A caller says police have found your identity documents and cryptocurrency information on a seized computer. Then a helpful specialist is suddenly available to protect your wallet.
The story becomes harder to dismiss when an official-looking support email arrives during the conversation. That is the moment to stop and check who started it.
Overview
The police story hands you to a second impersonator
A recent UK report describes a supposed police investigation leading directly to someone claiming to provide Ledger support. The second caller wanted the recipient’s hardware wallet connected.
The recipient says they independently checked with police and ended the attempt. This is a public account, not an independently authenticated police incident file.
The wider tactic is nevertheless documented by Ledger: unsolicited callers can use real support-ticket emails to make their own false identity seem legitimate.
A genuine automated email can be part of the deception
A scammer can submit a support request using somebody else’s email address. The support system then sends that person an authentic confirmation.
The caller points to the message as proof they work for Ledger. But the message proves that a request entered the system, not who is speaking.
Ledger’s published guidance says it does not provide telephone support. A police introduction does not create an exception to that rule.
The boundary is control of the wallet
Do not follow an unsolicited caller’s instructions to connect, restore, update, or move funds. Independently contact the relevant institution instead.
- A familiar police number on caller ID can be spoofed.
- A badge number or case reference is a claim the caller supplies.
- An authentic support notification does not authenticate a telephone conversation.
- Your recovery phrase must never be dictated to a caller or entered into a website.
- A transfer described as protective can still send assets to somebody else’s wallet.
What the Latest Account Actually Describes
In the public account posted to CryptoScams, the opening involved supposedly seized passports, a laptop, and stored account information.
The caller reportedly asked about travel before turning to cryptocurrency holdings and hardware wallets. The conversation then moved to a supposed Ledger specialist.
An apparently genuine support confirmation arrived. The recipient says they later learned that a request submitted through a support portal could trigger such a message.
The account ends with an independent police check and the purported specialist hanging up. It does not establish a completed theft or reveal the intended final website.
No loss or final phishing address is documented in that account. The names given belong to the caller’s story, not verified identities.
The useful warning lies in the handoff: an apparent authority creates urgency, then supplies another apparent authority to carry out the supposed protection.
Why the Support Email Does Not Clear the Caller
Ledger’s own campaign guidance specifically describes scammers opening support tickets with a target’s email address and following up by telephone.
Think of a ticket confirmation as a receipt for a request. It can be genuine even when the person who initiated the request is not you.
The same distinction applies to an appointment email or account notification. The institution may have sent the message, while the caller falsely claims responsibility for helping you.
You therefore need two checks, not one. Is the message authentic, and does it actually authorize this conversation or the action being requested?
A real ticket number answers neither question about the caller’s employment. It also does not mean that police transferred you into the company’s own telephone system.
Ledger tells recipients of unsolicited support confirmations to inform its team that they did not initiate the request. Use the genuine support route when doing so.
Do not copy your recovery words into that report. An explanation of the unwanted call, the time, and the relevant message is enough to describe the attempt.
The distinction is especially important if you already checked the sender domain. Passing that check cannot turn a ticket-triggering trick into a safe instruction.
How the Fake Police and Ledger Support Scam Works
Step 1: A serious investigation makes answering feel responsible
The opening story claims your identity is connected to an arrest, seized documents, or a compromised computer. It makes ordinary caution feel like avoiding a police inquiry.
A calm tone can be as effective as a threat. Someone who praises your caution may still be guiding the conversation toward the same dangerous instruction.
You do not need to settle the allegation on the incoming call. A genuine concern can be checked through an independently obtained police contact.
Step 2: Questions reveal which wallet story will work
Questions about accounts, devices, balances, and previous breaches help an impersonator tailor the next stage. Avoid giving a stranger an inventory of your financial life.
Some information may already be known. That does not prove the caller found it during the investigation they describe or has access to your wallet.
A claim about stolen recovery words is particularly powerful because it suggests immediate danger. Treat it as an unverified allegation, not a reason to disclose more words.
Step 3: The handoff borrows credibility from the first caller
The purported police contact introduces a supposed specialist. Instead of verifying a new person, the recipient is encouraged to carry trust across the transfer.
That is the critical mistake. The second voice may be another participant in the same deception, not a separate organization independently confirming the first story.
A technical vocabulary does not change this. Someone can understand wallets, exchanges, and recent incidents while misrepresenting who employs them.
Step 4: A real notification supplies a misleading credential
A support confirmation arrives at the right moment. The caller presents the timing, sender, and case number as a package of reassurance.
The package is persuasive because part of it can be real. The deception is the unsupported connection between that real email and the person on the phone.
Do not click through merely to satisfy the caller. End the conversation and initiate any support request yourself through a known official route.
Step 5: Supposed protection becomes an action you approve
The dangerous stage may involve recovery words, an unfamiliar application, a transaction, or a request to move assets. Not every attempt uses the same final instruction.
The latest account stopped before a complete theft sequence was established. These possible endpoints describe the risk to avoid, not additional events proven in that report.
If a caller controls the explanation while you approve the action, a hardware wallet cannot tell you the story was false. Review what you are actually authorizing.
The Two Checks That Break the Handoff
Check the police contact without using the caller’s route
Hang up. Find the force’s official website independently and use its published non-emergency contact process. Do not call a replacement number supplied during the same conversation.
Explain that someone claimed to be investigating identity and cryptocurrency information. Provide the claimed reference without assuming the caller’s identity has been confirmed.
If the allegation concerns an immediate physical threat, use the appropriate emergency service. A wallet-protection sales pitch is not itself an emergency verification channel.
Check Ledger support without keeping the stranger involved
The official Ledger contact page describes email and available live-chat assistance. It expressly says telephone support is not offered.
Start there yourself. You do not need to accept a transfer, keep screen sharing active, or follow a caller’s link to reach genuine help.
If the caller insists that ordinary support is excluded from a confidential police operation, that does not remove the need for independent verification.
What a Hardware Wallet Can and Cannot Protect
A hardware wallet helps keep signing keys away from ordinary software. It does not make every instruction you receive trustworthy or every transaction you approve appropriate.
The recovery phrase is a different route to control. Someone who obtains it may restore the same wallet elsewhere without possessing your physical device.
That is why a caller asking you to keep the device while providing the words has not offered meaningful reassurance. Keeping the plastic does not keep the secret.
Nor is a transfer made safe by a label such as secure vault or temporary verification. What matters is the destination and the authority you are giving it.
The Swiss National Cyber Security Centre’s wallet warning independently explains caller-ID spoofing and recovery-phrase requests in cryptocurrency phishing.
Its guidance reinforces a useful rule across brands: no legitimate support representative or authority needs your seed phrase to investigate a telephone allegation.
What to Do If You Responded to the Call
- End contact and stop following the caller’s instructions. Do not accept another transfer or continue through an email link simply because a ticket was created.
- Write down what you actually disclosed or approved: ordinary contact details, account credentials, a recovery phrase, a transaction, a signature, or software installation.
- If you only spoke and shared no secrets or approvals, do not wipe the wallet. Preserve the call details and independently report the impersonation.
- If recovery words were exposed, treat wallets derived from them as compromised. Obtain official guidance promptly on safely moving remaining assets to independently secured new keys.
- Never reset the only accessible device before confirming your recovery options and asset access. A rushed reset can turn a fraud concern into avoidable loss.
- If you signed or sent something, preserve transaction identifiers and public destination addresses. Contact the relevant exchange or service promptly, without assuming it can reverse a blockchain transfer.
- If credentials or remote access were also involved, secure the affected accounts from a trusted device and stop the unauthorized access. Tell genuine support about that additional exposure.
- Report the fake police contact through the real force and the Ledger impersonation through genuine support. Keep sensitive recovery material out of every report.
When funds remain at risk, work from a trusted environment and official wallet instructions. Do not let another unsolicited helper choose the replacement wallet or backup words.
A newly generated wallet must be under your control. A set of words supplied by a supposed rescuer is not an independent recovery destination.
When recording the call, distinguish the identity claimed from an identity actually verified. A name or badge number may belong to somebody uninvolved or be invented entirely.
Record how the email arrived and whether you initiated any support request yourself. That sequence helps explain the ticket trick without accusing the genuine email service.
Keep original messages privately where possible, including their timestamps. For an initial public warning, redact personal addresses, account identifiers, and unrelated correspondence.
If you cannot remember every instruction, say so. An accurate partial account is more useful to an investigator than filling the gaps with a guessed theft sequence.
Do Not Let the Rescue Become Another Scam
People discussing cryptocurrency losses often receive private messages promising recovery. Some offers invoke police contacts, blockchain tracing, or an alleged relationship with a wallet manufacturer.
Being able to view a public transaction does not give someone the power to reverse it. A convincing diagram can still accompany an advance-fee demand.
Keep any exchange report focused on the actual transaction and destination. Do not pay an invented tax or unlocking charge to a stranger claiming the funds are waiting.
MalwareTips also covers fake police recovery advertisements. That is a separate route exploiting the same desire for authoritative help.
A public warning should omit private documents, full account details, and recovery words. You can explain a scam without publishing the material another criminal would need.
If you are embarrassed about continuing the first conversation, focus on the next controllable action. Accurate reporting is more useful than trying to hide a partial disclosure.
Frequently Asked Questions
Can the number displayed on my phone really belong to police?
The displayed number can match a real organization while the call comes from an impersonator. Verify through a fresh contact you initiate, not caller ID.
Does a genuine Ledger ticket email prove the caller is genuine?
No. Ledger documents scammers triggering authentic support confirmations with a target’s email address. The request’s existence does not authenticate the person calling about it.
Would Ledger telephone me after a police transfer?
Ledger’s published contact guidance says it does not provide phone support. An unsolicited caller’s police story does not establish a special support arrangement.
Should I give the caller some recovery words to check?
No. Do not disclose any part of the phrase or enter it into a diagnostic website. Genuine support does not need those words.
Is connecting the device alone proof that money was stolen?
No. Assess what software ran, what secrets were disclosed, and what actions were approved. Explain the exact exposure rather than assuming a loss from connection alone.
Can changing my device PIN fix an exposed recovery phrase?
No. A device PIN does not replace the wallet’s underlying recovery secret. Seek official guidance on securing assets under new, independently controlled keys.
The Bottom Line
Hang up on unsolicited police-to-Ledger support handoffs. A real ticket email can be used as a prop, while Ledger’s actual rules exclude this telephone support story.
If you already disclosed secrets or approved a transfer, act on that precise exposure immediately through genuine channels. Do not hand the recovery process to another stranger.
Join the discussion
0 commentsShare your experience or ask a question about this article.
Discussion
Start the conversation
Have a question or something useful to share? Add the first comment.