Recovery scams

What it is

A recovery scam is the second scam. It is aimed exclusively at people who have already lost money to the first one, and it works because it arrives at the precise moment when someone wants very badly to believe that the loss is reversible.

The offer is help. A blockchain investigator who can trace your coins. A law firm that has been given your case by the FBI. A government agency that has recovered a pool of funds and needs to verify your identity to release your share. Sometimes it is the platform’s own “compliance department”, writing to explain that your withdrawal can be released after one final payment.

What makes it land is that the caller already knows things. They have the amount. They have the date. They know which platform you sent to. The FBI includes exactly this — “having knowledge of the exact amounts and dates of previous wire transfers and the third-party company where the victim previously sent scammed funds” — in its list of red flags, because that knowledge does not come from an investigation. It comes from the first scam’s own records, and victim lists get sold and reused.

The scale is not marginal. In Canada, which breaks this out as its own reporting category, losses to recovery approaches rose from C$1.7 million in 2021 to C$21.9 million in the first nine months of 2025 alone. In the United States, victims further exploited by fictitious law firms reported more than $9.9 million lost in a single twelve-month window.

How it actually works

1. The first loss creates the target

   Money goes. Somewhere there is now a record: your name, the amount, the date, the platform, your contact details. That record is an asset, and it circulates — sold between operations, reused by the original one, occasionally reconstructed from a public complaint.

2. Contact arrives, usually within weeks

   By email, by social media, through an advertisement in the comments under a video about crypto losses, or through a search result for “recover stolen bitcoin”. Some victims are approached; others go looking and find a site built to be found by people going looking.

3. They demonstrate knowledge of your case

   This is the hinge. The exact figure, the exact date, the name of the platform. It reads as proof that a real file exists somewhere with your name on it.

   Where it could have stopped

   Specific knowledge of your loss is not evidence of an investigation. It is evidence that whoever is calling has access to the first scam’s records. Treat detail as a warning sign here, not a reassurance.

4. An authority is borrowed

   A law firm, with letterhead and an insignia — sometimes a real firm’s, which harms them too. An affiliation with the FBI, the Consumer Financial Protection Bureau, or a foreign regulator. Sometimes the regulator is invented outright: the FBI names the “International Financial Trading Commission” as one that does not exist.

5. The fee, framed as procedure

   Never called a fee for the recovery itself. It is a retainer, a tracing fee, back taxes owed on the recovered amount, a compliance deposit, or a requirement to open an account at a named foreign bank whose website turns out to be theirs. Payment is asked for in cryptocurrency, prepaid cards or transfer — the rails with no reversal.

6. A report, or silence

   Either the contact stops after the first payment, or you receive a tracing report that is incomplete or wrong, accompanied by a request for a further fee to complete the recovery. Some victims pay through several rounds of this.

Why it works

It arrives at the worst possible moment for judgement. A recent large loss produces exactly the state in which people make bad decisions: distress, urgency, shame, and a strong desire for the situation to be undone. Every scam exploits emotion; this one exploits an emotional state that a previous crime manufactured.

The knowledge feels like proof. Ordinary scepticism asks “how would they know that?” — and the answer, “because they have my file”, is both available and wrong. It takes a deliberate second thought to arrive at “because they have the scammer’s file”, and that second thought is what the timing is designed to prevent.

It borrows authority that is genuinely trustworthy. Lawyers, the FBI, financial regulators. These are the institutions someone in this position should be turning to. The scheme does not have to overcome scepticism about authority; it rides on justified trust in it.

Shame keeps the second victimisation quiet. People who have been taken twice report at a lower rate than people taken once, which is why the measured figures here are almost certainly further from reality than most on this site.

The fee is always small relative to the loss. A few thousand to recover several hundred thousand reads as an obviously good bet. The framing is deliberate: it converts a further loss into what feels like a rational investment.

And a real version exists. Assets genuinely are seized. Exchanges genuinely do freeze deposits. Civil recovery genuinely happens. The scheme is parasitic on a real process, which is what stops “no one can ever get money back” from being useful advice.

Where it comes from

Recovery fraud does not have a distinct geography of its own, and this page will not invent one. It follows whatever fraud came before it: the operations that hold the victim lists, or whoever those lists were sold to.

What is documented is the pattern of imitation. The FBI’s advisories describe impersonation of US law firms, of the FBI itself, of the Consumer Financial Protection Bureau, and of foreign banks whose websites are reconstructed convincingly enough to accept a registration. The 2026 update adds AI-generated video used to produce promotional material for the fake service, and spoofed sites built to harvest whatever the visitor types into them.

Two of those developments matter for how you should read evidence now. A professional-looking website is no longer weak evidence of legitimacy — it is no evidence at all. And a video of someone who appears to be an agent is not evidence either. What remains reliable is the direction of contact: who found whom.

Real cases

Red flags

• They contacted you. This is the whole thing. Legitimate recovery starts with you contacting your bank, your national agency, or a lawyer you found. Nobody credible arrives unbidden offering to get your money back.
• They know the exact amount and date you lost. Listed by the FBI as a red flag, not a credential.
• A fee is required before anything happens. A retainer, a tracing fee, taxes on the recovered sum, a compliance deposit. Every version is an advance fee.
• They claim to work with the FBI, the CFPB, or any government agency. There are no law firms that are official partners of US government agencies.
• They reference a regulator you have never heard of. Look it up independently. Some of them do not exist.
• You are asked to pay in cryptocurrency or gift cards. No government body and no genuine law firm bills this way.
• You are told to open an account at a bank they name, at a domain they gave you, to receive the recovered funds.
• They found you right after you said you would report it. The announcement is the trigger.
• A guarantee. Real recovery is uncertain and slow. Certainty is a sales technique.
• They ask you to “verify your identity” with banking details or documents before anything is returned.

If it’s happening to you

If you have not paid yet. Stop the conversation. You do not need to establish whether they are genuine — you only need to notice that they contacted you and want money up front, which is sufficient. Screenshot everything first: the profile, the messages, the website, the firm name, the wallet address or account details. Then report it as a new incident on top of your original report.

If you have paid. Move today.

1. Call your bank’s fraud line and say a second fraud has occurred. Card payments in particular may still be chargeable back.
2. If it went to crypto, send the transaction hashes to the receiving exchange immediately.
3. Report it separately from the original scam. It is a distinct offence, and reporting both is what lets agencies connect the two operations. See where to report.
4. If a real law firm was impersonated, tell them. They will usually want to know, and it helps them warn others.
5. Expect a third approach. Being taken twice moves you up the list, not down it.

If you are looking for help and have not been approached. The safe routes all begin with you: your bank, your national reporting agency, your financial regulator’s complaints process, and — if you want legal advice — a lawyer found through a bar association or a regulator’s register, engaged on ordinary terms with a fee agreement you can read. Ask directly whether they will take payment only from recovered funds; the answer is informative.

What not to do. Do not pay one more fee to release funds that have already required several. Do not send identity documents to anyone who contacted you. And do not conclude from any of this that your original report was pointless: reports are what produced the FBI advisories this page is built on.

Where the money goes

The money trail here is shorter and colder than in the scam that preceded it. There is no fake platform to maintain and no relationship to sustain, so the fee typically goes straight out — to a crypto address, a mule account, or a card payment through a processor that will be abandoned. Nothing is bought, no service is performed, and there is no balance anywhere with the victim’s name on it.

Because the sums are smaller and the rails are the same ones the first scam used, recovery proceeds tend to be laundered alongside the primary fraud’s takings rather than separately.

By the numbers

No agency publishes a line item for most of the schemes on this site, so these charts show the official categories that contain this scheme. Each series is labelled with the agency's own category name. See how the mapping works.