The number in the headline and the number that comes back: what five cases show about fraud loss and recovery

A prosecution announcement usually leads with one number. Read the underlying court filing or settlement order, and there are often three: what was allegedly taken, what a defendant is actually held to owe, and what has actually been recovered. Those numbers are not close, and the gap between them is not a rounding error; it is a fairly consistent pattern, visible across cases this site has already documented in fraud categories that have nothing else in common.

Intended loss is a sentencing concept, not a recovery

Federal sentencing guidelines calculate a defendant’s exposure using “intended loss”, what the scheme was designed to take, whether or not it succeeded. That number drives the sentence. It is a different number from what a court later orders as restitution, which is tied to losses that can actually be documented and attributed.

Roosevelt Gulley, sentenced in Sacramento for filing 79 fraudulent California unemployment claims using stolen identities, was ordered to pay $575,425 in restitution against an intended loss exceeding $1.5 million, roughly a third of what the scheme was built to extract. Michael Griffin, who ran a fake credit-repair operation that manufactured synthetic identities to open and max out accounts at Synchrony Bank, Capital One and Discover, was held accountable at sentencing for intended losses and fraudulent gains exceeding $3.4 million, but restitution, the amount tied to identifiable losses, was set at $412,885.17. Roughly one dollar in eight.

Neither gap is a failure of prosecution. Both cases ended in a guilty plea and a prison sentence. The gap is what happens between an application being filed and money actually clearing: a state agency’s fraud controls catch some claims before a card is mailed; a bank freezes an account before a balance is drawn down. The application volume and the successful cash-out are, structurally, two different numbers.

Claimed, paid, and prevented are three different numbers

The scale changes, but the pattern repeats almost exactly in the 2025 national health care fraud takedown, the largest in Justice Department history at $14.6 billion in alleged fraud across 324 defendants. Inside it, Operation Gold Rush allegedly used the stolen identities of more than one million Americans to bill Medicare roughly $10.6 billion for catheters and other equipment. Medicare actually paid about $900 million of that, roughly 8.5 cents on the claimed dollar, and HHS-OIG and CMS say they prevented about $4.41 billion more before it went out the door. A separate Illinois scheme allegedly used AI-generated recordings of beneficiaries’ fabricated consent to claim $703 million; about $418 million was paid.

Claimed, paid and prevented get collapsed into a single headline figure in most reporting, and they answer different questions. Claimed is the criminal’s ambition. Paid is what a victim, here, the Medicare trust fund, actually lost. Prevented is a measure of how well the control worked before the money moved, the same mechanism that stopped roughly two-thirds of Gulley’s intended $1.5 million from ever reaching an ATM.

After the money moves, recovery gets harder

The health care and unemployment cases show controls stopping money before it leaves. The picture changes once funds have actually reached the fraudster, recovery becomes rarer and slower.

The clearest statement of this on the site is in the Tether forfeiture case: a June 2025 civil forfeiture complaint against 679,981.22 in Tether traced to a romance-and-investment scheme that reached two identified victims, one through LinkedIn and one through the dating app Coffee Meets Bagel. Civil forfeiture, a case brought against the property itself, which is why no defendant is named, is, as that case notes directly, “one of the few genuine routes to recovery” for victims. But it only works on funds that have already been traced and frozen, and it reaches a small fraction of what victims of this scheme collectively lose. It worked here specifically because Tether transactions sit on a public ledger, the same trait, incidentally, that let prosecutors move on Prince Group’s $15 billion in bitcoin: money is only forfeitable once it is found, and it is only found if it was never converted into something a ledger can’t see.

The IM Mastery Academy settlement shows the same pattern on the civil-enforcement side. The FTC and Nevada’s Attorney General alleged the trading-education MLM took more than $1.2 billion from consumers since 2018 through false earnings claims, internal company data the FTC cited showed some 60% of customers stopped paying within a month and 90% within six. The May 2026 settlement produced a $795.8 million judgment, but the five defendants were required to surrender just under $90 million in assets, homes, cars, a yacht, jewellery, against it, with the FTC expecting more than $100 million once other defendants’ payments are counted. That is roughly eight cents recovered for every dollar the FTC alleges was taken, and it counts as a win, because the assets had to be physically identified, valued and seized rather than simply owed.

Why report speed is the whole lesson

Across all five cases, the mechanism is the same regardless of the type of fraud: money that is still sitting somewhere identifiable, an unmailed benefit card, an unconverted stablecoin balance, an asset titled in a defendant’s name, can be stopped or clawed back. Money that has already been withdrawn at an ATM, spent, or laundered through layers of accounts generally cannot. That is the entire reason victim-facing agencies push for immediate reporting: the window in which a loss is still “frozen funds” rather than “restitution owed” is short, and it is the only part of this process a victim has any influence over. It is also why anyone who contacts a past victim promising to recover funds for a fee is almost certainly running a second scheme, see this site’s recovery scam page, because by the time that call comes in, the money each case above describes has, in the large majority of instances, already gone.