Mars MarketResponse
Lost money? The first 72 hours
The transfer itself is irreversible. Almost everything else still has options, but only briefly — and the order in which you do these things matters more than the speed with which you do them.
Read this first
Anyone who contacts you offering to recover your funds for a fee is almost certainly running a second fraud against the same victim list. This happens within hours of a loss, and it is the most reliable prediction on this page.
Sequence
Six steps, in this order
-
Stop everything that can still move money
No further deposits, no "release fee", no verification payment, no top-up to unlock a withdrawal. Additional payments to the same counterparty are the single most common way a recoverable situation becomes a total loss. If a site is holding your balance and asking for more to release it, that request is the fraud continuing, not a rescue.
-
Preserve evidence now, while it still exists
Pages get taken down and channels get deleted within days. Capture what you have before it disappears, in a form that survives outside the original source.
-
Secure what is left
Move remaining funds to a wallet you control and trust, from a device you trust. Change credentials on any account that touched the transaction. Check for wallet approvals you granted and revoke them, since an unexplained drain is often a stale permission rather than a stolen key.
-
Notify the financial layer
Notify your bank if any fiat leg touched the transaction, and notify any custodial exchange involved. Some transfers pass through custodial platforms that freeze in response to a timely report. This window closes quickly and rarely reopens.
-
File a report with the appropriate authority
In the United States, complaints go to the FBI's Internet Crime Complaint Center. In the European Union, reports are routed through national cybercrime units. In most other jurisdictions there is an equivalent national portal. Reporting costs an hour and it is the only route by which enforcement data accumulates.
-
Write down the timeline while it is fresh
Dates, amounts, addresses, how contact was first made, what you were told, in what order. Investigations proceed on records, and a coherent chronology is the difference between a lead and a dead end.
Be honest with yourself about the report
Reporting a loss from an illegal purchase is uncomfortable, and it carries real consequences. That is a decision only you can make. What should not influence it is any hope that a paid intermediary can recover funds without a report — they cannot, and the request for payment is itself the second layer of the scheme.
Evidence
What to capture before it disappears
| Item | Why it matters | How long it lasts |
|---|---|---|
| Transaction identifiers | Every investigation starts here | Permanent, on-chain |
| Full destination addresses | Links your loss to the wider cluster | Permanent, on-chain |
| Screenshots of the pages involved | The domains often vanish within days | Days to weeks |
| Chat and message logs | Shows how contact was established and by whom | Until deleted or account removed |
| Timestamps of every step | Establishes sequence and supports corroboration | Only as good as your record |
| Payment details of any fee paid | Secondary frauds reuse identifiable infrastructure | Variable |
Store this outside the device and the accounts that were involved. A record kept only on a compromised machine is not a record.
Not money
If the loss is not the main problem
A financial loss is often the smaller of two situations, and this site is not qualified to help with the other one. If the reason you were on those pages involves substance use, please speak to your national health service, your family doctor, or a local substance-use support organisation. Those services are confidential, they are free at the point of use in most countries, and they are not connected to anything you were doing online.
If you are in crisis, contact your local emergency number or a crisis line in your own country.