame. Filing takes 2-3 hours total across the agencies. The shame is real but the agencies handle thousands of these cases yearly. They do not judge. The bigger argument for reporting is that the case becomes data. Each report contributes to enforcement patterns that produce takedowns like the April 2026 Dubai Police operation that detained 275 suspects. The single filing is small. The pool matters.
What reporting does vs what it does not
Reporting opens | Reporting does not guarantee |
|---|---|
Police case number for insurance claim | Direct recovery of stolen funds |
Tax loss deduction (country-dependent) | Active review of your specific case |
Exchange compliance freeze if attacker cashes out at a regulated venue | Quick response from agency |
FBI Operation Level Up victim outreach (US) | Conviction of the attacker |
Pooled enforcement data for takedowns | Personal communication from investigators |
For the broader recovery decision tree, see lost crypto what to do.
Where do you file in the United States?
FBI IC3 (ic3.gov) for the federal record. FTC ReportFraud (reportfraud.ftc.gov) for consumer protection tracking. SEC tips portal for investment fraud. Local police for the case number. IRS Form 4684 for theft loss tax deduction. File with all five; each serves a different role. Filing typically takes 2-3 hours total across the agencies.
Each agency has a specific role. FBI IC3 is the federal entry point for cybercrime (source: FBI IC3 Cryptocurrency landing page). They pool reports, identify patterns, forward cases to local FBI offices and partner agencies. FTC tracks misleading business practices and shares with state attorneys general via Consumer Sentinel (source: FTC ReportFraud portal). SEC handles investment fraud in particular (source: SEC Tips, Complaints, and Referrals portal), relevant if the scam pitched fake yield, ICO, or "investment opportunity." Local police issue the case number that opens insurance and tax claims. IRS Form 4684 is the tax loss filing path (source: IRS Instructions for Form 4684).
US reporting matrix
Agency | Where | Role | Typical filing time |
|---|---|---|---|
FBI IC3 | ic3.gov | Federal cybercrime entry point | ~30-45 min |
FTC | reportfraud.ftc.gov | Consumer protection tracking | ~15-20 min |
SEC | sec.gov/tcr | Investment fraud | ~20-30 min |
Local police | Local non-emergency line or station | Case number for later filings | ~60-90 min |
IRS | Form 4684 with annual return | Tax loss deduction | At tax time |
Filing times are operator estimates from supporting Blofin users through this process; agencies do not publish per-form duration.
Where do you file in other countries?
UK uses Report Fraud (replaced Action Fraud December 2025). Australia uses ACSC plus Scamwatch (ACCC). Canada uses the Canadian Anti-Fraud Centre (CAFC). EU members use national cybercrime agencies. Singapore uses SingCERT plus Scam Shield. Hong Kong uses the Anti-Deception Coordination Centre (ADCC). The pattern is the same: federal cybercrime venue plus consumer protection plus tax authority.
Global reporting venues
Country | Primary cybercrime venue | Consumer protection | Tax authority |
|---|---|---|---|
UK | Report Fraud (UK; formerly Action Fraud) | Citizens Advice / Trading Standards | HMRC |
Australia | ACSC (cyber.gov.au) | Scamwatch (scamwatch.gov.au) | ATO |
Canada | CAFC (antifraudcentre.ca) | CAFC + provincial consumer agencies | CRA |
EU | National cybercrime agency (varies) | National consumer protection | National tax authority |
Singapore | SingCERT + Scam Shield | ScamShield | IRAS |
Hong Kong | ADCC | Consumer Council | IRD |
Japan | National Police Agency cybercrime | Consumer Affairs Agency | NTA |
South Korea | KISA + cyber police | Korea Consumer Agency | NTS |
The "file with all relevant" rule applies in every country. The cybercrime venue is the priority for the case record. The consumer protection venue tracks patterns. The tax authority filing covers the loss deduction. UK readers note: Action Fraud was retired in December 2025 and replaced by Report Fraud at reportfraud.police.uk (source: GOV.UK: Report Fraud new service from City of London Police).
What paperwork do you need before you file?
Transaction hashes (txids), wallet addresses (yours and the scammer's), timestamps, screenshots of communications, screenshots of any fake platform showing balance, blockchain explorer links, and a full timeline. Gather everything before filing. Most reports require 60-90 minutes to fill in correctly. Incomplete reports get deprioritized.
The transaction hash is the most important piece of paperwork. It is the unique blockchain identifier that lets investigators trace funds. Get it from your wallet's transaction history or from a blockchain explorer (Etherscan for Ethereum, BscScan for BNB Smart Chain, Solscan for Solana, mempool.space for Bitcoin) (source: Etherscan block explorer). Copy the full hash. Confirm it matches the transaction in your wallet by checking the timestamp and amount.
Paperwork checklist
Item | Where to get it | Why it matters |
|---|---|---|
Transaction hashes for every relevant tx | Wallet history or block explorer | Lets investigators trace funds on chain |
Wallet addresses (yours + scammer's) | Wallet UI or block explorer | Identifies the attacker's address for tagging and tracing |
Timestamps of each transaction | Block explorer (UTC time) | Builds the timeline |
Amounts and tokens | Block explorer | Quantifies the loss |
Screenshots of communications | Email, Telegram, Discord, SMS | Shows the social engineering pattern |
Screenshots of fake platform | If you accessed a fraudulent investment site | Documents the deception |
Full timeline | Your own notes | Narrative for the complaint |
Police report case number | After local police filing | Cross-reference for downstream filings |
For scenario-specific recovery procedures, see compromised wallet emergency steps.
How do you file with FBI IC3 in particular?
Go to ic3.gov. Click "File a Complaint." Walk the form. Provide a narrative description of the scam. List all transaction details. Submit. You will receive a case ID. Save it for cross-references (police report, exchange ticket, tax filing). IC3 passes relevant cases to local FBI offices and partner agencies; no direct response is typical.
Step-by-step IC3 filing
Step | Action |
|---|---|
1 | Open ic3.gov in your browser (typed URL directly) |
2 | Click "File a Complaint" |
3 | Indicate filer type (yourself, business, etc.) |
4 | Provide your contact information accurately |
5 | Provide scammer information you have (email, social handle, wallet address) |
6 | Classify the crime (Investment Fraud, Confidence Fraud/Romance, etc.) |
7 | Write a narrative description of the scam |
8 | List every transaction with hash, address, amount, timestamp |
9 | Upload supporting documents (communications, screenshots) |
10 | Submit. Save the case ID right away |
The narrative description matters more than most users realize. Investigators triage by the clarity of the narrative. State what happened in time order. Name the platforms, dApps, and exchanges involved. Mention any other victims you know about. Be specific about how the scam contacted you (DM, email, dating app, online ad). The narrative is what makes the case useful to investigators.
The category affects routing. Pig butchering should be filed under "Confidence Fraud/Romance" or "Investment Fraud" depending on the dominant pattern. Wallet drainer attacks (see crypto phishing attacks) go under "Identity Theft" or "Computer Intrusion" depending on the specifics. Authority impersonation goes under "Government Impersonation." Recruitment scams go under "Employment/Business Opportunity." Get the category right; cases get triaged by category.
What is Operation Level Up and what enforcement is active in 2026?
Operation Level Up is the FBI's 2024-2026 victim outreach for pig butchering. The FBI traces on-chain to identify victims who have not reported, contacts them, and connects them to recovery resources. The April 2026 joint operation arrested 276 suspects across Dubai Police (275) and Royal Thai Police. The 2026 enforcement environment is more active than any prior period.
The FBI's Operation Level Up in particular reaches out to pig butchering victims identified through on-chain tracing (source: FBI Operation Level Up program page). The program contacts victims, walks them through reporting, and connects them to recovery resources. Users who file IC3 reports early get added to this outreach pool. Users who do not file get nothing.
The 2026 enforcement landscape includes the April 29 Dubai Police raid (275 arrests across 9 compounds, with one parallel Royal Thai Police arrest bringing the DOJ-announced total to 276) (source: DOJ press release: Coordinated Takedown of Scam Centers Leads to at Least 276 Arrests), DOJ takedowns in Q1 2026 (two big cases announced), and OFAC sanctions against Cambodian and Myanmar scam-center operators (source: Chainalysis: U.S. Crackdown on Southeast Asian Crypto Scam Centers April 2026). The pace is sustained, not occasional. The enforcement does not directly recover individual losses but it does compress operator margins, which slowly cuts the volume of new scams.
2026 enforcement context
Action | When | Scope |
|---|---|---|
Operation Level Up | Active 2024-2026 | FBI on-chain victim outreach, pig butchering focus |
DOJ-coordinated April 2026 joint takedown | April 29, 2026 | 276 arrests total (Dubai Police 275 across 9 compounds, plus Royal Thai Police) |
OFAC Cambodian sanctions | September 2024 expanded 2026 | Designated Cambodia compound operators |
OFAC Myanmar sanctions | 2025-2026 | Designated Myanmar compound operators |
UK + EU sanctions on regional entities | 2023-2026 | Human trafficking + crypto scam operations |
For the broader social engineering context that frames why enforcement focuses on pig butchering, see social engineering in crypto.
What about tax loss treatment?
In the US, theft loss may be deductible on IRS Form 4684, with limits. The 2017 Tax Cuts and Jobs Act restricted personal theft loss deductions to federally declared disasters, but profit-motive losses (investment scams) may still qualify. Consult a crypto-aware tax expert. Other countries vary. Document with the police report and IC3 case number first.
The technical question that matters in the US is whether the loss qualifies as a "transaction entered into for profit" under IRC §165(c)(2) (source: IRS Chief Counsel Advice 202511015 on theft loss deductions for scam victims). Pig butchering and investment scams often qualify because the user was engaged in a profit-motive activity (investing). Pure consumer theft (e.g., someone stealing your phone with crypto on it) may not qualify. The distinction is fact-specific and a crypto-aware tax preparer should weigh in.
For non-US countries, the rules vary widely. The UK allows capital loss claims under specific HMRC guidance. Australia allows loss claims via ATO for investment-context scams. Canada similarly. Singapore generally does not allow personal theft loss deductions but business-context losses may qualify. In every case, the police report and federal cybercrime case number are the paperwork foundation.
US Form 4684 quick framework
Scenario | Likely tax treatment |
|---|---|
Pig butchering / investment scam (profit motive) | May qualify as theft loss under TCJA exceptions; consult expert |
Wallet drainer attack on holding | Treatment varies; depends on profit-motive category |
SIM swap leading to exchange drain (see SIM swap attacks) | Treatment varies; paperwork essential |
Hardware wallet seed exposure leading to drain | Treatment varies; depends on circumstances |
Pure consumer theft (phone stolen with crypto) | Likely not deductible under TCJA |
This guide cannot replace tax advice. The takeaway is: file the loss properly with the IRS or your country's tax authority, document with case numbers, and consult a crypto-aware tax expert if the loss is material. The tax recovery, while incomplete, is the most accessible form of partial recovery for most victims.
Frequently asked questions
Do I have to file with the police?
For losses above a few thousand dollars, yes. The police case number is the paperwork foundation for everything else: insurance, tax loss, exchange escalation. Some agencies (FBI IC3) accept filings without a police report but later paths require it. File with local police even if you expect no active review.
Will I get a response from the FBI?
Usually no direct response. IC3 pools and triages. Cases that match active reviews or that meet thresholds (large dollar amount, multi-victim pattern, identifiable suspects) get passed to local FBI offices. Most single filings do not produce direct contact. Operation Level Up is the exception, with proactive outreach to identified pig butchering victims.
Can I file anonymously?
Some agencies allow anonymous tips (SEC, FTC). FBI IC3 requires identification but does not publish your information. Local police filings are not anonymous; they are public record. For most victims, identified filing produces better downstream outcomes than anonymous tips. Anonymous tips can still be valuable for the pool data.
What if the loss is small?
Still file IC3 (free, online, 30 minutes). Skip local police for losses under $500 in many countries, since local police rarely investigate small crypto losses. The IC3 record matters for pool enforcement even if your individual case is small. Small losses also sometimes get grouped into larger cases through pattern matching.
What is SEAL 911 vs FBI IC3?
SEAL 911 is a volunteer community security incident response service that helps with active emergency response (revoke approvals, move funds, immediate triage). FBI IC3 is the federal government's record-keeping for cybercrime. The two serve different roles. Use SEAL 911 for emergency response in the first hour. File with IC3 for the formal record within 24-72 hours.
Can I sue the scammer?
Sometimes. Identified scammers with US assets can be sued in civil court. Class actions against larger rug-pull operators have produced some recoveries. Anonymous scammers are usually un-suable. Lawyers specializing in crypto recovery exist; rates start in the thousands of dollars for case evaluation. Most single cases do not justify the legal cost. File the criminal complaints first; the civil path can follow.
What about blockchain forensics firms?
Chainalysis Reactor, TRM Labs Forensics, Elliptic, and CipherTrace (now part of Mastercard) are the major firms (source: Chainalysis Reactor product page). They trace funds across chains and through mixers. They typically work with law enforcement and major exchanges. Some offer victim services directly. Rates start in the low thousands. Worth engaging for losses above $50K with a fresh on-chain trail. For smaller losses or older incidents, the IC3 + police report path is usually the more accessible option.
Researched and written by the Blofin Academy editorial team with AI-assisted drafting. Primary sources include FBI IC3 reporting guidelines, FBI Operation Level Up program paperwork, DOJ April 2026 joint takedown announcement, FTC ReportFraud paperwork, SEC tips portal, and equivalent global agency websites. All facts independently checked against cited sources current as of May 2026.
This article is educational and does not constitute financial, legal, or tax advice. Tax treatment of crypto theft losses varies by country and case specifics; consult a crypto-aware tax expert for big losses. Reporting outcomes vary widely; the article describes the reporting system, not guaranteed recovery. Blofin's rules team cooperates with law enforcement on cases involving funds that reach Blofin addresses; users should still file directly with the agencies described.