Recovery Scam: How the Second Fraud Works and How to Spot It
A recovery scam targets people who have already lost money. Learn the four opening scripts, the seven proof-of-legitimacy demands almost none can meet, and why any upfront fee is the fraud itself.
They Knew My Case Number. They Were Reading My Own Post.
How a second fraud finds you — and the seven questions almost none of them can answer.
What this guide says in 5 lines
- No private service can reverse a blockchain transaction. There is no technical mechanism for it.
- The recovery scam depends on urgency, secrecy and an upfront fee — all three together.
- Being contacted first is itself the strongest available warning sign.
- A legitimate firm has a registration, a licence and an office you can verify independently.
- Your own report with real evidence does more than any "recovery agent" you will ever be offered.
A recovery scam is the same fraud, run a second time on the same person. It works because the first loss created exactly the conditions it needs: urgency, a willingness to pay for hope, and a list of confirmed victims circulating among the people who took the money. This guide shows the four opening scripts, the questions that separate a real firm from a fabrication, and the one rule that ends the entire category.
Why you are being contacted, and by whom
When you report a loss, post about it, or join a victim support group, your details become visible to a predictable audience: the operation that took the money, and others who buy victim lists from each other. Contact after a loss is therefore not surprising — it is expected, and it usually arrives within days.
This is why "how did they know about my case?" is the wrong question. The right one is why a firm you have never heard of would spend its own time finding you, rather than waiting for clients to find it.
A genuine law firm or analytics company does not cold-contact victims of a fraud it was not already engaged on. Being approached first is a structural warning sign, not a compliment.
The four opening scripts
Nearly every recovery approach uses one of these four framings. They are designed to answer the one question a cautious victim asks — "how can you get my money back?" — before it is asked.
Notice that each one explains why this firm can do the impossible, using a mechanism nobody can check.
| Opening | Claimed mechanism | Honest translation |
|---|---|---|
| "Recovery specialist" | They can get it back for a fee, or a percentage | No one can reverse a blockchain transfer. The fee is the only money that moves. |
| "Cyber investigation agency" | Official-sounding tracing for a retainer | Tracing is free and public. A retainer buys you work you could do yourself. |
| "Legal firm" | A demand letter, for a court fee paid upfront | Check the bar association independently and ask for a licence number. |
| "Fellow victim in a group" | Shared suffering, then an introduction to a helper | The most efficient re-victimisation route. Never act on an address from a DM. |
| "Exchange compliance officer" | Calls from a number that looks real | Hang up and call the exchange on a number you looked up yourself. |
| "Law enforcement officer" | Contact through official channels, for a "processing fee" | Real agencies never charge a fee to act. Verify through published contacts. |
The seven questions almost none of them can answer
Ask these in writing before any money moves. A legitimate firm answers all seven, plainly, without pressure. A fabrication answers none of them and applies time pressure instead — which is the answer in itself.
Keep the replies. A refusal to answer in writing is useful evidence if you decide to report the approach.
- 01What is your company registration number, and in which jurisdiction are you registered?
- 02What licence or professional body authorises you to act in recovery matters?
- 03Who is personally accountable for this engagement, by name?
- 04What do you charge, when is it payable, and is any part of it contingent on a result?
- 05What exactly will you do in the first ten days, in writing?
- 06Which regulated institution will receive your request, and on what legal basis?
- 07Can you put all of the above in an engagement letter I can have reviewed before paying anything?
Any answer that includes "pay the upfront fee and we will start" ends the conversation. An upfront fee for a recovery you cannot verify is the fraud, not a step toward recovering from it.
How much of the recovery industry is fraud
The honest answer is that no one has a reliable figure, because recovery approaches are reported far less often than the original losses — people who have already been embarrassed once are reluctant to report being targeted twice.
What the published data does show clearly is the shape: second-wave fraud is consistently reported as arriving within days of the first loss, and it is consistently fee-first. This chart shows the compound effect on victims who engage with an approach.
The compound loss when a victim responds to a recovery approach
Relative index — median outlay by stage for victims who engaged with a recovery approach
Reading: The escalation is the mechanism. Each fee is modest relative to the sum already sunk, which is exactly what makes the next one payable. The final row is zero — no stage of this process returns capital.
What actually helps, instead
There is real work you can do, and it does not involve paying anyone. It is slower, less emotionally satisfying, and it is the only thing that has ever produced outcomes.
The two moving parts are a dispute on any bank- or card-funded portion, and a documented freeze request to any regulated institution the funds reached. Both need the same thing from you: a written, dated, verifiable record.
- 01File the bank or card dispute first if any part of the loss was funded that way — those deadlines are the shortest of anything in the process.
- 02Send a documented freeze request to any exchange the trace shows the funds reached, while they are still there.
- 03File at IC3.gov and ReportFraud.ftc.gov, attaching your written record rather than describing it.
- 04Use the official complaint route for the platform itself where one exists — regulator, consumer protection body, or app store.
- 05Ignore every inbound approach, including the ones that reference your case number accurately. Case details circulate; knowing them proves nothing.
- 06Tell someone you trust. Shame is the fraud’s protection, and it is also what makes the second approach easier to accept.
One rule covers this entire guide: never send money to get money back. It has no exceptions, and it is the difference between one loss and an escalating series of them.
Common questions
Do the useful part yourself, for free
Build the record an institution actually acts on: the tracer produces the movement, the Report Builder turns it into a complaint, an email and a legal draft.
Primary sources and further reading
- FTC — Scams That Target Victims of Previous Scams consumer.ftc.gov
- FBI — Scam Recovery Fraud Warning www.fbi.gov
- IC3 — Reporting Recovery Fraud www.ic3.gov
External links open in a new tab and are provided so you can verify the underlying material yourself. TrueMoneyTalk is not affiliated with these organisations.
Keep reading
Someone you know may be in this situation right now.
Disclaimer: this guide is general information, not legal, financial or recovery advice, and it is not a substitute for advice from a licensed professional in your jurisdiction. Individual outcomes vary and are never guaranteed.