- Trending
- Comments
- Latest
Scammers are posing as police detectives and then triggering genuine Ledger support emails to make their calls look real, in a scheme that aims to extract victims’ 24-word recovery phrases, according to accounts from Ledger users on Reddit.
Ledger says it never calls customers and never asks for a recovery phrase. Anyone who has entered theirs on a site or given it to a caller should treat the wallet as compromised.
The reported scam typically begins with an unexpected telephone call from someone claiming to be a police detective investigating criminal activity.
According to accounts shared in the r/CryptoScams and r/ledgerwallet Reddit communities, callers tell their targets that sensitive personal information has been discovered during an ongoing investigation.
The information allegedly includes passports, identification documents, passwords, and cryptocurrency wallet details.
In some cases, callers reportedly question recipients about recent international travel or cryptocurrency activity before warning that their digital assets may have been compromised.
The supposed investigation then becomes the justification for an urgent security assessment.
Victims are told that a specialist must examine their cryptocurrency wallet to determine whether their funds remain safe.
The tactic is designed to create anxiety and encourage immediate cooperation before the recipient independently verifies the caller’s identity.
Some individuals reported that incoming calls appeared to originate from legitimate police telephone numbers.
However, caller identification information can be manipulated, meaning a displayed number does not necessarily establish the caller’s identity.
One Reddit user reportedly contacted the police station independently after receiving such a call and discovered that the officer identified by the caller did not exist.
Other users described receiving follow-up calls from individuals claiming to represent Ledger customer support.
These incidents suggest that the scammers may be using multiple impersonators to make the alleged emergency appear credible.
For a Ledger wallet holder, the combination of a police investigation and a supposed security warning can create pressure to disclose information that should remain confidential.
The central objective is reportedly to persuade victims to surrender their wallet recovery credentials or enter them into fraudulent websites.
One particularly deceptive element of the scheme involves the misuse of Ledger’s genuine customer support ticketing system.
Rather than relying exclusively on counterfeit email messages, scammers reportedly submit support requests using the email addresses of intended victims.
This action triggers an automated response from Ledger’s legitimate support infrastructure.
The victim consequently receives an authentic confirmation email, despite having never requested assistance.
Scammers then refer to the message during their calls, presenting it as evidence that their supposed security investigation is genuine.
The technique exploits the credibility of an established company rather than requiring attackers to compromise its email infrastructure.
However, receiving an authentic support notification does not establish that the person who initiated the request is authorized to act on the recipient’s behalf.
The Ledger wallet scam relies on confusing these separate events.
A legitimate email confirms only that a support request has been recorded; it does not prove that an unsolicited caller represents Ledger.
According to the reports, impersonators may direct victims to fraudulent diagnostic pages or cryptocurrency recovery websites.
These websites are designed to resemble legitimate security services and may instruct users to enter their 24-word recovery phrases to confirm ownership or protect their assets.
Such requests are particularly dangerous because a recovery phrase can provide access to cryptocurrency wallets and the funds associated with them.
Anyone who obtains the phrase may be able to recreate the wallet on another device and authorize transactions without the original owner’s permission.
Ledger explicitly states that its support team does not provide telephone support and will never request a customer’s Secret Recovery Phrase.
The company also warns that impersonators may use authentic support ticket confirmations to make unsolicited calls appear legitimate.
These warnings directly address the methods described in the recent reports.
The reported incidents highlight the risks of social engineering attacks, which rely on manipulating individuals rather than directly exploiting technical weaknesses in cryptocurrency hardware.
Unlike attacks targeting software vulnerabilities, these schemes attempt to persuade users to voluntarily disclose confidential information.
The attackers reportedly combine several elements to increase their credibility, including law enforcement titles, apparent police telephone numbers, case references, and authentic customer support emails.
They also create urgency by suggesting that cryptocurrency holdings may be stolen unless the victim immediately completes a security procedure.
However, cryptocurrency holders can independently verify suspicious communications without following instructions provided by unsolicited callers.
Anyone receiving a call supposedly connected to a criminal investigation should contact the relevant police organization using contact information obtained from its official website.
Users should not rely on telephone numbers supplied during the suspicious conversation.
Similarly, Ledger wallet owners should communicate with the company only through support channels available on its official website.
They should avoid clicking unfamiliar links sent through messages or following instructions to visit external wallet recovery pages.
The most important precaution is to keep the 24-word Secret Recovery Phrase confidential.
Ledger advises users never to enter their recovery phrases into websites, computers, or mobile applications.
The phrase should also never be disclosed to anyone claiming to represent the company’s support department.
Users should reject cryptocurrency transactions they did not personally initiate or authorize on their hardware devices.
These precautions remain important even when the person making contact appears to possess legitimate personal information.
An authentic-looking message or convincing explanation does not eliminate the possibility of fraud.
The latest impersonation reports demonstrate how cryptocurrency scams can exploit trusted organizations and established customer support processes.
Although the incidents were described by individuals on Reddit, the supplied report does not establish how many people were targeted or whether any victims lost cryptocurrency through this particular scheme.
The absence of confirmed financial losses does not diminish the potential threat posed by attempts to steal recovery credentials.
For individuals who have already disclosed a recovery phrase, the affected wallet should be treated as compromised.
The appropriate response is to create a new wallet with a newly generated recovery phrase using a trusted device and transfer any remaining assets to addresses controlled by the new wallet.
Simply changing a device PIN does not protect funds when the underlying recovery phrase has already been exposed.
Users can also report suspected Ledger impersonation attempts through the company’s designated phishing contact, phishing@ledger.fr.
The reported campaign illustrates a broader challenge facing cryptocurrency holders who manage their own digital assets.
Hardware wallets are designed to keep sensitive signing credentials protected, but their security can be undermined if users are persuaded to disclose recovery information.
The use of authentic support emails makes the reported scheme particularly concerning because victims may interpret legitimate automated communications as confirmation of a caller’s identity.
As fraudsters continue developing more convincing impersonation techniques, Ledger wallet users remain responsible for verifying unexpected security claims and protecting their recovery phrases.
The central warning is straightforward: neither a supposed police investigation nor a genuine support email justifies sharing the confidential words that control a cryptocurrency wallet.
Copyright © 2025 - The Bit Gazette.
