Scammers Impersonate Police, Ledger Staff to Steal Crypto Phrases
Scammers posing as police officers and Ledger support staff are using genuine automated emails to pressure crypto holders into revealing 24-word recovery phrases.
Reports published Nov. 4, 2026, described a scam in which callers posing as detectives told crypto holders that their passports, identification documents, passwords or wallet information had appeared in a criminal investigation.
The callers sometimes asked about recent travel or cryptocurrency use before claiming that a specialist needed to check whether the victim’s wallet had been compromised. They then created urgency and asked for the holder’s 24-word Secret Recovery Phrase.
In one reported case, the caller ID appeared to belong to a police station. The recipient contacted the station through an independent channel and learned that the named officer did not exist. Other targets reportedly received a second call from someone claiming to work for Ledger.
The scammers reportedly use Ledger’s genuine support ticket system to make the calls appear legitimate. They open a ticket using the target’s email address, which triggers an automated message from Ledger. The scammers then refer to the authentic email as proof that the phone call is real, although Ledger has no connection to the callers.
Ledger does not provide customer support by phone and does not ask customers for their 24-word Secret Recovery Phrase. Impersonators may send targets to fake diagnostic or recovery websites and request the phrase as proof of wallet ownership. Anyone who obtains the phrase may be able to access and transfer funds from wallets created with it.
People who receive unsolicited calls about police investigations or wallet emergencies should verify the claims through official police channels using a separate device. Ledger customers should use only the support options listed on Ledger’s official website. Suspected impersonation attempts can be reported to [email protected].
A recovery phrase should never be shared or entered on a website, computer or phone. If it has been exposed, the related wallet should be treated as compromised. Remaining funds should be moved to a new wallet with a new phrase on a trusted, clean device when the transfer can be completed safely.
Reviewed and fact-checked by Alex Panasenko on November 4.
The material on GNcrypto is intended solely for informational use and must not be regarded as financial advice. We make every effort to keep the content accurate and current, but we cannot warrant its precision, completeness, or reliability. GNcrypto does not take responsibility for any mistakes, omissions, or financial losses resulting from reliance on this information. Any actions you take based on this content are done at your own risk. Always conduct independent research and seek guidance from a qualified specialist. For further details, please review our Terms, Privacy Policy and Disclaimers.
Articles by this author
