Treat a demand to buy an AML certificate or send a matching mirror payment to release crypto as a reason to stop and verify the process independently. The AML label does not authenticate the requester or show that paying will resolve the case. Preserve the original transaction and ask the genuine service which documented requirement applies before authorizing any additional transfer.
Write down the claim before debating the fee
Save the exact message, sender, claimed organization, payment destination, amount and promised result. Does the requester say a document is missing, a blockchain fee is unpaid, an account is restricted or an earlier transfer must be duplicated? Those are different claims. Combining them under one urgent AML warning makes it harder to check any of them.
A certificate can mean several things, including a training qualification or a private risk-analysis report. Neither description automatically establishes authority to release funds held by another service. Ask who issues the document, who requires it and where the receiving party says it will accept it. A polished PDF and a price do not answer those questions.
The FBI's recovery-scheme warning describes businesses charging upfront fees, supplying inadequate reports and asking for more. That historical warning concerns a pattern of conduct, not a finding that every paid professional service is fraudulent. The relevant check is the requester's identity, actual capability and agreed scope.
Break the demand into checks that can be verified
| Demand or claim | What to verify independently | What payment alone cannot establish |
|---|---|---|
| Buy an AML certificate | Issuer, purpose and the genuine receiver's requirement | Authority over somebody else's account restriction |
| Send the same amount again | The written reason for another transfer | That the first receipt is repaired |
| Pay native network gas | The actual wallet action and relevant network | That an arbitrary recipient can release a balance |
| Pay a private recovery company | Identity, contract and technical capability | That it can order an exchange or court to act |
| Submit source-of-funds evidence | Official channel, requested documents and purpose | That a purchased report replaces your own records |
| Act before a short forfeiture deadline | The actual policy and case reference | That urgency authenticates the sender |
| Pay another fee after the first | A concrete account of the earlier payment and result | That the new demand will be the final one |
AML Crypto's discussion of fake exchanges describes matching mirror-transfer demands and added unlocking payments. This is a security provider's description of the pattern, not evidence that it supervises your receiving service. Keep its useful warning separate from any marketing claims about the provider's own analysis products.
Distinguish an actual review from a promised clean slate
A legitimate service may ask for identity or source-of-funds information. Its review concerns a particular transaction and the evidence available. An unrelated seller cannot establish acceptance of a certificate just by saying the whole blockchain requires it. Ask the receiving service directly whether that document and issuer form part of its process.
A private analysis report can describe risk observations under a particular method. Buying it does not itself rewrite earlier transfers or compel another company to accept the funds. A new document can be relevant evidence, but the party conducting the review decides how it evaluates that evidence under its applicable obligations. Do not seek a report as a way to fabricate provenance or bypass checks.
The FTC's crypto-scam guidance describes platforms displaying apparent balances and then demanding fees to withdraw. A number shown in a dashboard is therefore not sufficient proof that the requester holds the stated funds for you. Verify the actual chain or account records before treating the displayed amount as recoverable money.
A matching payment creates another transfer
Suppose a fictional dashboard shows 600 units and a message says another 600 must be sent to mirror the first transfer. The second payment does not retroactively alter the first transaction. Without a verified service process, you have not established why the recipient would release either amount. The example illustrates the accounting question; it is not an actual case or a universal rule about every verification transfer.
A genuine native network fee is tied to a particular network action. It should not be confused with sending a large matching amount to an address supplied in a support chat. Likewise, real contractual costs can exist, including some technical recovery services. Ask for their scope and basis through the verified organization rather than declaring every additional cost legitimate or every fee fraudulent.
An exchange or investigator's branding can also be copied. Reach the company independently through an established official channel, quote the case reference and ask whether it issued the demand. Do not verify a phone number, email address or certificate solely by following the contact details printed on the suspicious document.
If you already paid, preserve the sequence
Record each payment separately, including its destination, network, hash, time and the explanation given before it. Retain the original messages and later changes in the promised outcome. Stop approving successive demands while the first claim remains unverified. A second requester offering recovery can become another unresolved payment rather than a solution.
The FBI's guidance for crypto-scam victims emphasizes useful transaction and contact information for reporting. Keep factual records and contact relevant legitimate services or authorities through their own channels. Do not expect a stranger's tracing report to function as a seizure order or a promise of a refund.
- Pause the extra payment and preserve the original demand.
- Locate the existing transfer or service account record independently.
- Authenticate the organization through a contact path not supplied by the requester.
- Ask which written requirement, document and payment purpose apply to this case.
- Separate identity evidence, analysis services, network costs and proposed recovery fees.
- If the demand remains unverified, retain the evidence and use legitimate reporting or support channels instead of sending more.
For site identity, read how to check a fake exchange. On KOT.CASH, the AML policy describes risk-based review and possible identity and source-of-funds requests. That published process should be read through the genuine site. For a no-account swap, keep the actual order reference and verify any case-specific instruction in the official support conversation. A claim about AML should lead to a checkable requirement, not an unexplained cycle of payments.
FAQ
Does an AML certificate prove someone can unlock my crypto?
No; verify who issued it, what it certifies and whether the genuine receiver requires it. A document or payment receipt does not itself establish control over another service's restriction.
What is suspicious about a mirror transaction demand for Bitcoin?
A demand to repeat an amount to release an earlier payment needs independent explanation and authentication. The second transfer does not edit the original transaction or prove the first payment will be returned.
Does an AML course certificate replace transaction evidence?
A training certificate concerns a different purpose from documenting the source of a particular transfer. Ask the reviewing service which evidence it actually requires.