You already lost money to a scam. Then someone contacts you claiming to be an investigator, government official, law firm, cybersecurity company, or recovery specialist who can get it back. Before you reply, pay another fee, install software, or share sensitive information, use this recovery scam checklist.
A professional website, case number, badge, polished message, or convincing video call does not prove that a recovery offer is genuine.
Last reviewed: July 24, 2026
What Is a Recovery Scam?
A recovery scam is a follow-up fraud that targets someone who has already lost money or personal information. A new person offers to recover the loss, obtain a refund, trace cryptocurrency, release frozen funds, or represent the victim in an investigation. The supposed helper then asks for money, identity documents, banking information, device access, wallet access, or additional payments.
The contact may claim to represent law enforcement, a regulator, a law firm, a bank, a cybersecurity company, a blockchain investigator, or an asset-recovery service. They may know the type of scam, the amount lost, the date of payment, or the name used by the first scammer. That knowledge is not proof of authority. Victim information can be retained, shared, stolen, sold, or reused.
The Federal Trade Commission’s refund and recovery scam guidance and the Commodity Futures Trading Commission’s recovery-fraud warning both describe schemes that re-target people after an earlier loss.
Why AI Makes Recovery Scams More Convincing
AI can help scammers create polished messages, realistic voices, fabricated profile photos, fake documents, professional-looking websites, and videos that appear to feature officials or executives. It can also make a message more personalized by using details from the original fraud report, public social profiles, leaked data, or previous conversations.
These tools weaken older assumptions. Bad grammar is no longer required for a scam. A voice that sounds natural is not proof. A video call is not independent identity verification. A detailed website can still be recently created or copied.
Use the PAUSE Framework Before You Respond
The original Designs24hr PAUSE framework moves the decision away from the person contacting you and into a process that you control.
Stop contact, payments, downloads, and data sharing.
Verify the identity, organization, domain, and claims independently.
Use official recovery routes before private recovery offers.
Protect accounts, devices, wallets, and evidence.
Report the second scam and seek help through trusted channels.
Recovery Scam Checklist: 12 Checks Before You Pay Again
One warning sign does not always prove fraud. Evaluate the full pattern. Several mismatches—especially an unexpected approach, a guarantee, an urgent fee, and a request for unusual payment or account access—should stop the process until everything is independently confirmed.
1Did You Contact Them First?
An unexpected recovery offer deserves stronger scrutiny than a professional you found and contacted independently. Ask how the person obtained your name, contact information, loss amount, and case details.
2How Did They Learn About the Original Scam?
Details about your earlier loss may have come from the original scammers, a copied complaint, leaked records, public posts, or a victim list. Knowledge is not proof that the person has recovered anything.
3Are They Claiming Government Authority?
Do not use the supplied phone number, email, social profile, link, or chat account. Locate the agency’s official website yourself and ask whether the person, case number, and requested action are genuine.
4Can You Verify the Person Independently?
Check the full name, employer, office location, professional licence where relevant, staff directory, and independently located office number. A badge photo, ID image, certificate, or video introduction is not enough.
5Is the Website and Domain Genuine?
Inspect the complete domain for misspellings, extra words, unusual endings, recently created pages, copied text, fake reviews, broken navigation, and an address that cannot be confirmed. A secure padlock only means the connection is encrypted; it does not prove the business is legitimate.
6Are They Guaranteeing Recovery?
No responsible person can guarantee a refund before reviewing the payment method, timing, evidence, institutions involved, and legal options. Treat “100% recovery,” “funds already secured,” or “guaranteed release” as serious warning language.
7Are They Requesting an Upfront Fee?
Be cautious of a retainer, processing charge, release fee, tax, insurance payment, court cost, administrative fee, wallet activation charge, or deposit demanded before any independently verifiable result.
8How Do They Want You to Pay?
Stop when someone demands cryptocurrency, gift cards, a wire transfer, a payment app, cash, courier pickup, or transfer to a “safe” account. These methods can be difficult to reverse and are commonly used in scams.
9Are They Asking for Sensitive Information?
Do not send passwords, one-time codes, bank logins, card details, tax records, passport images, a Social Security number, cryptocurrency seed phrases, private keys, or unnecessary identification.
10Do They Want Device or Wallet Access?
Refuse remote-desktop software, screen sharing, unfamiliar browser extensions, unknown mobile apps, unexplained wallet connections, or instructions to sign a transaction you do not fully understand.
11Are They Using Pressure or Secrecy?
Warnings such as “act before the funds disappear,” “do not tell your bank,” “the investigation is confidential,” or “pay today to preserve your case” are designed to block independent review.
12Can Every Claim Be Confirmed Elsewhere?
Close the message. Find the real institution independently. Confirm the person, case, funds, payment request, and next step through an official channel that the recovery contact did not provide.
Recovery Claims Versus Stronger Verification
| Recovery claim | What would provide stronger verification |
|---|---|
| “We work with the FBI or IC3.” | Confirmation through an independently accessed official FBI or IC3 channel. |
| “We recovered your money.” | Confirmation from the actual bank, court, exchange, payment provider, or relevant institution. |
| “This video proves I am an official.” | Independent confirmation through the organization represented—not the video itself. |
| “Your cryptocurrency is frozen in a wallet.” | Verifiable documentation that does not require a deposit, seed phrase, private key, or wallet connection. |
| “Pay a tax or fee to release the funds.” | Independent confirmation from the relevant government or financial institution through its official channel. |
| “This case number proves the investigation exists.” | Confirmation from the genuine agency or organization using contact information you found yourself. |
| “We know exactly how much you lost.” | Nothing by itself. That detail may have come from the original scammers or a victim list. |
Does a Video Call Prove a Recovery Agent Is Real?
No. A video call proves that a communication session occurred. It does not independently prove the caller’s name, employer, authority, location, professional licence, or claim that funds have been recovered.
A call may involve recorded video, real-time face replacement, a stolen or compromised account, a cloned voice, or a real person making false claims. The FBI notes that advanced AI-generated content can be difficult to identify and recommends verification through known official channels when authenticity is uncertain.
For suspicious calls and cloned voices, use the AI voice scam checklist. Do not rely on a caller’s voice, face, badge, background, or display name as your only evidence.
What to Do Based on the Payment Method
Recovery is never guaranteed, but acting quickly may improve the options available. Contact the relevant provider through its official app, website, statement, or the number printed on the card—not through contact details supplied by the recovery agent.
| What was sent | Immediate action |
|---|---|
| Credit or debit card | Contact the card issuer, report fraud, and ask about blocking, replacement, dispute, or chargeback procedures. |
| Bank transfer or wire | Contact the bank’s fraud department immediately and ask whether the transfer can be stopped, recalled, traced, or flagged. |
| Payment app | Report the transaction inside the official app and contact the linked bank or card provider when applicable. |
| Gift card | Contact the gift-card issuer immediately, keep the card and receipt, and provide the card number only through the issuer’s official support route. |
| Cryptocurrency | Contact the exchange or service used to send it, preserve wallet addresses and transaction hashes, and refuse anyone promising guaranteed blockchain recovery. |
| Cash or courier delivery | Contact local law enforcement promptly and preserve delivery instructions, addresses, messages, and tracking information. |
| Check | Contact the bank immediately. Do not send money because a deposited check appears available; fraudulent checks may later be reversed. |
| Remote device access | Disconnect the device, remove unfamiliar remote-access tools with trusted help, secure accounts from a trusted device, and review financial activity. |
The FTC provides additional instructions for specific payment methods in its official guide on what to do if you were scammed.
What If You Already Paid the Recovery Agent?
- Stop all further payments. Do not pay a second fee, tax, deposit, insurance charge, or “final release” amount.
- Contact the payment provider immediately. Explain that the transaction is connected to a suspected recovery scam.
- Ask about available fraud procedures. Depending on the payment method, these may include a stop, recall, dispute, freeze, replacement, or investigation.
- Secure affected accounts. Change exposed passwords, review active sessions, and strengthen multifactor authentication.
- Remove unwanted access. Revoke unknown connected apps, browser extensions, wallet permissions, and remote-access software.
- Preserve evidence. Save messages, email headers, usernames, URLs, phone numbers, invoices, wallet addresses, receipts, transaction IDs, and a timeline.
- Report the second scam separately. Include information about both the original loss and the recovery approach.
- Expect additional contact. The same group may return with a different company name, official title, lawyer, investigator, or supposed refund program.
What Did You Already Share?
| Information or access shared | Recommended next action |
|---|---|
| Name, email, or phone number | Expect follow-up attempts, strengthen account security, and treat future recovery offers with extra caution. |
| Social Security number | Use the personalized recovery process at IdentityTheft.gov. |
| Driver’s licence or passport | Contact the issuing authority and monitor for identity misuse or unfamiliar applications. |
| Bank or card information | Contact the financial institution immediately and follow its fraud and replacement instructions. |
| Password | Change it immediately and replace every reused version. Review sessions, recovery details, and connected applications. |
| One-time code or login approval | Secure the related account, revoke sessions, and review authentication methods and recovery information. |
| Remote access | Disconnect, remove the tool with trusted assistance, and change sensitive credentials from a device you trust. |
| Wallet address | Monitor activity and reject anyone claiming the public address gives them special recovery authority. |
| Seed phrase or private key | Treat the wallet as compromised and seek qualified security guidance without sharing the phrase or key again. |
| Money or cryptocurrency | Contact the sending provider immediately and preserve all transaction evidence. |
For broader information-sharing precautions, review the AI privacy checklist.
Fictional Recovery Offer Examples
These examples are fictional and show why context and independent verification matter more than professional presentation.
Suspicious government message
“Your reported funds have been secured by our cyber division. Pay a $650 release tax in cryptocurrency within two hours. Do not contact your bank because the investigation is confidential.”
Why it is suspicious: unexpected contact, government impersonation, cryptocurrency payment, urgency, secrecy, and a supposed fee to release funds.
Safer independent verification
You close the message, type the official agency address into your browser, call a published office number, and ask whether the person and case number are genuine before sharing anything.
Why it is safer: the verification route does not depend on information supplied by the person being checked.
Suspicious crypto investigator
“We traced your stolen assets. Connect your wallet and enter your seed phrase so our recovery software can confirm ownership. A 10% activation deposit is refundable.”
Why it is suspicious: seed-phrase request, wallet connection, advance payment, guaranteed tracing claim, and pressure to act.
Suspicious law-firm approach
“Our attorneys were assigned your case by an international regulator. We guarantee full recovery. Send your passport, bank login, and retainer through the payment link below.”
Why it is suspicious: unsolicited contact, unverifiable referral, guarantee, excessive data request, and supplied payment link.
Where to Report a Recovery Scam in the United States
FBI Internet Crime Complaint Center
Report internet-enabled fraud, impersonation, fake websites, and cryptocurrency-related details at IC3.gov.
Federal Trade Commission
Report consumer fraud through the official ReportFraud.ftc.gov portal.
Identity Theft Recovery
Create a personalized identity-theft recovery plan at IdentityTheft.gov.
Also report an impersonating profile to the platform where it appeared and contact your bank, card issuer, payment app, exchange, or transfer provider directly when money or account information is involved.
Related AI Safety Guides
Frequently Asked Questions
What is a recovery scam?
A recovery scam is a follow-up fraud that targets someone who already lost money or information. The new contact promises a refund, investigation, or fund recovery but asks for fees, sensitive information, device access, or additional payments.
How do recovery scammers know how much money I lost?
The information may come from the original scammers, shared victim lists, copied complaints, leaked records, public posts, or previous messages. Knowing the correct amount does not prove that the person is an official or has recovered anything.
Can a company really recover money lost to a scam?
Some banks, payment providers, law-enforcement processes, courts, attorneys, or qualified specialists may help in certain cases, but no outcome is guaranteed. Options depend on the payment method, timing, evidence, jurisdiction, and institutions involved.
Do legitimate recovery services charge upfront fees?
Some legitimate professionals may charge fees, so an upfront fee alone is not conclusive. The risk becomes much greater when the offer is unexpected and includes guaranteed recovery, pressure, secrecy, unusual payment methods, or requests for sensitive access.
Will the FBI or IC3 contact me to recover money?
IC3 states that it does not ask for payment to recover lost funds and does not refer victims to paid recovery companies. Verify any claimed law-enforcement contact through an independently located official channel.
Can a recovery agent prove their identity through a video call?
No. A video call does not independently prove the person’s identity, employer, authority, licence, or recovery claim. Confirm those facts through the organization’s official contact information.
Can stolen cryptocurrency be recovered?
Recovery may be possible in limited circumstances, but it is never guaranteed. Contact the exchange or service used for the transfer, preserve transaction records, file official reports, and reject anyone demanding wallet keys or promising certain recovery.
Is a case number proof that a recovery offer is legitimate?
No. A case number can be invented or copied. Confirm it through the genuine agency, bank, law firm, court, exchange, or organization using contact information you found independently.
What should I do if I already paid a recovery scammer?
Stop further payments, contact the payment provider immediately, secure affected accounts, remove unwanted access, save evidence, and report the recovery scam separately from the original fraud.
Where should I report a fund recovery scam?
In the United States, report internet-related fraud to IC3, consumer fraud to the FTC, and identity theft through IdentityTheft.gov. Also contact the relevant financial institution or payment provider directly.
Verify Before You Pay Again
A convincing message, professional website, case number, or video call does not prove that someone can recover your money. Pause the conversation, contact the relevant institution independently, and verify every claim before paying, installing software, connecting a wallet, or sharing information.
Sources and Review Notes
- FBI/IC3: FBI Warns of Scammers Impersonating the IC3
- FTC: Refund and Recovery Scams
- CFTC: Don’t Be Re-Victimized by Recovery Frauds
- Washington State Department of Financial Institutions: Recovery Scams
- FTC: What To Do if You Were Scammed
