The Virtual Assets Regulatory Authority (VARA) is Dubai’s real virtual-asset supervisor; its public home is vara.ae. Scam mail ignores that. Victims get a message claiming “VARA” (sometimes with odd add-ons like “Gautieji”) has listed them as a broker-fraud casualty, that a crypto balance is ready to withdraw “without extra deposits”, and that they should reply with a magic word or write to a random Telegram number.
That is recovery bait wearing a regulator’s initials. Genuine supervisors do not harvest victims through code words, do not move retail clawbacks over Telegram, and do not need you to “confirm” a surprise windfall. The goal is either a fee, a wallet-connect, or enough personal data to run the next con.
Delete the mail. Verify any licence claim on the official site you typed yourself. Report the broker loss through normal channels — not through the stranger who claimed to be VARA.
Start at Get help. Read Fake recovery before any follow-up payment.
This article is for general information only. It is not legal or financial advice. Details change. If you have lost money, contact your bank or card issuer and use the routes on the help pages.