Assets & Risk
Crypto Withdrawal Tax or Unlock Fee: Check Before You Pay
Asked to send more money before you can withdraw crypto? Check the fee, the recipient, and the evidence, then protect your accounts and report a payment you suspect was fraudulent.
If you must send fresh money as a “tax,” security deposit, or unlock fee before withdrawing crypto, stop the payment and verify the demand independently. A private support address, a new charge after each payment, or a deadline to avoid losing everything are reasons to treat the situation as suspected fraud. Withdrawal costs can be legitimate; the label on a charge proves very little.
This guide is for someone who can see an account balance but is being told to pay again to access it. The question is who is charging you, what the charge covers, and whether a source outside the conversation can confirm it.
A small successful withdrawal does not validate the whole account
The FBI's IC3 investment-fraud guidance describes schemes that allow early withdrawals to build confidence, then demand taxes or fees when the victim wants to take more out. A payment you received proves that particular payment arrived. It does not prove the remaining balance exists or can be withdrawn.
Screenshot of the public IC3 guidance, captured September 15, 2026. The warning concerns advance payments and small-withdrawal bait; it is not an allegation against any particular exchange.
A dashboard is not proof of funds. Even on a legitimate service, USD portfolio value differs from withdrawable cash. On a suspicious site, the displayed principal and profit need independent verification too. A return chart or another user's payment screenshot cannot replace your own transfer and receipt records.
Separate four kinds of payment request
| What you are being asked to pay | What to verify | When to stop |
|---|---|---|
| Exchange withdrawal fee | The asset, network, amount, fee, and net receipt in the genuine service you reached independently | The quote exists only in chat, or payment goes to a separate “support” address |
| Self-custody network fee | Your intended transaction, the correct network, recipient, and fee estimate in a trusted wallet | You must pay a stranger, connect to an unfamiliar site, or approve an unreadable permission to “top up gas” |
| Tax or withholding | The jurisdiction, formal documentation, recipient, and basis, checked with the relevant tax authority or a qualified professional | A chat message, threat, or supposed tax certificate is the only basis for an immediate crypto payment |
| Unlock deposit or recovery charge | The actual service involved and confirmation through a channel you found independently | Payment supposedly guarantees release, or every payment produces another condition |
“All withdrawals are free” and “all tax requests are scams” are both poor rules. A padlock icon, corporate logo, or polished support desk does not establish legitimacy either. Verify the basis and recipient; if you cannot, do not pay.
For example, Ethereum network fees are paid in ETH. A standard self-custody transaction may therefore require ETH in the sending wallet. That does not justify funding a suspicious investment site or paying someone who promises to unlock it. Other networks, fee-sponsorship arrangements, and exchange charges differ. If you actually use Binance, our withdrawal fee and net-receipt checks provide a platform-specific example.
Four checks for the demand in front of you
Where did it appear? Preserve the original message, website address, and time. Do not sign in through the sender's link. Use an independently verified website, bookmark, or app. If a stranger introduced you to the investment site itself, its own customer support is not independent confirmation.
Which record does it match? Compare the withdrawal reference, asset, network, amount, fee currency, and payee. A claim about an inadequate “risk score” without an independently verifiable process is insufficient. Do not send another test payment to establish trust.
What does the evidence actually prove? Your successful deposit transaction shows where that transfer went, not that an investment earned a profit. If someone supplies a withdrawal transaction hash, compare its network, asset, amount, and destination with your own receiving details. Another person's transfer does not establish a payment to you. An internal order number is not necessarily an on-chain transaction ID.
Who confirms receipt? Check your own bank or trusted receiving platform for funds that have actually been credited and are available. For self-custody, verify the asset on the correct network. A screenshot or “completed” message does not replace receiving-side records. If you cannot reconcile the evidence, leave the outcome unconfirmed and stop adding money.
If you have already paid
Do not make a second payment to rescue the first. The FTC's cryptocurrency-scam guidance notes that crypto payments are typically irreversible and recommends reporting to the exchange used to send the money. Prompt reporting may preserve an opportunity to act; it is not a refund guarantee.
- No payment yet: preserve the demand and stop interacting. Do not disclose passwords, verification codes, a recovery phrase, or remote access.
- Money sent through a bank or exchange: independently contact the sending institution, explain the suspected fraud, and provide the transaction references. Ask whether that specific payment can still be intercepted, flagged, or disputed. Be accurate about any payment you authorized yourself.
- Credentials or access also exposed: use a trusted device to secure your email and affected accounts, end unfamiliar sessions, and revoke compromised access credentials. Binance users can follow our account-compromise response guidance; other services require their own official procedures. Changing an account password does not fix an exposed wallet seed phrase or private key. Do not use a “safe wallet” supplied by the person demanding payment.
If collecting documents would delay stopping active account misuse, secure access first. Record whether secrets were exposed; do not paste the secrets themselves into a report or evidence list.
Preserve evidence, report, and avoid a second approach
Build a short timeline: how contact began, the website involved, the other party's identifiers, each reason for demanding more money, and each payment's date, time zone, asset, network, amount, destination address, and transaction hash. These transaction details are among the information IC3 asks cryptocurrency victims to preserve.
Keep original records securely. Redact account details, email addresses, authentication information, and internal URLs from screenshots you share publicly. Do not post a complete evidence package to recruit a “recovery expert.”
Report to local police or an appropriate fraud-reporting authority and notify the sending institution. IC3 is a US reporting channel; its FAQ says non-US citizens may also submit cybercrime complaints. This does not replace local reporting or guarantee an investigation, a response, or recovery.
The immediate task is complete when additional payments have stopped, affected accounts are protected, evidence is preserved, and reports are submitted. Recovery remains a separate, unconfirmed outcome. If someone later says your funds have been found but require a release payment, do not pay or hand over access. IC3's warning about fraudulent recovery services describes repeated upfront charges and false claims of ties to law enforcement.
Checked against the primary sources above on September 15, 2026. This is general fraud-identification and reporting guidance. Specific tax obligations, service charges, and recovery options require verification for the jurisdiction and case involved.