How to Vet an Asset Recovery Firm Before Hiring | ICAR

Vetting an asset recovery firm before hiring one comes down to six checks: confirming what information they actually need from you, verifying their licensing and credentials independently, confirming the business itself is real and registered, understanding how they structure payment, asking what a realistic outcome looks like, and considering how they first made contact with you. This guide applies whether you’re evaluating a firm you found yourself or one that reached out to you and it’s worth applying the same standard to any firm, including ours.

Check 1: What Information Do They Actually Ask For?

A legitimate investigator working a fraud or crypto loss case needs specific documentation: transaction records or hashes, the wallet addresses or account numbers involved, a timeline of what happened, and any communication you had with the original scammer. What they should never ask for is your seed phrase, private keys, exchange account passwords, or remote access to your device or accounts. Any request for credentials that would give someone else control over assets you still have (as opposed to assets you’ve already lost) is a serious red flag regardless of how it’s justified.

Check 2: Verify Licensing and Credentials Independently

If a firm employs licensed private investigators, most jurisdictions maintain a public license database — in the US, this is typically run at the state level; New York’s Department of State license search is one example, and most other states maintain equivalent public tools. A real licensed investigator will provide license information upfront and won’t hesitate if you ask to verify it yourself. If a firm is affiliated with an attorney, every licensed attorney in the US is registered with a state bar association, and that registration is independently searchable.

Beyond formal licensing, professional certifications relevant to fraud investigation and asset recovery  (Certified Fraud Examiner (CFE), Certified Anti-Money Laundering Specialist (CAMS), and similar credentials) are independently verifiable through the issuing body’s own certification lookup, not just a claim on a firm’s website. Ask for specific names and check them, the same way you’d verify a doctor’s board certification before a serious procedure.

Check 3: Confirm the Business Itself Is Real

Search for the firm’s actual business registration, not just its website. A legitimate firm has a real registered business entity, a genuine physical address (not just a virtual mailbox), and named team members whose professional backgrounds can be independently checked: a LinkedIn profile with a verifiable work history and industry connections is a reasonable, if not foolproof, signal, while a firm that lists no identifiable people at all is a meaningfully weaker prospect. Independent reviews on multiple platforms, not just testimonials curated on the firm’s own site, are also worth checking, keeping in mind that both glowing and harshly negative reviews can occasionally be fabricated in either direction.

Check 4: Understand How Payment Actually Works

Legitimate firms use standard business contracts and accept payment through conventional channels like wire transfer, credit card, check, or a retainer processed through a proper trust or business account. They do not ask for payment in cryptocurrency, gift cards, or other difficult-to-trace methods, regardless of how the request is framed,  a “blockchain activation cost,” a “tax clearance fee,” or a “processing fee” paid before any work begins are all versions of the same warning sign covered in our Recovery Scams Hub article.

A large upfront payment demanded before any investigative work has started, particularly one paired with a guaranteed outcome, is one of the most reliable indicators of a fraudulent recovery operation. Legitimate firms may charge a retainer or work on a fee structure tied to actual investigative hours or milestones, but the structure should be transparent and explained clearly before you’re asked to commit.

Check 5: Ask What a Realistic Outcome Looks Like

No honest investigator, attorney, or firm can guarantee the recovery of stolen funds,  the outcome depends on where the money went, how quickly you’re acting, and whether the assets remain traceable at all. Anyone promising a specific percentage or guaranteed dollar amount back is telling you something false, full stop; this is one of the single most reliable tells across every version of this fraud. A legitimate firm will instead walk you through realistic probabilities, explain the actual forensic methodology involved (the tools and techniques used to trace fund movement) and be candid that outcomes vary considerably by case.

It’s also worth understanding that recovery isn’t limited to a private firm’s own efforts. The DOJ’s Scam Center Strike Force, announced in November 2025, has seized and forfeited over $400 million in stolen cryptocurrency through coordinated federal action, and the FBI’s own Recovery Asset Team processed more than 3,000 requests in 2024 with a 66% success rate freezing funds on well-documented cases. A good private investigation often runs in parallel with these official channels, helping ensure your case reaches the right agencies with strong documentation rather than working as a total replacement for them.

Check 6: How Did You Actually Make Contact?

This is worth its own check because it’s such a reliable early filter. Legitimate investigators and firms generally don’t cold-call, cold-email, or send unsolicited direct messages specifically targeting people who’ve posted about a recent loss on social media or appear in a leaked victim list. If a firm reached out to you first, out of nowhere, referencing your specific situation, treat that as a reason for more scrutiny, not less, regardless of how professional the approach seems, and regardless of whether they reference a real, well-known agency or program by name.

A Quick Vetting Checklist

• They ask only for documentation (transaction records, timelines, communications)  never seed phrases, passwords, or remote device access
• Licensing and professional certifications are independently verifiable, and they’re not defensive when you check
• The business has a real registered entity, a genuine physical address, and named team members with checkable backgrounds
• Payment goes through standard channels only, never crypto, gift cards, or an upfront fee tied to a guaranteed outcome
• They’re candid about realistic probabilities and explain their actual methodology rather than making promises
• You found them, not the other way around, or if they contacted you first, you’ve verified everything above with extra scrutiny

Frequently Asked Questions

What’s a realistic success rate for fund recovery?

It varies enormously by case, but government programs offer useful benchmarks, the FBI’s Recovery Asset Team reported a 66% success rate freezing funds on documented cases in 2024, which reflects what’s achievable with fast action and strong documentation, not a guarantee for every case.

Is any upfront payment to a recovery firm automatically a red flag?

Not automatically — a reasonable retainer tied to actual investigative work, paid through standard channels, is different from a large upfront fee paired with a guaranteed outcome. The distinction is in the payment method, the size relative to work scope, and whether any specific result is promised.

What credentials should I actually ask about?

For licensed investigators, ask for their license number and verify it against your state’s public database. For fraud-specific expertise, credentials like Certified Fraud Examiner (CFE) or Certified Anti-Money Laundering Specialist (CAMS) are independently verifiable through the certifying body.

What should I never share with an investigator, even a legitimate one?

Your seed phrase, private keys, exchange passwords, or anything that would give someone else control over assets you still have. A legitimate investigator only needs documentation of what already happened, not access to what hasn’t.

How do I vet a firm I found through a friend’s referral?

Apply the same six checks regardless of how you found them, a personal referral is a reasonable starting point for trust, but it isn’t a substitute for independently verifying licensing, business registration, and payment practices yourself.

About ICAR: International Cyber Asset Recovery (ICAR) is a UK-based forensic investigation and asset recovery firm operating across the UK, US, Canada, Australia, Singapore, and Hong Kong. ICAR works alongside official fraud reporting  providing blockchain tracing, OSINT investigation, and exchange cooperation services that complement law enforcement and bank fraud processes. Free initial case assessments, complete case form or contact support via WhatsApp