Why Past Scam Victims Are Being Targeted Again by a Second Scam

The cruelest call a scam victim can get is the one that sounds like rescue. A polite voice says your stolen money has been found, a case number is ready, and all you need to do is pay a small fee to release it.

After a scam, a second contact often follows. Someone gets in touch claiming to be from the FBI, the FTC, a law firm, or a "crypto recovery" company. They say they can get the money back. The reader wants to know if it is real.

It almost never is. This is a recovery scam, and it is aimed squarely at people who have already been hurt once. This guide explains how recovery scammers find you, the disguises they use, the signs that give them away, where real help actually comes from, and what to do if you have already paid.

In this article (16)

1. What a recovery scam is
2. How big the problem is
3. How scammers know you were scammed
4. How the recovery pitch works, step by step
5. The 6 disguises recovery scammers use
6. A typical case, start to finish
7. Why this scam works so well
8. Why crypto victims are hit hardest
9. Red flags of a recovery scam
10. Real recovery help vs recovery scam
11. Where real help comes from
12. How to protect yourself
13. How to help a family member
14. Already paid a recovery scammer? Do this now
15. FAQ
16. How we researched this article

What a recovery scam is

A recovery scam is a second scam aimed at someone who has already been scammed. The scammer contacts you, or waits for you to find them, and offers to recover the money you lost. To do that, they say, you must first pay something: a legal fee, a tax, a "release" charge, a wallet activation fee, or a deposit to prove you own the account.

There is no recovery. The fee goes to the scammer. Often the scammer asks again, and again, with a new reason each time. Some victims lose more to the recovery scam than they lost in the original fraud.

Sometimes it is the same gang

In many cases, the people running the recovery scam are the same people who ran the first scam, or people who bought their records. They already know exactly how much you lost, when, and how. That detail is what makes the recovery pitch so convincing. It feels like only a real investigator could know these things. In fact, only the scammer could.

How big the problem is

Recovery scams are not always counted separately in official data, because victims often report them as part of the original crime or under impersonation. Here is what the official figures do show.

Read these numbers together and the risk becomes clear. Billions of dollars are being lost each year, especially by older adults and crypto investors. Every one of those losses creates a person who is desperate to get money back. That is the market recovery scammers feed on.

The last row matters too. Real recovery does happen. The FBI's Recovery Asset Team froze $679 million in 2025. But it happens through banks and law enforcement acting fast on fresh reports, and it never comes with a fee.

How scammers know you were scammed

The first question readers ask is: how did they find me? There are several common routes.

They already had your details

The original scammers keep records of who paid and how much. Those lists, sometimes called "sucker lists," are reused or sold. A person who paid once is seen as likely to pay again.

You searched online for help

Scammers buy search ads and post fake reviews for "fund recovery" services. When a victim searches "how to get my money back from a crypto scam," the first results can be scams. The FBI warned in July 2026 that scammers even built a fake IC3 website and promoted it with AI generated videos of senior FBI leaders.

You posted about it

Victims who share their story in Facebook groups, Reddit threads, or comment sections often get private messages within hours. The messages come from "a friend who got her money back" or from an "agent" who saw the post.

You filed a complaint

Scammers know people report to the FTC and FBI. They pose as those agencies and say they are following up on "your complaint." They do not need to see your real complaint to make this claim. They just assume you filed one.

How the recovery pitch works, step by step

Step 1: The contact

You get a call, email, text, letter, or social media message. It may claim to be from the FBI, the FTC, the Department of Justice, a state attorney general, a law firm, a bank, a "blockchain forensics" company, or even a fake victims' group.

Step 2: Proof that feels real

They know details about your loss. They give you a case number, a badge number, or a court reference. They may send official looking documents with seals and signatures, or a link to a website showing your "recovered funds" sitting in an account with your name on it.

Step 3: The fee

Before the money can be released, there is a cost. It may be called a legal retainer, a court filing fee, a tax on the recovered amount, an anti money laundering certificate, a wallet unlock fee, or a deposit to "verify" your account. It is usually a small fraction of what you are told you will get back, which makes it feel worth it.

Step 4: Payment in a form that is very hard to reverse

They ask you to pay by wire transfer, cryptocurrency, gift cards, or a payment app. Sometimes they ask you to install remote access software "so we can process the refund."

Step 5: One more fee

Once you pay, there is a new problem. The bank flagged the transfer. The tax was calculated wrong. A judge needs a bond. Each step needs more money. This continues until you stop paying or run out of money.

The 6 disguises recovery scammers use

1. The fake FBI or IC3 agent

They say they are from the FBI's Internet Crime Complaint Center and are following up on your report. They may contact you on Facebook, WhatsApp, or Telegram. The FBI says plainly that IC3 does not have a social media presence and does not investigate crimes or recover funds through those platforms. We covered a closely related trick in our article on the fake FTC call that ends in a Zoom "police interview".

2. The fake FTC or government refund

They say the FTC or the government has a settlement and you are owed a refund. The FTC does send real refunds, but it never asks you to pay to receive one and never asks for your bank login.

3. The fake law firm

A "law firm" says it is filing a class action or a case against the scammers and needs a retainer. The FBI reported that fake law firms took more than $9.9 million from crypto scam victims in a single year. They often claim to be working with the FBI, and they sometimes ask victims to pay "back taxes" on the recovered funds.

4. The crypto recovery or "hacker" service

Ads and social posts offer "ethical hackers" or "blockchain recovery experts" who can trace and reclaim your crypto. Some show fake reviews and screenshots. Real blockchain analysis firms work with law enforcement and exchanges. They do not promise individuals guaranteed recovery for an upfront fee.

5. The fake bank or exchange

Someone says they are from your bank's fraud team or from a crypto exchange, and that your stolen money has been traced to an account they can unlock. They need a "verification deposit" first.

6. The friendly fellow victim

In a support group or a comment thread, someone shares how they got their money back with the help of a particular agent, and gives you that agent's contact. The "victim" and the "agent" are the same scam.

A typical case, start to finish

The story below is a composite of the pattern readers describe to us. Details are illustrative, but each step is real.

A retired engineer in Florida lost $48,000 to a fake crypto trading platform he found through a "wrong number" text. Two months later, after he reported it to the FBI and posted about it in an online group, he gets an email from a "law firm" in New York. It says the firm is part of an international task force with the FBI, and his funds have been traced to a frozen wallet in Singapore.

The email includes his exact loss amount and the name of the fake platform. It links to a website with an attorney profile and a client login. When he logs in, he sees "Recovered Balance: $46,200," with his name at the top.

A "case manager" calls. To release the funds, he must pay a 5% anti money laundering compliance fee, $2,310, in Bitcoin. He pays. A week later, there is a problem: the Singapore court needs a tax clearance, $6,900. He pays that too. Then comes a "currency conversion bond" of $12,000.

At that point his daughter sees the emails and calls the real FBI field office. There is no task force and no frozen wallet. The engineer has lost another $9,210 to the same kind of people who took the first $48,000.

The warning signs: the firm contacted him first, it knew details only the scammers would know, the website balance was just numbers on a page, and every step required a fee in crypto.

Why this scam works so well

Recovery scams succeed because of how a loss feels, not because victims lack sense.

• Hope is powerful. After a big loss, the idea of getting it back is overwhelming. People will take a small risk for a chance to undo a large one.
• Shame keeps it secret. Many victims have not told family about the first scam. So they handle the "recovery" alone, without anyone to say "wait."
• The details are real. The scammer knows your loss amount, dates, and platform names, because they or their partners were there.
• It borrows trust from real agencies. Names like FBI, FTC, and Department of Justice carry weight, and fake documents look official.
• The fee looks small next to the prize. Paying $2,000 to get back $46,000 feels like a good deal, until the next fee arrives.

Why crypto victims are hit hardest

Of all the readers who tell me about recovery offers, crypto investment victims are the largest group. That matches the data. The FBI says crypto investment fraud cost Americans $7.23 billion in 2025, more than any other single scam type it tracks. That creates a very large pool of people looking for a way back.

Crypto feels traceable, so recovery feels possible

Many victims learn after the loss that every crypto transaction is recorded on a public ledger. That is true, and it leads to a reasonable sounding thought: if the money can be traced, surely it can be returned. Recovery scammers lean on this. They send screenshots of wallet addresses, transaction charts, and "forensic reports" that show where your coins went.

The problem is the step after tracing. Seeing where crypto went is not the same as getting it back. Freezing stolen crypto usually requires an exchange to act on a request from law enforcement or a court. A private "recovery agent" who contacts you cannot do this, and anyone who claims they can for a fee is lying.

The "hacker" pitch

Another version promises an "ethical hacker" who will break into the scammer's wallet and take your money back. This is not something any legitimate business offers, and it would be a crime if it were. It is simply a story designed to make a fee sound reasonable.

Fake withdrawal fees on the same platform

Some victims never leave the original scam. The fake trading platform itself announces that your account is "frozen" and you must pay a tax or "liquidity fee" to withdraw. This is a recovery scam built into the first scam. If a platform asks you to pay before you can withdraw your own balance, the balance does not exist.

Red flags of a recovery scam

• They contacted you first. Real agencies rarely reach out to promise recovery. You usually have to go to them.
• They want a fee before you get anything. Legal fees, taxes, release charges, or deposits. This is the core of every recovery scam.
• They guarantee results. No honest lawyer or investigator can promise your money will come back.
• Payment by crypto, wire, gift cards, or payment apps. These are hard or impossible to reverse.
• They reach you on social media or messaging apps. The FBI says IC3 does not recover funds through Facebook, Telegram, or similar platforms.
• They ask for remote access to your computer. There is no legitimate reason a recovery service needs control of your device.
• They ask you to keep it secret. Being told not to tell your bank or family is a classic scam instruction.
• The email address is not .gov. Real FBI, FTC, and IC3 addresses end in .gov, not Gmail, Outlook, or a lookalike domain.
• A website shows your "recovered balance." Numbers on a page they control prove nothing.

Real recovery help vs recovery scam

Where real help comes from

Real recovery is less dramatic than the scammers promise, but it is real. These are the places that can actually help, for free.

Your bank or card company

This is the most important call and the one with the best chance of results. Banks can sometimes recall wires, reverse card charges, and block further transfers, especially if you call quickly. Ask for the fraud department using the number on your card or statement.

The FBI's IC3

Filing at IC3.gov puts your case in front of the FBI. For fast moving wire fraud, the Recovery Asset Team works with banks to freeze money, which is how $679 million was frozen in 2025. IC3 will not call you to demand a fee.

The FTC

Report at ReportFraud.ftc.gov. The FTC uses reports to bring cases, and when it wins settlements, it sends refunds directly to eligible people, free of charge.

Local police and your state attorney general

A police report can help with bank disputes and insurance claims. Your state attorney general's consumer protection office can also take complaints.

Help for older adults

If you or the victim is 60 or older, call the National Elder Fraud Hotline at 1-833-372-8311. It is run by the Department of Justice and staffed by case managers who help you report and find support.

Our step-by-step page on the first 48 hours after a scam walks through each of these calls and what to say.

How to protect yourself

1. Treat every unexpected recovery offer as a scam. Do not engage. Hang up, delete, or block.
2. Contact agencies yourself. If you want to check on your case, type ic3.gov or ftc.gov into your browser, or call your local FBI field office using a number from fbi.gov.
3. Never pay to get money back. Not a fee, not a tax, not a deposit.
4. Do not post your loss details publicly. If you want to share your story to warn others, leave out the amount, the platform, and your contact details.
5. Tell someone you trust. Bringing a family member or friend into the loop is the single best defense against a second scam.
6. Expect follow ups. After one scam, assume your details are on a list. Be extra careful with calls, emails, and messages for at least a year.
7. Freeze your credit and secure your accounts. If personal details were shared, use IdentityTheft.gov to build a recovery plan.

How to help a family member who is being targeted

Often the person who spots a recovery scam is not the victim. It is a son, a daughter, or a friend who notices strange emails, new crypto purchases, or a parent who suddenly talks about "the lawyer in New York." If that is you, how you raise it matters.

Lead with the first scam, not the second

Your family member may still be carrying shame about the original loss. Start by making it clear that you are not angry about that. Something like: "Those people are professionals. It could have happened to anyone." People who feel safe are much more willing to listen.

Ask to see the messages together

Instead of saying "this is a scam," ask them to show you the emails or texts and walk through them together. Point out the fee, the payment method, and the email address. Then call the agency together using a number you look up yourself, such as the local FBI field office. Hearing "we have no record of this" from the real agency is far more convincing than hearing it from you.

Help with the next steps

Offer to sit with them while they call the bank and file at IC3. Set up alerts on their accounts, and agree that any future request for money gets a call to you first. If they are 60 or older, the National Elder Fraud Hotline at 1-833-372-8311 can also talk with them directly, which some people find easier than hearing it from family.

Be patient

Some victims hold on to the hope of recovery for a long time. If they are not ready to stop, keep the conversation open and keep checking in. Pushing too hard can drive the contact underground, which is exactly what the scammer wants.

Already paid a recovery scammer? Do this now

If you paid a recovery scammer, you are not alone, and it is not a reflection of your intelligence. These people are professionals working on a person in pain. Here is what to do right away.

1. Stop all payments and contact. Do not pay "one last fee," no matter what they say will happen.
2. Call your bank or card company using the number on your card. Report the payment as fraud and ask them to stop or recall it.
3. If you paid in crypto, contact the exchange you sent it from and report the receiving wallet address.
4. If you paid with gift cards, call the gift card company using the number on the back of the card.
5. If you gave remote access, disconnect the device from the internet, have it checked, and change your passwords from another device.
6. Report to the FBI at IC3.gov and to the FTC at ReportFraud.ftc.gov. Include every contact method, website, and payment detail.
7. If you are 60 or older, call the National Elder Fraud Hotline at 1-833-372-8311.

Recovery scammers often make first contact by email or text. Our guides to spotting phishing emails and scam text messages show how to check those messages before you reply.

FAQ

How we researched this article

This guide is based on FBI Internet Crime Complaint Center alerts on fictitious law firms, IC3 impersonation, and government impersonation, the FBI's 2025 Internet Crime Report, Federal Trade Commission data published in 2026, and the recovery offers our readers send us for review. The typical case is a composite of reader reports, with details changed. Figures are reported losses and undercount the true total. This article is for general education and is not legal or financial advice. Written by Nitesh Kumar Gupta, Founder and Editor of The Scam Exposed.