Phishing and unauthorized transfers
Legal assessment of account compromise, deceptive instructions and disputed asset movements.
Who this practice helps
When the authority for a transfer is in question
This practice addresses disputed wallet instructions, account compromise and deceptive requests that led to a transfer. The legal assessment considers what the client authorized, the surrounding communications and the responsibilities of the relevant parties.
Understanding the legal issue
We bring together the client timeline, account records and independently prepared technical findings to assess responsibility and available remedies. The review considers how access was obtained, what instructions were given and which service providers or other parties may hold relevant evidence.
Records that help establish the facts
- Original messages, domains and suspicious links
- Security and login notifications
- Transaction hashes and receiving addresses
- Provider correspondence and incident reports
Keep originals and preserve dates and context. Initial enquiries should contain only a concise overview. We will explain how further records should be shared.
Assessing the available route
Potential steps include lawful evidence preservation, appropriately scoped reporting, platform requests and claims supported by the facts. Do not send passwords, verification codes, seed phrases or private keys to us. We explain an appropriate route for sharing further records.
Free review and the later engagement
We begin with a free initial case review and no firm retainer. If suitable, a recommended independent recovery company evaluates the technical position and reports to the firm. After report review, any paid legal engagement sets out the standard fee, applicable retainer terms and authorization and jurisdictional submission work. Relevant reviews and approvals precede the next steps that depend on them.
Related guidance
How we work · Preserving relevant records · Common questions
Authority, deception and the transaction sequence
An unauthorized access event and a transfer a person was deceived into approving can present different factual and legal questions. A careful account distinguishes the device or account compromise, the instruction presented and the action taken. The review should avoid replacing uncertain facts with a categorical description.
Preserve security notices, timestamps and the original message or site that prompted the action. Record which service was used to initiate the transaction and what the interface displayed. Do not connect a wallet to a new site or provide access credentials merely to obtain an informal opinion.
Technical findings need an evidentiary foundation
A useful technical report identifies the relevant network, transaction and address, explains the analytical method and separates observed data from attribution. Counsel should be able to understand the report’s assumptions and the limits of any conclusion about control or destination.
Off-chain records may be needed to connect transactions with an identifiable party. An assessment should ask what records might exist, who may hold them and whether an appropriate lawful disclosure route is available. It should not assume that any exchange will disclose another customer’s information on request.
Preservation without creating new risk
Preservation should protect relevant records without collecting unnecessary secrets. Keep original files and an intelligible chronology. If a device may contain relevant material, agree an appropriate handling plan before altering it or sending copies widely.
A legal strategy can assess provider requests, reporting, potential claims and the need for qualified technical support. Those actions should be sequenced deliberately. A completed blockchain transaction should not be described as reversible merely because a report or legal request has been prepared.
What the engagement may produce
The work product depends on the agreed instructions. Possible deliverables include: an incident timeline, a transaction and communication index, counsel’s review of any authorized technical findings and a written assessment of the next legal decisions.
The proposal should identify the actual deliverable, assumptions, exclusions and charges. Technical analysis, local counsel and proceedings are separately considered where needed. Understand scope and fees.
The decision at the end of a stage
The first stage should distinguish securing systems, identifying the transfer path and assessing legal responsibility. Those tasks may require different providers. A transaction trail alone does not establish who controlled an address or caused the loss.
A stage review should explain what has been established, which gaps remain and what authority is needed for any next instruction. It may support further work, a narrower route or a decision not to proceed.