"Have you been scammed?" The recovery message, and what happens after you reply

A message arrives on WhatsApp from a number you do not know. It asks whether you have been the victim of a scam, and says a fund or a team can recover the money. If you have in fact lost money, the timing is uncanny. This post walks through what regulators say happens next, step by step, and where the sequence ends.

One limit first. We did not find a regulator’s warning about a scheme with the exact name “Victims Fund Recovery”. What is documented is a family of approaches that offer recovery or compensation to people who have already been scammed, sold under different names. The FTC, the FBI, the UK’s Financial Conduct Authority, the UK’s Financial Services Compensation Scheme, Australia’s Scamwatch and the North American Securities Administrators Association each describe pieces of it. The sequence below is assembled from those descriptions, and where a step comes from one agency only, we say so.

For the general mechanism, see our recovery scams page. This post follows one victim through the process.

Step 1: the opener is a list, not luck

The message does not find you by accident. The FTC says refund and recovery scammers “buy lists of people who’ve already been scammed, hoping they can be scammed again.” Its consumer advice page describes those lists as holding names, addresses, phone numbers, the type of scam and the amount lost. That is why the message can be so specific, and why a scammer who knows your loss looks like an insider.

The FTC lists phone, email, text, social media messaging and physical mail as contact routes. The UK’s compensation scheme, the FSCS, adds WhatsApp and Telegram messages and cold calls to its own list of impersonation routes, and the FCA reports approaches by phone, text, email and WhatsApp. The FBI describes a trigger: after a victim realises they are being defrauded and tells the scammers they will report them to the FBI, a fake “FBI agent” makes contact. It also says almost all complainants reported that the scammers claimed to have recovered their lost funds or offered to help recover them.

Step 2: a real-sounding institution

The sender is not “a recovery scammer”. The sender is a body you would trust. The FTC says the caller may claim to be a government agency, and even the FTC, a consumer advocacy group or a law firm. The FCA says a common version claims the regulator has recovered funds from a crypto wallet opened in the victim’s name, and another targets loan-scam victims by saying the FCA can help them get their money back.

Compensation funds are a natural costume because real ones exist. California runs a Victims of Corporate Fraud Compensation Fund, and the state’s Secretary of State has had to warn about phishing emails promising “fraud compensation awards”. The US Department of Justice returns forfeited money to victims through a process called remission. The scam borrows the vocabulary of those systems.

In July 2026 the FBI warned that this borrowing now includes video. It described AI-generated video of senior FBI officials promoting spoofed reporting websites, and fake FBI profiles on Facebook Messenger, with the impersonator communicating over Telegram and Messenger. NASAA, the US state securities regulators’ association, also reports deepfake videos, testimonials and scripts customised to a victim’s preferred language.

Step 3: your details are taken

Next comes verification. The FBI describes spoofed IC3 complaint sites that ask for a name, phone number, email, type of scam and estimated loss, then issue a reference number that implies follow-up contact. It also describes an impersonator sending a link to “update” a report you filed. The FTC describes a related move: asking for financial information under the pretence of depositing a refund.

Two agencies describe something more invasive. The FSCS lists requests to share a screen or download software such as AnyDesk among its red flags. Scamwatch lists remote access to your device among the things scammers ask for.

The FSCS also flags reference numbers as a tell: any reference to a “URN” (unique reference number) or a “CRN” (customer reference number) is, in its words, a warning sign.

Step 4: the fee, renamed

Every version arrives at money. What varies is the label. The FTC lists “retainer fee”, “processing fee” and “administrative charge”. The FSCS lists upfront payments, and fees for a “Trade Reference Licence” or for anti-money-laundering compliance. NASAA lists charges for “forensic searches” and “regulatory filing services”, typically demanded in cryptocurrency. Scamwatch lists fees, a percentage of the recovered money, and tax payments.

The FTC’s page names the payment methods: cash, gift cards, cryptocurrency, wire transfers, payment apps. Payments made that way are generally hard to get back, and the FTC says legitimate organisations will never ask for money to help you get a refund.

Step 5: it does not stop at one payment

This is the “what happens next” the message leaves out. NASAA describes the typical progression as an upfront fee, then pressure from relentless follow-up over weeks or months, then multiple escalating payments. Scamwatch lists a request for additional funds for “investigations” as a warning sign, and lists testimonials from other supposed victims who were helped.

NASAA adds a bait-and-switch in some cases: worthless fake cryptocurrency tokens that mimic legitimate assets. The FCA’s breakdown by age shows who is being reached. Nearly two-thirds of the reports in the first half of 2025 came from people aged 56 or over, and 480 victims were tricked into sending money. For all of 2024 the FCA counted 10,379 fake-FCA reports and 991 victims who lost money.

Step 6: the ending

The sources do not describe a single ending. They describe repeated requests for more money (NASAA and Scamwatch), fabricated documents (the Coin Dispute Network allegations below), and misuse of the details you handed over: the FTC warns that “if you pay, they’ll steal your money”, and that if you share your information “they might steal your identity”. The lists in Step 1 are the reason a second approach can come at all.

A named case: the service version

Not every version starts with an unsolicited message. In August 2024 the Manhattan District Attorney and Homeland Security Investigations announced charges against Michael Lauchlan over a website called Coin Dispute Network. In May 2025 the office announced additional charges against him and a second defendant, Gary Zaydman. Prosecutors allege the site used fake testimonials and fabricated tracing reports, and that more than 200 customers reported no recovery at all. These are allegations, both men are presumed innocent, and we found no plea or verdict in the sources reviewed. Our case page has the details.

What a real compensation process looks like

The contrast is the most useful test. The Department of Justice says it and its remission administrators “will never ask for payment to participate in or receive funds from the remission process”, and that genuine contact comes from an administrator or from government representatives you have already dealt with. The FSCS says it is “completely free to make a claim”. The FCA says it will never ask you to transfer money to it. The FBI says IC3 “does not maintain a social media presence and does not investigate crimes or recover funds through Facebook, Telegram, or similar platforms.”

NASAA is the bluntest. For crypto losses specifically, its advice is to accept that “it’s unlikely that you will recover your lost crypto assets.” That is not a reason to give up on reporting. It is a reason to treat any promise of recovery as the thing being sold.

If you have already replied

The regulators’ advice is consistent, and none of it depends on knowing who the sender was.

• Stop and do not pay. Reject any upfront fee, whatever it is called. The FTC’s advice is never to pay in advance for refund help.
• Check independently. Look up the agency or fund yourself and use the number you find, not the one you were given. The FBI advises typing the address of the real IC3 site yourself.
• Call your bank if money or details have gone. Scamwatch’s advice for a scam of this kind is to contact your bank immediately, report to police and change passwords, and in Australia to contact the identity support service IDCARE on 1800 595 160.
• Report the recovery attempt as its own incident, in addition to the original loss. In the US that means the FTC and the FBI’s IC3; in the UK see the UK page, and in Australia the Australia page. NASAA also points crypto victims to their state or provincial securities regulator.
• If you gave anyone access to your device, change your passwords, as Scamwatch advises, and do not share device access with anyone who contacted you first.

What we could not verify

We found no loss data for this specific WhatsApp variant. The FCA’s figures are for fake-FCA scams in general, not compensation-fund approaches. The order of the steps above is assembled from several agencies, in different countries, describing overlapping schemes; no single case file documents every step for one victim. And the Coin Dispute Network case is charged, not decided.

Those limits do not change the practical test, which every source here shares. Legitimate recovery and compensation start with you, or with a case you already know about, and they never ask you to pay to be paid.