A recovery scam is a secondary fraud that specifically targets people who have already lost money to an earlier scam, offering to recover the lost funds in exchange for an upfront fee that, once paid, simply disappears along with the “recovery agent.” The FBI’s 2025 Internet Crime Report recorded more than 10,500 recovery scam complaints totaling $1.4 billion in losses — including $540 million taken specifically from victims aged 60 and older, across 2,529 complaints. This is the fifth and final Hub article in our Investment Scams cluster, and in some ways it’s the most important one to read regardless of which type of scam you may have encountered, because recovery scams specifically target victims of every scam type covered in our other four Hub articles: cryptocurrency fraud, pig butchering, Ponzi/HYIP schemes, and fake trading platforms. (See also: our Pillar guide, Investment Scams: The Complete Guide, and our Hub articles on Cryptocurrency Investment Scams, Pig Butchering Scams, Ponzi Schemes & High-Yield Investment Fraud, and Fake Trading Platforms & Forex/CFD Scams.)

Why Recovery Scams Work So Well

Recovery scams exploit a specific emotional and financial state that makes victims unusually receptive: someone who has just lost money is often desperate, ashamed, and actively searching for any way to undo what’s happened. A caller or message that arrives claiming to already know the details of the original scam, sometimes because the same criminal network sold that information, sometimes because the recovery scammer is affiliated with the original scam operation itself, feels credible precisely because it demonstrates specific knowledge a stranger shouldn’t have.

The FTC has documented that scam operations frequently maintain what they internally call “sucker lists” records of who has already paid, how much, and what pitch worked on them, which get sold, traded, or reused to run a second scam against the same victim, sometimes years after the original loss. This turns a single fraud into an ongoing cycle: the 2026 Identity Theft Resource Center Trends in Identity Report found that just over a quarter of identity crime victims were managing two or more incidents simultaneously.

There’s also a psychological dimension worth naming directly. A person who has just been defrauded is frequently experiencing a specific kind of urgency that has nothing to do with the recovery pitch itself: the desire to fix the mistake before anyone finds out, before a spouse or adult child asks hard questions, before the financial hole becomes permanent. A recovery scam offer arrives at exactly the moment that urgency is highest, promising a way to make the whole thing disappear quietly and completely which is precisely the emotional state that overrides the skepticism the same person might apply to almost any other unsolicited financial offer.

How the Pitch Usually Works

Recovery scammers typically make contact by phone, email, or text, identifying themselves as a law firm, a government agency, a financial regulator, or occasionally a cybersecurity or asset-recovery firm. The FBI has specifically warned that scammers produce documents on convincing law firm letterhead, claim affiliation with agencies like the Consumer Financial Protection Bureau, and reference real financial institutions by name to build credibility quickly.

The pitch usually follows a consistent shape: they already know you lost money (sometimes with unsettling specificity about the amount or the platform involved), they claim to have identified where the funds went or secured a legal mechanism to recover them, and they need a retainer, processing fee, tax payment, or your banking details to “release” or “process” the recovered funds. Once paid, the retainer disappears along with the recovery agent, and the victim has now lost money twice to what may be the exact same criminal organization.

The documentation these operations produce has grown notably more sophisticated. Fabricated case numbers, official-looking seals, and letterhead mimicking real government agencies or established law firms are now common enough that a document’s visual polish alone should never be treated as proof of legitimacy, genuine government correspondence rarely arrives as an unsolicited cold contact promising a specific dollar recovery in exchange for an upfront payment.

How Recovery Scams Target Each Type of Original Fraud

It’s worth being specific about how this plays out across the four scam categories covered elsewhere in this cluster, since the recovery pitch is often tailored to match the original fraud precisely.

Following crypto investment fraud

Victims of crypto scams are frequently approached by someone claiming to be a “blockchain recovery specialist” or “crypto forensics firm” who claims to have already traced the stolen funds and can recover them for a fee paid. often, with a particularly cruel irony in cryptocurrency itself.

Following pig butchering scams

Victims of relationship-based scams are sometimes approached by someone posing as a victim advocate or a fellow victim who has “already recovered” their own funds and offers to connect the new victim with the same recovery contact, exploiting the same trust-building mechanism that made the original scam work.

Following Ponzi/HYIP collapses

Investors in a collapsed Ponzi scheme are frequently targeted by fraudsters posing as the court-appointed receiver or a law firm representing the receivership, requesting an upfront “processing fee” to release a claims-process distribution, a tactic that works precisely because a real receivership claims process does exist and does eventually distribute funds, making the fake version harder to distinguish from the legitimate one.

Following fake trading platform losses

Forex and CFD scam victims are often approached by someone claiming to specialize in regulatory complaints or chargebacks, offering to handle the entire dispute process for an upfront fee, even though, as covered in our Forex/CFD Hub, a legitimate chargeback dispute is something a victim can typically initiate directly with their own card issuer at no cost.

The Particularly Cynical Twist: Impersonating Real Victim-Protection Programs

One of the more troubling patterns the FBI has flagged is that fraudsters have begun impersonating the Bureau’s own legitimate victim-outreach initiative, Operation Level Up — the program that proactively identifies and contacts cryptocurrency fraud victims to warn them before further losses occur, and which we’ve referenced positively in our Crypto Investment Scams Hub article. Scammers now use that program’s real name and reputation to add false legitimacy to their own fake recovery pitch, a reminder that any institution whose name carries authority in a crisis (a law enforcement agency, a regulator, a bank) is a candidate for exactly this kind of exploitation.

This matters practically: a caller referencing a real, well-known victim-protection program by name is not, on its own, proof of legitimacy. Genuine law enforcement outreach, including the real Operation Level Up, does not ask for upfront fees, retainers, or your banking details to “release” recovered funds. If you’re contacted by someone claiming to represent a program you’ve heard of, the single most reliable verification step is to hang up and contact the agency directly through a phone number or website you find independently, never one provided by the caller.

Older Adults Face Disproportionate Risk

The FBI’s elder fraud data shows recovery scams hit older victims with particular force: Americans aged 60 and over filed 2,529 recovery scam complaints in 2025, totaling more than $540 million in losses — a meaningful share of the category’s total. This tracks with broader elder-fraud trends: Americans 60 and older reported $7.748 billion in total fraud losses in 2025, up 59% from the prior year, and the FTC’s December 2025 report on older adults notes that this age group tends to lose larger amounts once targeted, and is disproportionately targeted a second time specifically because criminal networks recognize prior victims as a uniquely receptive target.

Family members and caregivers play an outsized protective role here specifically because recovery scams are engineered to be handled alone and quietly. A victim who feels comfortable telling an adult child “someone called about getting my money back” before engaging further has a natural check built into the situation that a victim isolated by shame does not. Encouraging that kind of open communication before any decision is made, rather than only after a second loss has occurred, is one of the more effective protective measures available to families.

Red Flags of a Recovery Scam

• Any unsolicited contact (call, email, text, or social media message) from someone claiming they can recover money you’ve already lost.
• A request for an upfront fee, retainer, “tax,” or processing charge before any funds are released
• Pressure to provide banking details or personal information to “process” a recovery
• Specific knowledge of your prior loss that feels impossible for a legitimate stranger to have obtained
• Reference to a real agency, law firm, or program name (including real victim-protection initiatives) used to build false credibility
• Urgency framed around a limited window to “claim” recovered funds

What To Do If You’re Contacted

1. Do not pay any upfront fee, retainer, or “tax”,  legitimate recovery work is never structured this way.
2. Do not provide banking details or personal information to an unsolicited caller, regardless of what agency or firm they claim to represent.
3. Independently verify any claimed affiliation by contacting the agency or firm directly through a number or website you find yourself, not one the caller provided.
4. If the caller references a real program (like Operation Level Up), verify directly with the FBI or relevant agency rather than assuming legitimacy from the name alone.
5. Report the contact to the FTC at ReportFraud.ftc.gov, or to the FBI’s IC3.gov if it involves cryptocurrency or a fake law firm.
6. If you’re uncertain whether a recovery offer is legitimate, get a professional case assessment from an established investigation firm before engaging further.

How to Tell a Legitimate Recovery Firm From a Scam

This is worth addressing directly, since it’s the exact question every recovery-scam victim wishes they’d asked sooner. Legitimate asset-recovery and investigation firms do not cold-contact people out of nowhere claiming to already know about their case. They don’t demand a large upfront retainer before any investigative work has begun, and they’re transparent about what their fee structure actually covers. A legitimate firm will also be straightforward about the fact that recovery is never guaranteed, any firm promising a guaranteed recovery is, by that promise alone, telling you something false.

If you’re approached by a firm you didn’t contact first, treat that as a reason for more scrutiny, not less, and independently verify their registration, physical business address, and reviews before engaging, the same due-diligence process we’ve recommended throughout this cluster for evaluating any financial services provider.

A few additional questions worth asking any recovery firm before engaging, regardless of how they were found: What specifically does the initial assessment involve, and is it free? What licensing or professional certifications does the firm or its investigators hold, and can those be independently verified? What does the fee structure look like if the case does proceed, and at what stage does any payment become due? A firm confident in its own legitimacy will answer all of these clearly and without defensiveness; a firm running a recovery scam typically cannot, because the honest answers would immediately undermine the pitch.

It’s also worth understanding what a legitimate investigation can and cannot promise. Blockchain tracing, wallet clustering, and OSINT investigation can meaningfully improve the odds of identifying where funds went and building documentation for law enforcement, a receivership claims process, or exchange cooperation requests — but no ethical firm can guarantee that funds will actually be returned, since that outcome ultimately depends on factors like how quickly funds were laundered, which jurisdictions are involved, and whether the responsible parties can be identified and have recoverable assets at all. Firms that skip past this nuance and promise a specific dollar outcome are worth treating with the same skepticism as the original scam.

A Note on Payment Method: The Untraceable Payment Request

One additional pattern worth flagging specifically: recovery scammers, like most fraud operators, strongly prefer payment methods that are difficult or impossible to reverse, wire transfers, gift cards, and cryptocurrency are all common requests, precisely because each closes off the recovery options a victim would otherwise have. A request to pay a “processing fee” via gift card in particular should be treated as close to definitive proof of fraud on its own; no legitimate law firm, government agency, or financial institution has ever had a legitimate reason to request payment in gift cards, regardless of how the request is framed or how urgent it’s made to sound. If a payment request specifically avoids your credit card or a traceable bank transfer, treat that avoidance itself as the clearest signal in the entire interaction.

Documenting the Contact, Even Before You’re Certain

If you’re contacted by someone claiming they can help recover funds you’ve lost, it’s worth documenting the interaction even before you’ve fully decided whether it’s legitimate: screenshot any messages, note the phone number or email address used, save any documents or “case numbers” provided, and record the specific claims made about your original loss. This documentation serves two purposes: it gives you something concrete to independently verify against the actual agency or firm being claimed, and if the contact does turn out to be fraudulent, it becomes exactly the kind of evidence that strengthens a report to the FTC or FBI IC3, and that a legitimate investigation firm can use to help identify whether the same operators are running a pattern of similar contacts against other victims.

How to Report Investment Fraud, by Region

• UK — Report Fraud and the Financial Conduct Authority’s Warning List
• US — the FBI’s Internet Crime Complaint Center (IC3) and the Federal Trade Commission (FTC)
• Canada — the Canadian Anti-Fraud Centre (CAFC)
• Australia — Scamwatch (National Anti-Scam Centre)
• Singapore — the Singapore Police Force Anti-Scam Centre
• Hong Kong — the Anti-Deception Coordination Centre (ADCC)

Frequently Asked Questions

Are all recovery services scams?

No — legitimate investigation and asset-recovery firms exist and can meaningfully help, including ICAR. The distinction is in how they operate: no unsolicited cold contact claiming instant knowledge of your case, no guaranteed outcomes, and no large upfront retainer before any work has begun. The safest approach is generally to seek out a firm yourself, based on independent research, rather than engaging with one that contacted you first.

Why would a recovery scammer already know I was scammed before?

Fraud networks frequently maintain and trade “sucker lists” — records of prior victims, amounts lost, and what pitch worked — sometimes selling this information to entirely separate criminal groups running the recovery-scam angle specifically. In some cases, the same organization runs both the original scam and the follow-up recovery scam, which is why the details can feel unsettlingly precise.

Is it really true that scammers impersonate the FBI’s own victim-outreach programs?

Yes — the FBI has specifically warned that fraudsters use the real name of its Operation Level Up program, which genuinely does contact crypto fraud victims proactively, to add false legitimacy to fake recovery pitches. Verify independently rather than trusting a familiar name alone, by contacting the agency directly through a number or website you find yourself.

Should I ever pay an upfront fee for recovery help?

Be extremely cautious of any recovery service, real or claimed, that requires a large payment before any investigative work has started. Legitimate firms are transparent about fee structures tied to actual work performed, and many offer a free initial case assessment specifically so a victim isn’t asked to pay anything before understanding whether pursuing recovery even makes sense for their situation.

Why are older adults targeted by recovery scams so heavily?

FBI data shows Americans 60 and older filed 2,529 recovery scam complaints in 2025 totaling over $540 million — criminal networks specifically recognize this group as both more likely to have lost larger amounts originally and more receptive to a recovery pitch, particularly when the original loss involved retirement savings and the emotional pressure to fix the situation quietly is especially acute.

What should I do if I already paid a recovery scammer?

Treat it the same as any other fraud: stop further payments immediately, gather all documentation including any correspondence and payment records, report to the FTC or FBI IC3, and consider a professional case assessment — the funds may still be traceable depending on how they moved, particularly if any portion was paid via card or a traceable transfer rather than cash or gift cards.

How is this Hub different from the other four in this cluster?

The other four Hubs cover distinct primary scam types: crypto, pig butchering, Ponzi/HYIP, and fake trading platforms. This Hub covers the secondary scam that specifically targets victims after any of those, which is why it ties directly back to all four and is worth reading regardless of which original scam type you may have encountered.

Can a recovery scam happen years after the original fraud?

Yes — because sucker lists persist and get traded well beyond the original incident, victims have reported being contacted by recovery scammers years after their initial loss, sometimes when they’d stopped actively thinking about it and were less prepared to recognize the pattern.

If You’ve Been Targeted a Second Time, You’re Not Alone

Being targeted again after an initial loss is not a sign you weren’t careful enough, it’s evidence that criminal networks specifically build systems to exploit exactly that vulnerable moment. ICAR never charges upfront fees for an initial case assessment, and we’re always transparent that recovery outcomes depend on case-specific factors rather than guarantees.

This article closes out the foundational structure of our Investment Scams series — a Pillar guide and five Hub articles covering crypto fraud, pig butchering, Ponzi and high-yield schemes, fake trading platforms, and now the recovery scams that follow all four. If any part of this series describes something you’re currently going through, the most important next step is simple: don’t navigate it alone, and don’t let shame about a first loss make you more vulnerable to a second one.

Across every article in this cluster, the same underlying pattern keeps reappearing in different costumes: a scheme engineered specifically to survive the exact scrutiny most people already know to apply. Recovery scams are, in a sense, the cluster’s clearest example of that pattern, because they’re built entirely around the emotional aftermath of having already been fooled once, betting that shame, urgency, and the desire for a quiet resolution will override the caution a victim might otherwise apply. Recognizing that pattern, here at the end of a second scam rather than only the first, is exactly the kind of awareness this entire series has been built to provide.

About ICAR: International Cyber Asset Recovery (ICAR) is a UK-based forensic investigation and asset recovery firm specialising in cryptocurrency fraud, investment scams, and digital asset recovery. ICAR investigates LinkedIn investment fraud cases across the UK, US, Canada, Australia, Singapore, and Hong Kong.

Free initial case assessments: Case Form or Contact Support via WhatsApp