Hunt the Scammer: Your Step-by-Step Guide
Your situation: Someone cloned your friend on WhatsApp, tricked you, and stole 900 USDT. Now we hunt them down.
What this guide does: Gives you every free tool and exact steps to track the scammer and maximize your chances of getting money back.
⚠️ READ THIS FIRST — The One Thing That Changes Everything
If you’re Palestinian, there’s a complication with Binance.
In late 2023, Binance started freezing Palestinian users’ funds when Israeli authorities requested it. This means:
- Even if you trace your stolen USDT to a Binance wallet
- Standard “report to Binance” advice may not work for you
- You’ll need alternative paths (we cover those below)
This isn’t to scare you — it’s so you don’t waste time on dead ends.
Source: Cointelegraph reported this in August 2024 — search “Binance Palestinian funds seized”
DO THESE THINGS RIGHT NOW
Before the scammer changes anything:
- Save the scammer’s WhatsApp profile photo (right-click, save image on WhatsApp Web)
- Screenshot EVERYTHING — all chat messages, the phone number, timestamps
- Write down the exact USDT wallet address they gave you
- Get your transaction ID from your wallet app (looks like a long string of letters/numbers)
📱 STEP 1: Find Out Who Owns That Phone Number
The scammer used a phone number. That number might be linked to their real name, social media, or other accounts. Here’s how to check:
The Easy Tools (Free, No Tech Skills Needed)
| Tool |
What It Does |
Link |
| Truecaller |
Shows how others saved this number in their contacts |
truecaller.com |
| GetContact |
Same idea, sometimes finds different names |
getcontact.com |
| Sync.me |
Another caller ID database |
sync.me |
| Eyecon |
Pulls Facebook photos linked to phone numbers |
eyecon-app.com |
How to use Truecaller (easiest):
- Go to truecaller.com
- Sign in with Gmail (use a throwaway if you want)
- Type in the scammer’s phone number
- See what name pops up
What you’re looking for: A real name, a business name, or clues like “نصاب” (scammer in Arabic) if others already flagged them.
📲 STEP 2: Check if They Have Telegram (BIG Lead)
Scammers who use WhatsApp often have Telegram too. Same phone number = same person.
Quick Check (No Coding)
- Open Telegram on your phone
- Add the scammer’s number as a contact
- See if a Telegram account shows up
- If yes — screenshot their username, profile photo, bio
Deeper Check (Telegram Bots)
Use these bots inside Telegram. Send them the phone number:
| Bot |
What It Finds |
Link |
| @BotoDetective |
Phone, email, social accounts |
Open Telegram, search @BotoDetective |
| @SocialMediaLeaksBOT |
Leaked database info |
Search @SocialMediaLeaksBOT |
| @GetContact_bot |
Caller ID lookup |
Search @GetContact_bot |
| @creationdatebot |
When their account was created (new = sus) |
Search @creationdatebot |
Pro tip: Use a burner Telegram account. Some of these bots are sketchy.
🔗 STEP 3: Track Where Your Money Went (Blockchain Tracing)
Your USDT didn’t disappear — it’s sitting in a wallet on the blockchain. Everything is recorded. Let’s follow it.
First: Figure Out Which Network
Your 900 USDT was probably sent on TRON (TRC20) — it’s the cheapest, most common for scams.
You need:
- The wallet address you sent money to (starts with T for TRON)
- Your transaction ID/hash (from your wallet app)
Tool 1: Tronscan (The Basic Tracker)
Link: tronscan.org
Steps:
- Go to Tronscan
- Paste the scammer’s wallet address in the search box
- Hit enter
- Click “Transfers” tab
- Filter by “USDT”
What you’re looking at:
- Did the money move? Where to?
- Is it sitting there? (Good — might be freezable)
- Did it go to a known exchange like Binance? (Good — they have ID records)
Tool 2: MistTrack (The Smart Tracker) 
RECOMMENDED
Link: misttrack.io
This is the secret weapon. It’s FREE and does the hard work for you.
What it does:
- Tells you if the wallet is “risky” (linked to scams)
- Shows you a visual map of where money went
- Checks against 1000+ known exchange addresses
Steps:
- Go to misttrack.io
- Click “Use MistTrack Light for free”
- Paste the wallet address
- Get your risk report
Real results: In Q2 2025, MistTrack helped recover almost $12 million for scam victims.
Tool 3: Bitquery (The Visual Map)
Link: explorer.bitquery.io
If you want to SEE the money flow as a graph:
- Go to Bitquery
- Enter the wallet address
- Click on the graph view
- Follow the dots
What Different Results Mean
| What You See |
What It Means |
Your Odds |
| Money went to Binance/OKX/Coinbase |
Exchange has their ID on file |
Better |
| Money is still sitting there |
Hasn’t cashed out yet |
Good if you act fast |
| Money hopped through 10+ wallets |
They’re hiding tracks |
Harder |
| Money went to “mixer” or “Tornado Cash” |
Intentionally anonymized |
Very hard |
🧊 STEP 4: Try to FREEZE the Stolen USDT
Here’s something most people don’t know: Tether (the company behind USDT) can freeze any USDT wallet.
They’ve frozen over $3.3 billion across 7,000+ addresses.
How Freezing Works (Simple Version)
- Tether adds the wallet address to a blacklist
- The USDT is still there, but can’t be moved
- With law enforcement, Tether can “burn” the frozen USDT and send new USDT to the rightful owner
How to Request a Freeze
Email: [email protected]
What to send them:
- Police report number (you need to file one first — see Step 6)
- Transaction ID showing you sent money
- The wallet address that received it
- Screenshots of the scam conversation
- Explain: “I was defrauded via WhatsApp impersonation scam”
Reality check: Tether usually needs law enforcement to make a formal request. Your email alone probably won’t freeze it. BUT — it creates a record that helps if your case gets bigger.
👥 STEP 5: Team Up With Other Victims (This 10x Your Chances)
You mentioned there are multiple victims. This is your biggest advantage.
Why Multiple Reports Matter
From the FBI’s own data:
“50 initial reports grew into an investigation covering 14,000 victims and $4 million in losses”
One person reporting = easy to ignore
Five people reporting the same wallet = pattern = investigation
What To Do
-
Find the other victims (you’re already in contact)
-
Create a shared document with everyone’s:
- Transaction hashes
- Wallet addresses (probably the same one)
- Phone numbers the scammer used
- Screenshots of conversations
- Dates and times
-
File reports together (see Step 6 below)
-
Reference each other — “I’m one of X victims, others are filing too”
📝 STEP 6: File Reports EVERYWHERE (Checklist)
The more places you report, the more likely someone takes action. Do ALL of these:
Priority 1: These Actually Get Looked At
| Where |
Link |
What to Include |
| IC3 (FBI) |
ic3.gov |
Everything — this goes to federal database |
| Chainabuse |
chainabuse.com |
Wallet address — exchanges check this |
| Scam Alert |
scam-alert.io |
Wallet address — law enforcement uses this |
| Bitcoin Abuse |
bitcoinabuse.com |
Wallet address — public scam database |
Priority 2: Regional/Platform
| Where |
How |
Why |
| Palestinian Police (Cybercrime Unit) |
Go in person to your local station |
They have an Electronic Crimes Unit (وحدة الجرائم الإلكترونية) |
| WhatsApp/Meta |
Report the number inside the app |
Gets the scammer’s account banned |
| Your crypto exchange |
Contact support |
If scammer used the same exchange |
What to Include in Every Report
Copy-paste this checklist:
□ Transaction ID (TxID/Hash)
□ Wallet address that received money
□ Amount stolen (900 USDT = ~$900 USD)
□ Date and time of transfer
□ Phone number used by scammer
□ Screenshots of WhatsApp conversation
□ Scammer's profile photo (saved)
□ How they first contacted you
□ Any names they used
□ "Multiple victims — same scammer" (if applicable)
🖼️ STEP 7: Reverse Image Search the Profile Photo
The scammer used your friend’s photo. But maybe they’ve used other photos too on other scams.
Tools That Find Faces
How to Use Yandex (Best Results)
- Go to yandex.com/images
- Click the camera icon
- Upload the scammer’s profile photo
- Look for:
- Other social media profiles using same photo
- Scam warning posts about that photo
- Original source of the photo
🔎 STEP 8: Google Dorking (Search Like a Pro)
Use special Google searches to find info about the scammer’s phone number:
Copy-Paste These Searches
Replace 970XXXXXXXXX with the actual scammer phone number:
"970XXXXXXXXX" site:facebook.com
"970XXXXXXXXX" site:instagram.com
"970XXXXXXXXX" scam
"970XXXXXXXXX" احتيال
"970XXXXXXXXX" نصاب
"970XXXXXXXXX" whatsapp
What Each Search Does
site:facebook.com — Only searches Facebookاحتيال — Arabic for “fraud”نصاب — Arabic for “scammer”- Quotes
" " — Searches exact phrase
🚫 STEP 9: DON'T Fall for Recovery Scams
After you get scammed, new scammers will try to scam you again.
Red Flags — DO NOT Trust Anyone Who:
“Guarantees” they can recover your money- Asks for upfront payment before doing anything
- Claims they can “hack” the scammer’s wallet
- Found you on social media and DMed you first
- Says they have “insider access” at exchanges
Legit Help Looks Like This:
Rule: If someone contacts YOU offering to recover your crypto, it’s a scam. 100% of the time.
📊 STEP 10: Your Realistic Chances (Honest Talk)
Let’s be real about what you’re working with:
Your Case Breakdown
| Factor |
Good or Bad? |
| Amount ($900) |
Small — law enforcement won’t prioritize |
| Multiple victims |
GREAT — pattern detection triggers investigations |
| Phone number from real carrier (Jawwal) |
GOOD — traceable, not a burner VoIP |
| USDT on TRON |
OK — traceable on blockchain |
| Scammer studied target for weeks |
Bad — they’re experienced |
Probability Estimates
| Scenario |
Recovery Chance |
| You alone, doing nothing |
~2% |
| You follow this guide, solo |
~15-20% |
| Multiple victims, coordinated reports |
~30-40% |
| Funds traced to KYC exchange + multiple reports |
~40-50% |
| Law enforcement takes interest |
~50%+ |
Bottom Line
Your best move is coordinating with other victims and filing everywhere. One report is noise. Five reports of the same wallet is a signal.
QUICK TOOL REFERENCE
All Links in One Place
Phone Number Lookup
Telegram Investigation
Blockchain Tracing
Scam Reporting
Face/Image Search
Support Organizations
YOUR ACTION CHECKLIST
Print this. Do it in order:
TODAY:
□ Save scammer's WhatsApp profile photo
□ Screenshot all conversations
□ Get your transaction ID from wallet app
□ Run phone through Truecaller & GetContact
□ Check if number has Telegram account
THIS WEEK:
□ Look up wallet on Tronscan
□ Run wallet through MistTrack (free)
□ Contact other victims, make shared evidence doc
□ File IC3 report (all victims)
□ Report wallet on Chainabuse + Scam Alert
□ Do reverse image search on profile photos
NEXT:
□ File with Palestinian Cybercrime Unit (in person)
□ Email Tether compliance with evidence
□ Monitor wallet for movement (check Tronscan weekly)
Remember: You’re not just trying to get your money back. Every report you file helps protect the next person. The scammer did this before you, and they’ll do it after — unless they get caught.
Good luck. The 1Hack community has your back. 
Scammers love crypto because it’s “untraceable.” Tronscan disagrees.
The blockchain never forgets — make sure it remembers you fighting back.
Friend Got Cloned on WhatsApp — 900 USDT Gone in Minutes
Situation-Summary: Social engineering scam using cloned identity stole crypto — now hunting the ghost behind the number.
Why This Matters
The Scam (How It Went Down)
The Details
Steps 4-6 (reports) — filed Chainabuse/Scam Alert, waiting
YOUR ACTION CHECKLIST (Priority Order)
All Links
!