">

Quick answer: A checklist scam is a social-engineering scheme that uses a neat verification, onboarding, or “due diligence” list to make a risky request look official. The list proves nothing about the sender. If it asks for money, cryptocurrency, gift-card codes, passwords, one-time codes, wallet access, or sensitive information, stop. Verify the offer using contact details you find independently, not the link, QR code, phone number, or email address in the message.

What is a checklist scam?

“Checklist scam” isn't a formal legal category. It's a useful description of a fraud tactic: the scammer gives you an organized set of steps so the request feels professional and safe.

The first steps may look harmless:

The dangerous demand is often buried among those routine tasks. After you've completed several steps, the sender may pressure you to continue because you've already invested time, money, or trust.

Real companies can use checklists for hiring, rentals, financial services, inspections, or account setup. The word “checklist” doesn't make a process legitimate, create a right to a refund, or provide a special dispute process. What happens after a payment usually depends on the payment method, timing, and whether you authorized the transaction.

Before you proceed, confirm who sent the list, why every step is required, and where your money or information will go.

How the scam usually works

A typical scheme develops in stages:

  1. An unexpected approach: You receive a message about a job, investment, rental, relationship, prize, or account problem.
  2. A trust-building document: The sender provides a checklist, guide, form, or “verification protocol” with official-looking branding.
  3. A small commitment: You're asked to click a link, join a chat, install software, or send a small payment.
  4. Escalation: The demands grow to include cryptocurrency, bank transfers, gift cards, identity documents, or wallet access.
  5. Pressure and isolation: The sender imposes a deadline or tells you not to discuss the opportunity with anyone else.
  6. Disappearance or another demand: The account vanishes, or you're told to pay an additional fee to release funds or recover the first payment.

A convincing logo, polished layout, or ten-step list doesn't verify the identity of the person asking for payment.

Checklist scam red flags

Pause before acting if one or more of these signs appear:

One sign can have an innocent explanation. An unexpected approach combined with pressure, secrecy, requests for account secrets, or an unusual payment method is enough reason to stop the process until you verify it.

Common checklist scam examples

Cryptocurrency and investment scams

A fake investment checklist may claim to help you qualify for mining, trading, liquidity pools, automated profits, or a private investment group. It may tell you to deposit cryptocurrency, connect a wallet, pay a supposed tax, or send a fee before withdrawing your “profits.”

The FTC's cryptocurrency scam guidance explains that cryptocurrency can be both the investment and the payment method. It also warns about supposed investment managers who contact people unexpectedly.

The FBI's cryptocurrency scam warnings cover schemes involving cryptocurrency ATMs and QR codes, decentralized finance, liquidity mining, and play-to-earn games. A checklist doesn't make any of these opportunities legitimate.

Job and task scams

A fake recruiter may send an “employee verification checklist” or daily task schedule. The list might request personal details, a training fee, a deposit, a purchase, or a transfer to unlock wages.

Before providing financial information, confirm that the employer and position appear on the company's official website. Then contact the organization through an address or phone number you found yourself and ask its human resources department whether the job, recruiter, and document are genuine. Don't use the contact details in the recruitment message as your only verification.

Romance and friendship scams

An online contact may describe a “trust” or “safety” checklist before asking for money, cryptocurrency, gift cards, or access to a financial account. The request may involve an emergency, travel problem, medical bill, frozen wallet, or supposed investment opportunity.

A checklist can't confirm a person's identity or intentions. Don't send money or financial credentials to someone whose identity and purpose you haven't independently verified through a trusted channel.

Rental, marketplace, and service scams

A fake landlord or seller may provide a property inspection checklist, purchase checklist, or booking form, then demand a deposit outside the normal platform. A fake technician may use a “security repair checklist” to persuade you to install remote-access software.

Verify the property, seller, service provider, and payment instructions separately. Don't let an unsolicited caller or pop-up control your device.

Gift-card payment scams

The FTC says scammers may create urgency and tell people to buy gift cards, then provide the card numbers or PINs. Its gift-card scam guidance makes the warning clear: a checklist or emergency story doesn't make gift-card payment legitimate.

If someone asks for a card number or PIN, stop. Don't send a photograph of the card, even if the sender says it is needed for “verification.”

How to verify a checklist safely

Use a verification process that doesn't depend on the sender:

  1. Pause the conversation. A deadline isn't a reason to skip basic checks. Tell the sender you won't proceed until you've verified the organization and the payment request.
  2. Save the evidence. Keep the message, checklist, sender details, website address, payment instructions, and screenshots. Don't delete the chat before you record the relevant information.
  3. Find the organization independently. Type the company's address into your browser or use a trusted statement, card, or prior account record. Don't rely on the link, QR code, or phone number provided by the sender.
  4. Ask a direct question. Contact the organization through its official channel. Ask whether the person, offer, document, and payment request are genuine.
  5. Examine the payment request. Cryptocurrency deposits, gift-card details, passwords, security codes, private keys, and recovery phrases are not safe ways to prove your identity. Treat a request for any of them as a stop sign.
  6. Get a second opinion. Show the offer to someone you trust before sending money or installing software. A scammer may say that outside advice will cost you the opportunity.
  7. Use a separate browser or device if needed. Never sign in to your bank or wallet through a link from the message. If you already installed software or allowed remote access, use a separate clean device to review important accounts.

Search results and social-media comments can reveal similar complaints, but they shouldn't be your only verification. Scammers can create fake reviews, copied websites, and group chats filled with supposedly successful users.

What to do if you clicked, shared information, or paid

Act quickly, but don't send more money to “fix” the problem. Anyone who promises to release funds, reverse a transaction, or recover a loss for an upfront fee may be running a second scam.

If you clicked a link

If you only opened the page and didn't enter information, download software, or approve a prompt, close it and stop responding. If you entered a password, change it from a device you trust and change it anywhere else you reused it. Sign out of active sessions, enable multifactor authentication, and review account recovery details.

If you installed software or gave someone remote access, disconnect the device from the internet and seek help from a trusted technician or your organization's IT team. Review financial and email accounts from a separate, clean device.

If you shared identity or account information

Tell the affected bank, card issuer, employer, or account provider what happened. Ask which security steps are available. Replace exposed passwords, secure your email account first, and monitor statements and account alerts.

If your Social Security number or other identity information was exposed, consider a credit freeze or fraud alert and use the federal IdentityTheft.gov recovery service.

If a cryptocurrency recovery phrase or private key was exposed, treat the wallet as compromised. If you still control funds, move them to a new wallet using a safe device. Never give the recovery phrase to someone who promises to retrieve your money.

If you sent cryptocurrency

Contact the cryptocurrency exchange or service you used immediately. Ask whether it can flag the transaction or take any available action. Recovery isn't guaranteed, particularly after a transaction has been completed.

Gather:

File a complaint with the Internet Crime Complaint Center's cryptocurrency reporting page. The IC3 also provides a direct complaint route. A transaction hash can help investigators trace activity, but it doesn't guarantee that funds will be recovered.

If you used a bank account, card, wire, or payment app

Call the bank, card issuer, or payment provider using the number on an official statement or card. Explain exactly what happened and ask whether the payment can be stopped, recalled, or disputed.

Be precise about whether you approved the payment yourself or whether someone made it without permission. The payment rail, timing, and transaction details can affect the provider's review. Don't assume a refund is automatic. Keep the claim number and all written responses.

If you bought a gift card

Contact the gift-card issuer immediately using its official customer-service information. Keep the card, receipt, and messages. Tell the issuer that the card was obtained through a scam and ask what action is available. Report the incident using the FTC's gift-card reporting guidance.

Where to report the scam

Reporting won't guarantee a refund, but it can preserve useful information and help connect related complaints. The routes below are for U.S. consumers:

Keep every confirmation number. If the scam involves threats, stalking, or immediate danger, contact local law enforcement.

Watch for recovery scams

After a crypto or investment loss, you may be contacted by someone claiming to be a lawyer, investigator, blockchain expert, or recovery company. The person may promise to retrieve the money for an upfront fee.

The IC3 has warned about companies falsely claiming they can recover cryptocurrency lost in investment scams. Don't pay a recovery fee, share your wallet recovery phrase, or give remote access to anyone who contacts you unexpectedly. Verify any professional through an independent official directory before discussing the case.

Questions consumers often ask

Are all verification checklists scams?

No. Real companies may use checklists for onboarding, inspections, account setup, or compliance. Look at where the list came from, whether the sender is applying pressure, and whether it demands secrets or an unusual payment. Confirm the process through an official channel before proceeding.

Can I get cryptocurrency back after a checklist scam?

Possibly, but there is no guaranteed recovery route. Contact the exchange or service used to send the funds and file a detailed IC3 complaint as soon as possible. Don't send additional money to release or recover the original transfer.

What if I approved the payment because I was deceived?

Tell the bank, card issuer, or payment provider that you were deceived and describe the events accurately. Ask which dispute or fraud-review process applies. The available options depend on the payment rail, timing, provider, and transaction details.

What's the safest response to a suspicious checklist?

Stop communicating, preserve the evidence, and verify the organization through a contact method you find yourself. If money or sensitive information has already been sent, contact the relevant provider immediately and report the scam.