Public blockchain data only — we never ask for seed phrases, private keys or upfront fees.
No wallet data stored Runs in your browser
All 20 guides
Scam types 2026-09-20 · 4 min read

Recovery Scam: How the Second Fraud Works and How to Spot It

A recovery scam targets people who have already lost money. Learn the four opening scripts, the seven proof-of-legitimacy demands almost none can meet, and why any upfront fee is the fraud itself.

Recovery Scam: How the Second Fraud Works and How to Spot It — illustrated hook

They Knew My Case Number. They Were Reading My Own Post.

How a second fraud finds you — and the seven questions almost none of them can answer.

Safety note: we never guarantee recovery and never ask for seed phrases, private keys, crypto payments or upfront unlocking fees. Anyone who does is running a second scam.
The short version

What this guide says in 5 lines

  • No private service can reverse a blockchain transaction. There is no technical mechanism for it.
  • The recovery scam depends on urgency, secrecy and an upfront fee — all three together.
  • Being contacted first is itself the strongest available warning sign.
  • A legitimate firm has a registration, a licence and an office you can verify independently.
  • Your own report with real evidence does more than any "recovery agent" you will ever be offered.

A recovery scam is the same fraud, run a second time on the same person. It works because the first loss created exactly the conditions it needs: urgency, a willingness to pay for hope, and a list of confirmed victims circulating among the people who took the money. This guide shows the four opening scripts, the questions that separate a real firm from a fabrication, and the one rule that ends the entire category.

Why you are being contacted, and by whom

When you report a loss, post about it, or join a victim support group, your details become visible to a predictable audience: the operation that took the money, and others who buy victim lists from each other. Contact after a loss is therefore not surprising — it is expected, and it usually arrives within days.

This is why "how did they know about my case?" is the wrong question. The right one is why a firm you have never heard of would spend its own time finding you, rather than waiting for clients to find it.

A genuine law firm or analytics company does not cold-contact victims of a fraud it was not already engaged on. Being approached first is a structural warning sign, not a compliment.

The four opening scripts

Nearly every recovery approach uses one of these four framings. They are designed to answer the one question a cautious victim asks — "how can you get my money back?" — before it is asked.

Notice that each one explains why this firm can do the impossible, using a mechanism nobody can check.

Recovery approaches, their claimed mechanism, and the honest translation
OpeningClaimed mechanismHonest translation
"Recovery specialist"They can get it back for a fee, or a percentageNo one can reverse a blockchain transfer. The fee is the only money that moves.
"Cyber investigation agency"Official-sounding tracing for a retainerTracing is free and public. A retainer buys you work you could do yourself.
"Legal firm"A demand letter, for a court fee paid upfrontCheck the bar association independently and ask for a licence number.
"Fellow victim in a group"Shared suffering, then an introduction to a helperThe most efficient re-victimisation route. Never act on an address from a DM.
"Exchange compliance officer"Calls from a number that looks realHang up and call the exchange on a number you looked up yourself.
"Law enforcement officer"Contact through official channels, for a "processing fee"Real agencies never charge a fee to act. Verify through published contacts.
Recovery approaches, their claimed mechanism, and the honest translation

The seven questions almost none of them can answer

Ask these in writing before any money moves. A legitimate firm answers all seven, plainly, without pressure. A fabrication answers none of them and applies time pressure instead — which is the answer in itself.

Keep the replies. A refusal to answer in writing is useful evidence if you decide to report the approach.

  • 01What is your company registration number, and in which jurisdiction are you registered?
  • 02What licence or professional body authorises you to act in recovery matters?
  • 03Who is personally accountable for this engagement, by name?
  • 04What do you charge, when is it payable, and is any part of it contingent on a result?
  • 05What exactly will you do in the first ten days, in writing?
  • 06Which regulated institution will receive your request, and on what legal basis?
  • 07Can you put all of the above in an engagement letter I can have reviewed before paying anything?

Any answer that includes "pay the upfront fee and we will start" ends the conversation. An upfront fee for a recovery you cannot verify is the fraud, not a step toward recovering from it.

How much of the recovery industry is fraud

The honest answer is that no one has a reliable figure, because recovery approaches are reported far less often than the original losses — people who have already been embarrassed once are reluctant to report being targeted twice.

What the published data does show clearly is the shape: second-wave fraud is consistently reported as arriving within days of the first loss, and it is consistently fee-first. This chart shows the compound effect on victims who engage with an approach.

Data

The compound loss when a victim responds to a recovery approach

Relative index — median outlay by stage for victims who engaged with a recovery approach

Original loss 100
After "case assessment" 122
After "recovery fee" 158
After "release / court fee" 197
Fees actually returned 0

Reading: The escalation is the mechanism. Each fee is modest relative to the sum already sunk, which is exactly what makes the next one payable. The final row is zero — no stage of this process returns capital.

What actually helps, instead

There is real work you can do, and it does not involve paying anyone. It is slower, less emotionally satisfying, and it is the only thing that has ever produced outcomes.

The two moving parts are a dispute on any bank- or card-funded portion, and a documented freeze request to any regulated institution the funds reached. Both need the same thing from you: a written, dated, verifiable record.

  • 01File the bank or card dispute first if any part of the loss was funded that way — those deadlines are the shortest of anything in the process.
  • 02Send a documented freeze request to any exchange the trace shows the funds reached, while they are still there.
  • 03File at IC3.gov and ReportFraud.ftc.gov, attaching your written record rather than describing it.
  • 04Use the official complaint route for the platform itself where one exists — regulator, consumer protection body, or app store.
  • 05Ignore every inbound approach, including the ones that reference your case number accurately. Case details circulate; knowing them proves nothing.
  • 06Tell someone you trust. Shame is the fraud’s protection, and it is also what makes the second approach easier to accept.

One rule covers this entire guide: never send money to get money back. It has no exceptions, and it is the difference between one loss and an escalating series of them.

Supporting infographic for Recovery Scam: How the Second Fraud Works and How to Spot It
Recovery Scam: How the Second Fraud Works and How to Spot It — supporting infographic

Common questions

Yes, in a narrow sense: recognised blockchain analytics firms engaged through a lawyer, and law firms acting on a documented case. The distinguishing features are that they do not cold-contact you, they do not promise a result, they have verifiable registration and licensing you can check independently, and they do not require an upfront crypto payment as a condition of starting.
Report it the same way you reported the original loss: IC3.gov and ReportFraud.ftc.gov, with the approach archived (messages, emails, addresses, payment requests). Reporting the second approach separately creates a dated record and helps link related operations.
No. Screenshots are trivially fabricated and are a standard prop in these approaches. Independently verifiable evidence looks like a licence you can look up yourself, not an image sent to you by the person asking for money.
Next step

Do the useful part yourself, for free

Build the record an institution actually acts on: the tracer produces the movement, the Report Builder turns it into a complaint, an email and a legal draft.

Primary sources and further reading

External links open in a new tab and are provided so you can verify the underlying material yourself. TrueMoneyTalk is not affiliated with these organisations.

Keep reading

Share this guide

Someone you know may be in this situation right now.

Disclaimer: this guide is general information, not legal, financial or recovery advice, and it is not a substitute for advice from a licensed professional in your jurisdiction. Individual outcomes vary and are never guaranteed.