One reported script routes victims through finotz.com or spaloan.com after a crypto loss. You are told to open a wallet on their domain so funds can be traced and a “security protocol” issued. A small bitcoin amount — in one account, 0.003 BTC — must sit in that wallet first. Email to [email protected] follows; then a “lawyer” somewhere in Europe supposedly needs the protocol document. The coins in the special wallet do not come back.
That is advance-fee recovery with extra science fiction. Real investigators do not require you to pre-fund a stranger’s branded wallet to mint a protocol with a comic-book name. Once bitcoin is on an address they control, refunds are a courtesy they need not extend. Fancy protocol PDFs can also be lures toward further malware or seed-phrase phishing.
Stop the chain. Do not send the document onward. Keep what you already have for a police report, and ignore anyone who offers to finish the “protocol” for another top-up. Help pages beat private recovery domains every time.
If money already left, start at Get help. Treat unsolicited “we can reverse the transfer” desks as a second hit — read Fake recovery first.
This article is for general information only. It is not legal or financial advice. Details change. If you have lost money, contact your bank or card issuer and use the routes on the help pages.