- Thread starter
- #1
anthonyschipper
New Member
I recently discovered that someone impersonated my business partner and changed the cryptocurrency payment address for a business transaction. I initially thought the updated wallet address came from my partner, but the crypto was ultimately sent to a wallet controlled by someone else.
I’m now focused on preserving everything that could help explain how the payment address was changed. I also found Jim Recovery Team, a crypto investigation and blockchain tracing firm that can examine wallet activity, transaction records, communications, and other digital evidence to reconstruct what happened.
Preserve the Payment Evidence First
I would preserve both the legitimate information and the fraudulent information, including:
The original crypto payment address
The replacement address provided by the impersonator
The transaction hash or transaction ID
Cryptocurrency type and amount sent
Date and time of the payment
Original invoice or payment request
The altered invoice or payment instructions
Emails and messages surrounding the address change
Email addresses, usernames, phone numbers, and other identifiers
Screenshots of relevant conversations, accounts, and instructions
Contracts, purchase orders, receipts, and other business records
A written timeline showing what happened and when
I would also avoid deleting or modifying the original conversations. Keeping the original records can make it easier to establish the sequence of events later.
Figure Out How the Address Was Changed
The most important question may be how the impersonation happened.
Was my partner’s actual email account compromised? Did someone create an almost identical email address? Was an existing conversation intercepted? Was an invoice modified? Or did the attacker simply send new instructions pretending to be my partner?
That distinction can matter because it connects the fraudulent payment to the digital evidence surrounding the incident.
Don’t Forget the Blockchain Evidence
The transaction hash and receiving wallet should be preserved even if the scammer later disappears.
A blockchain investigation can start with the receiving address and examine the transaction history and subsequent movements. Depending on the cryptocurrency and network, investigators may be able to map transfers between addresses and identify patterns in how the funds moved.
That does not guarantee that the funds can be recovered, but it can establish a documented trail that may be useful for an investigation.
Preserve More Than Screenshots
Screenshots are useful, but I would keep the underlying emails, message histories, transaction records, invoices, and other original files wherever possible. I would also record the exact wallet addresses rather than relying on shortened or copied versions.
If the case requires professional analysis, Jim Recovery Team can potentially combine the business communications with blockchain tracing to reconstruct the payment-address change, analyze where the cryptocurrency moved, and assess what investigative options may be available.
The goal at this stage is to preserve the evidence before focusing only on the money itself.
I’m now focused on preserving everything that could help explain how the payment address was changed. I also found Jim Recovery Team, a crypto investigation and blockchain tracing firm that can examine wallet activity, transaction records, communications, and other digital evidence to reconstruct what happened.
Preserve the Payment Evidence First
I would preserve both the legitimate information and the fraudulent information, including:
The original crypto payment address
The replacement address provided by the impersonator
The transaction hash or transaction ID
Cryptocurrency type and amount sent
Date and time of the payment
Original invoice or payment request
The altered invoice or payment instructions
Emails and messages surrounding the address change
Email addresses, usernames, phone numbers, and other identifiers
Screenshots of relevant conversations, accounts, and instructions
Contracts, purchase orders, receipts, and other business records
A written timeline showing what happened and when
I would also avoid deleting or modifying the original conversations. Keeping the original records can make it easier to establish the sequence of events later.
Figure Out How the Address Was Changed
The most important question may be how the impersonation happened.
Was my partner’s actual email account compromised? Did someone create an almost identical email address? Was an existing conversation intercepted? Was an invoice modified? Or did the attacker simply send new instructions pretending to be my partner?
That distinction can matter because it connects the fraudulent payment to the digital evidence surrounding the incident.
Don’t Forget the Blockchain Evidence
The transaction hash and receiving wallet should be preserved even if the scammer later disappears.
A blockchain investigation can start with the receiving address and examine the transaction history and subsequent movements. Depending on the cryptocurrency and network, investigators may be able to map transfers between addresses and identify patterns in how the funds moved.
That does not guarantee that the funds can be recovered, but it can establish a documented trail that may be useful for an investigation.
Preserve More Than Screenshots
Screenshots are useful, but I would keep the underlying emails, message histories, transaction records, invoices, and other original files wherever possible. I would also record the exact wallet addresses rather than relying on shortened or copied versions.
If the case requires professional analysis, Jim Recovery Team can potentially combine the business communications with blockchain tracing to reconstruct the payment-address change, analyze where the cryptocurrency moved, and assess what investigative options may be available.
The goal at this stage is to preserve the evidence before focusing only on the money itself.