Sent Your Passport to a Fake Crypto Recovery Site? Next Steps

If you sent your passport to a suspected fake crypto recovery site, stop sending documents or fees, preserve the disclosure record and secure any accounts whose credentials you also shared. Then use the relevant identity-protection and reporting routes for your country. A passport copy being exposed is a real concern, but it does not automatically prove that a loan exists, a wallet key was stolen or the physical passport must be reported lost.

Do not let the next request enlarge the incident

A recovery operator may ask for a clearer scan, a selfie, a bank statement or a payment to finish verification. Do not continue through the same contact just because you already sent something. The FBI’s recovery-scam warning advises against giving identifying information or money to unknown people claiming they can recover cryptocurrency. The immediate task is containment, not completing their checklist.

If the contact threatens to publish your documents, save the threat and stop treating the conversation as a recovery service. A promise to delete a copy after another payment is not evidence that copies will disappear. Do not replace one uncertain operator with an unsolicited person offering to clean the internet or retrieve the passport file for a fee.

Consider a fictional user, Daniel. He sends a passport image to someone who says it is needed to recover a lost transfer. The person then requests a selfie and a verification deposit. Daniel’s first useful action is to stop those two new disclosures. He can still record what he sent and seek official help without accepting the seller’s claim that finishing the process is the only way to protect himself.

Make an exposure inventory before choosing remedies

Write down what left your control, without uploading the evidence to another unknown checker. Record the website address, account identifiers, dates, messages, payment details and documents requested. Distinguish files actually sent from items merely requested. Keep the evidence in a protected location and use redacted copies for informal discussions; do not publish a full passport to demonstrate that it was exposed.

The categories can overlap, but they are not interchangeable. A passport does not itself function as the signing key for a self-custody wallet. It may still matter to identity checks at custodial services, especially alongside other disclosed information. Conversely, losing a recovery phrase calls for a wallet-specific response even if you never sent a single identity document.

Protect the accounts that could make the disclosure worse

If you reused a password or entered a login code on the suspect site, reach the affected provider independently. Review active sessions and recovery settings, replace exposed credentials and enable available multifactor protection while preserving your legitimate access. Give particular attention to email used for account recovery. Do not ask the supposed recovery agent which session belongs to them or accept their link as the way into security settings.

The FTC’s identity-theft guidance recommends reviewing account activity and credit reports for unfamiliar records. Record unexpected changes and contact the relevant institution through an established route. Monitoring is a way to detect evidence, not a promise that every possible misuse will generate an alert. An uneventful first check does not establish that all copies were deleted.

Use a simple action log: institution contacted, date, issue reported, reference number and next step. Separate confirmed unauthorized activity from a precautionary notification. This gives you a useful record if another request or unfamiliar account appears later, without turning every ordinary message into proof that the document has already been used.

Choose local protections without merging their promises

In the United States, the FTC explains credit freezes and fraud alerts. A freeze and an alert do different things, and a freeze is requested with each of the three credit bureaus. The FTC’s identity-theft resources also direct victims to IdentityTheft.gov for reporting and a recovery plan. These are US routes, not a service that blocks every use of identity information worldwide.

In Russia, the Bank of Russia describes a self-prohibition on consumer credit contracts through Gosuslugi or an MFC. It has a defined scope and exclusions, including existing credit-card borrowing and certain secured or educational lending. Check the official status and effective conditions rather than assuming that submitting an application immediately stops every financial operation. The measure does not remove information already copied by the recipient.

The two mechanisms are not interchangeable and do not settle an already disputed debt. If an unfamiliar obligation or account appears, contact the institution concerned and use the relevant dispute and reporting procedures. Preserve its response. Do not pay a stranger who says a new loan or transfer to a special account is required to neutralize the earlier disclosure.

A copied passport and a missing passport need different descriptions

Tell the issuing authority what actually happened: the physical document is missing, or you still have it and a copy was sent to someone else. Ask which procedure applies to that document and jurisdiction. Do not turn an exposure report into a false statement that the physical passport was lost. Nor should an operator’s claim that a passport is now invalid replace the issuer’s decision.

For example, current US State Department guidance says to report a valid US passport lost or stolen when the physical document is lost or stolen; that report invalidates it. This is a US passport rule, not an instruction to cancel every exposed document. The example shows why the accurate description matters before making a report that changes the document’s status.

1. Stop further uploads, signatures and payments to the suspect contact.
2. Save a factual timeline and the evidence without spreading full document copies.
3. List documents, credentials, codes, wallet secrets and payments as separate exposures.
4. Secure affected accounts through their established providers.
5. Check applicable identity, credit and document-issuer procedures through official sources.
6. Record any unfamiliar activity and follow the relevant institution’s dispute or reporting route.

Keep reporting separate from promises of recovery

The FTC’s refund-and-recovery warning describes repeat approaches to people who have already suffered a scam. Someone knowing the amount you lost or the name of the first operator is not independent proof they can help. Keep new claims attached to their evidence and verify any claimed agency affiliation through that agency’s established contact route.

Our crypto recovery-scam guide covers evaluating the underlying offer; this response begins after documents were disclosed. Legitimate financial services can have compliance processes, including the KOT.CASH AML policy, but that does not authenticate a separate recovery website. A no-account swap is an exchange process, not a way to erase an exposed identity record. Resolve the identity and account issues through the appropriate institutions rather than another transfer.