Who owns the crime report? Scam reporting portals and the case for public infrastructure
Reporting a crime is one of the oldest public functions there is. When the crime is a crypto scam, however, the first place a victim is likely to land is not a police station but a private reporting portal, run by a blockchain analytics vendor and pitched as a public good. A second investigation by Rachel Wolcott for Compliance Corylated, “Private crypto scam reporting portals pitched as public good; crime victims call it data harvesting”, examines what that arrangement means for the people who use it. Our earlier commentary looked at the privacy law dimension of the same story; this piece looks at a different question. Who should own the reporting layer of crypto crime, and what should the people who report be entitled to expect in return?
The scale is not trivial. The article counts some 1.25 million reports on one vendor-run portal since 2022 and close to 685,000 on another, alongside a community anti-scam organisation whose reports flow to a third vendor. Each portal describes itself in the language of victim support: a free, accessible place to document what happened, a report that can be taken to the police, a flag that may stop a wallet being used against others. The vendors’ representatives are candid, in the same article, that they do not assist with fund recovery of any kind, and that attribution of addresses to categories of activity is their “secret sauce”. Victims’ reports are, in other words, raw material for the product that the same vendors sell to exchanges, banks and governments, at a time when the two largest have between them booked tens of millions of dollars in public contracts and raised capital at valuations in the billions.
None of this is hidden, exactly. It is simply not what a victim sees at the moment of reporting. Nivie Kaul of Digital Defenders Group puts it bluntly: when people realise their life savings are gone, “they are not giving informed consent. They are pouring out the most intimate facts of their lives to anything that looks like help.” The victims quoted, whose names have been changed, describe discovering the commercial reuse of their reports as “a second layer of violation” and as being “victimised all over again, not just by scammers, but by the system at the precise moment victims are most vulnerable”.
What the reporting layer is for
Set the privacy argument aside for a moment and ask what a crime-reporting channel is supposed to achieve. It should get the report to an authority with the power to act. It should tell the victim what has happened to it. It should produce data that investigators, supervisors and researchers can rely on and that the person who supplied it can correct. And in aggregate it should make the crime it records rarer.
Measured against that, the picture the article paints is uncomfortable. Reports are forwarded to law enforcement in some cases and to networks of largely retired officers in others, with no systematic feedback to the person who filed them. Portals themselves warn that recovery is unlikely, and a recent US Department of Justice filing argues that victims who authorised the transfers themselves cannot even contest the forfeiture of seized funds. Meanwhile the FBI recorded over 180,000 cryptocurrency complaints in 2025, up by a fifth on the previous year, with losses of 11.3 billion dollars and more than 18,500 people losing over 100,000 dollars each. Millions of reports have been collected. The problem has continued to grow.
This is not an argument that the portals are useless, nor that the vendors act in bad faith. Only around 15 percent of victims report at all, and anything that lowers that barrier has value. It is an argument that a function this important has been allowed to grow up inside private products, on private terms, because no public, shared specification for it exists.
Standards as the alternative to enclosure
That is where the Open Blockchain Intelligence Standards (OBIS) initiative comes in, and from a different angle than in our previous piece. Two of the three OBIS focus areas speak directly to what a victim-reporting layer should look like. Regulatory reporting and supervision concerns how information about suspected criminal activity is structured, transmitted and acted upon by authorities, so that a report is a report wherever it is filed and does not depend on which vendor’s form the victim happened to find. Open analytics and research data concerns how address labels, attributions and typologies are documented, sourced and shared, so that a wallet flagged on the strength of a victim’s account carries its provenance with it and can be independently checked, challenged and, where wrong, corrected.
A reporting layer built to open specifications would not need to be run by a vendor at all. National authorities, financial intelligence units, consumer protection bodies and victim-support organisations could operate channels that speak the same language, feed the same investigative pipelines and remain accountable to the people who use them. Analytics vendors would still compete, on the quality of their analysis rather than on privileged access to victims’ accounts of their worst days. And victims would know, at the moment of reporting, what a report is for and where it goes, because the answer would be written down in a public document rather than in a licence clause.
OBIS is an open, vendor-neutral project. Its specifications are developed by contributors in public, on GitHub, and it is owned by no company and certifies no one. Three institutions promote OBIS and facilitate its development: ICI Bucharest, the Complexity Science Hub Vienna and the Blockchain Intelligence Professionals Association. None of them owns, controls or authors the standards; their role is to bring the community together and keep the work open. The invitation extends to the vendors whose portals are discussed in this article, to the public authorities that receive their reports, and above all to the victim organisations whose members have the most direct interest in getting this right. The specifications and the contribution process are at obistandards.org and github.com/obi-standards, and formal comments can be sent to [email protected].
One of the victims interviewed summarised the issue in four words: “Victims are not datasets.” A crime-reporting system worthy of the name would treat that as a design requirement, not a complaint.
Source: Rachel Wolcott, “Private crypto scam reporting portals pitched as public good; crime victims call it data harvesting”, Compliance Corylated, 2 September 2026 — https://www.compliancecorylated.com/news/private-crypto-scam-reporting-portals-pitched-as-public-good-crime-victims-call-it-data-harvesting/