The first window

In matters where the client reaches us inside the first day or two, the conversation we have at intake is structurally different from the conversation we have when the same client reaches us six weeks later. Both calls cover the same questions — what happened, who was paid, where the money went — but the answers we are likely to get back from the systems we work through are not the same. The early window is short, and most of what we can do at intake depends on what is still recoverable at the time the client calls.

This piece is about what the early window changes, why it changes, and what a client can do during it without making a different problem worse.

Why the first window matters

A typical investment or crypto-fraud loss reaches its final position over a sequence of transfers. The original deposit moves from the client's bank or brokerage to a receiving institution that is, in most files we look at, not the platform itself. From there, the funds are moved again — sometimes within hours — to a second account or wallet, often in a different jurisdiction, and from that point onward the trail diverges quickly. By the time a client recognises something is wrong, the money is rarely sitting where it first landed.

What the early window offers is the period before that second movement is fully complete. For wires to receiving banks, the freeze and reversal mechanics that exist within the banking system are most likely to engage when the receiving institution still holds identifiable funds and the originating bank has not yet treated the matter as closed. For crypto deposits, the early window is the period before the destination wallet has been emptied through a mixer, an exchange swap, or a chain bridge. Neither window stays open indefinitely; both narrow rapidly within the first two to three weeks and close meaningfully after the first month.

This is the operational reason we ask clients to call early. It is not a marketing point. The work we can do inside a 48-hour window and the work we can do inside a 60-day window are different work, and we tell clients which one their file is likely to be.

What we ask in the first call

The first intake conversation is not designed to extract the client's whole story in detail. It is designed to identify, quickly, the few facts that determine whether the case is one where the early-window mechanics can still apply.

We ask: when did the most recent transfer leave the client's account, and through which institution. We ask whether the client has the transaction reference numbers, the receiving account details, and any platform correspondence that names a destination. We ask whether the client has paid further amounts after recognising something was wrong — re-verification fees, "release" charges, AML-clearance requests — because the answer changes both the case profile and the urgency of the documentation work.

We do not, in the first call, ask the client to retell the manipulation story in detail. That part of the file is important; it is not what determines the immediate next action. The first conversation focuses on the timeline, the trail, and the documents the client still has access to.

What changes in 72 hours

The single largest change inside the first 72 hours, in our experience, is the platform's posture. While the client is still believed by the platform to be a paying customer, the platform's communication channels are open: the dashboard loads, the contact responds, screenshots can be taken, terms-of-service PDFs can be downloaded. Once the platform's operators conclude that the client cannot be moved further through the fee-stack — typically once a fee request has been refused or the client has named the operation as fraud — those channels begin to close.

Email replies stop. WhatsApp accounts go dark. Dashboards become inaccessible. Within several weeks, in many files, the platform domain itself stops resolving and the marketing material disappears from the open web. The materials a client is still able to capture in the first 72 hours are materials they may not be able to capture at all in 30 days.

This is why, at intake, the first concrete request we make is not legal: it is preservation. Full screenshots of the dashboard, complete chat exports including phone numbers and display names, all email correspondence including headers, every transaction confirmation. The window during which these are easy to collect is short; the window during which they are useful is long.

What we ask clients not to do

The first window is also when most of the avoidable damage to a file occurs. The pattern is recognisable. A client who has just realised something is wrong receives a contact, often within days, from a "recovery agent" or a "blockchain investigator" claiming to be able to retrieve the funds for an upfront payment. The contact details are sometimes professional. The fee is framed as small relative to the loss. The pressure to engage quickly is high, because the agent emphasises that the trail will go cold.

The trail does go cold, but the second contact is, in nearly every file we have seen, a continuation of the first operation. The lead list has been passed forward. Engaging the second contact extends the loss without improving the file.

We tell clients, in the first call, not to engage with any party offering recovery in exchange for an upfront payment. We tell them not to send a "test transaction" to anyone, not to share their wallet recovery phrase under any framing, and not to pay any further fee structured against an account balance they cannot withdraw. The first window is the time when these requests are most likely to come in; the early-call conversation is, in part, designed to make the client recognise them.

What the early window cannot do

There is a version of the early-window framing that overstates what is possible. We try to be careful with that. Calling within 48 hours does not, on its own, change the outcome of a file where the receiving counterparty is in a jurisdiction with limited cooperation, where the funds were taken in a privacy coin, or where the documentation the client has is too thin to support a request to a payment intermediary.

Early intake improves what is possible for files where the underlying mechanics can still operate. It does not create those mechanics where they are not present. We say this in the first call, because the alternative — letting a client hope into a file that does not support the hope — is not a service.

What the early window does, reliably, is preserve optionality. The same file that has six options inside the first week has two by the end of the first month. The work we do at intake is the work that takes a six-option file and lets the client choose between them. Most of the rest is preservation, communication, and the careful narrowing that happens as each option either holds up or does not.

The shorter version: call early, document everything, engage no one offering recovery for an upfront payment. The longer version is the one above, with the front-end pattern of the funnel set out separately.