Good news! Someone wants to get your stolen money back, for a small upfront fee.

“They’re looking for people who’ve already been an easy mark, and now they’re hoping that they can mark them again.”

— Federal Trade Commission, warning about scammers posing as “FTC agents” or other recovery officials targeting prior fraud victims. The FTC explicitly notes: it has no agents, and no real recovery channel ever asks for upfront payment.

Of all the scams I've studied, the recovery scam holds a special place in my contempt. It takes a particular kind of creativity to look at someone who's just been financially gutted — savings gone, trust shattered, lying awake doing the math — and think: there's still juice in that one.

And yet here we are. There's an entire cottage industry built on exactly that idea. They even have a charming internal name for you. Not "victim." Not "client." You're on what the FTC, in its dry official language, calls a "sucker list" — a tidy spreadsheet of people who've already paid a scammer once, complete with your name, your number, the kind of scam that got you, and the amount you lost. It gets bought and sold on the dark web like baseball cards. Congratulations on the inclusion. It's the one club nobody wants the membership card for.

It doesn't matter which scam put you on that list — a task scam dressed as a job, a romance scam, a crypto "investment," a fake pre-IPO share offer. Once you've paid out once, your name is in the database, and the recovery vultures buy that database.

How the second robbery works (it's not subtle)

The phone rings. The voice is warm, professional, maybe even a little outraged on your behalf. They're from a "fund recovery firm." Or a "cybercrime law office." Or — and this is my favorite, in the way a root canal is your favorite — they're from the FBI itself, calling personally to help you, a regular citizen, recover your funds. Because that's famously how the FBI spends its afternoons.

And then comes the masterstroke, the detail that makes people's guard drop: they know things. They know the platform that scammed you. They know roughly how much you lost. They might know the date. Your heart lifts — finally, someone who understands, someone official, someone who can fix this.

Then, inevitably, the ask. They can get your money back — it's practically sitting in an account waiting for you — they just need a small fee first. A "retainer." A "processing charge." A "release tax." An "anti-money-laundering verification deposit," which is a beautiful phrase that means absolutely nothing. The number is always just small enough relative to what you lost that paying it feels rational. Lost $40,000? What's a $2,500 retainer to get it back? That math is the trap. There is no $40,000. There is only the $2,500, and it's about to be gone too.

Anatomy of a recovery scam, decoded beat by beat

That's the shape of it in prose. Here it is as the sequence it actually is — each step engineered to lower your guard for the next. Naming the move at each stage is what inoculates you: once you can see the lever, you can't unsee it. This is the version the FTC warned about on 3 June 2026, recreated.

If a contact like this reached you, the agency-impersonation version is broken down in full in our piece on the fake-FTC-agent warning.

The one rule, again, because it ends every version of this

You've heard it from us before and you'll hear it until we're hoarse, because it's the single most useful sentence in fraud prevention:

Not a recovery agent. Not a law firm that found you first. Not a government agency. Not the "compliance department." Not the nice man who is definitely from your bank. The instant the conversation requires money to flow out of you before anything flows in, you are not being rescued. You are being robbed, again, by someone who read about your first robbery in a spreadsheet.

A word about the people who are supposed to help

Now, I'd be a hypocrite to spend this whole piece sneering at the scammers without saving a little for the system that leaves the door wide open for them.

Here's the genuinely maddening part. Real recovery is sometimes possible — through completely free, legitimate channels. When victims report fast, the FBI's recovery process can actually claw money back: in 2024, on the cases it acted on, it froze $469 million out of $651.5 million in reported losses. That's not nothing. That's most of it. The legitimate machine, when it engages, works.

The Bureau has even started doing the recovery scammer's job in reverse. Through an effort called Operation Level Up, FBI agents now cold-call people they can see are being defrauded — 8,103 of them as of December 2025 — and here is the number that should stay with you: 77% of those people had no idea they were in a scam when the phone rang. So the legitimate version of the "we're calling to help you" call does exist. The difference is the only one that ever matters: it never asks you for a fee. The same line separates real compensation from the con — when the OneCoin victims' fund began returning money it was free, yet scammers still surfaced to charge people for "access" to it.

So no, I won't pretend the answer is simply "just trust the authorities." The authorities, frankly, could try a lot harder to be trustworthy and reachable. But here's what's still true, and what the scammers are betting you'll forget in your panic: the legitimate routes are free and they're the only ones with any chance of working. The expensive route — the friendly stranger with the retainer fee — has a zero percent success rate by design. It was never going to recover anything. Recovery was never the product. You were the product.

How to tell the rescuer from the second robber

If someone contacts you about recovering lost funds, run down this list. Any single one of these means walk away:

The crypto version passes every test above, because the trace is real

Everything on that checklist assumes the recovery man is lying to you. Usually he is. But there's a version of this con aimed at people who lost crypto, and it survives the list — because the central thing it sells you is true.

A public blockchain records every transaction forever. If you sent crypto to a scammer, the movement of that money is genuinely visible, and anyone can follow it hop by hop. So when a "crypto recovery" firm produces a tracing report showing exactly where your coins went, the report can be perfectly accurate. Nobody has to fabricate anything. The technology does what it says.

Which is why the ordinary tells don't fire. You may have gone looking for them, so the contact wasn't unsolicited. The evidence they hand back is checkable. There is no obvious lie to catch. The credibility isn't faked — it's borrowed from a technology that works, which is the same trick as the badge and the screenshot in the props department.

The lie isn't in the report. It's in what the report is allowed to imply. A trace answers where did the money go. It cannot answer can I get it back. Those are different questions, and the second one isn't decided by evidence at all — it's decided by who has the legal power to move funds. The FBI puts the structural reason plainly:

“Private sector recovery companies cannot issue seizure orders to recover cryptocurrency. Cryptocurrency exchanges only freeze accounts based on internal processes or in response to legal process.”

— FBI, Seeking Victim Information in Cryptocurrency Recovery Fraud Investigation, 3 September 2024

Read that twice, because it settles the whole question. However good the trace is, the company holding it has no mechanism to act on it. The power sits with the exchange and the courts, and neither takes instructions from a private report you paid for.

So the deliverable becomes the tell. The FBI describes recovery-fraud operators charging an up-front fee and then either vanishing or producing “an incomplete or inaccurate tracing report” before requesting further fees — and tells victims outright that if you paid upfront and got back “a questionable tracing report and form letters to send to financial institutions,” you may be a victim of recovery fraud. Form letters. You paid for stationery and a PDF. This is not hypothetical: in the same notice, the Bureau's San Diego Division says it seized web domains belonging to MyChargeBack, Payback LTD and Claim Justice pursuant to an investigation into cryptocurrency recovery fraud, and is still asking people who paid those companies to come forward.

One check you can run before you pay anyone: look at where the reviews live

Everything above tells you what to ask the firm. Here is something you can find out without asking them anything, and it takes about thirty seconds.

The standard advice is to look for reviews. That advice fails here, and it fails for a specific reason: reviews are the one thing these operations manufacture at scale. A firm with no clients and no history can have a hundred glowing testimonials by Friday. So checking whether praise exists tells you nothing. What tells you something is where that praise is sitting.

Search the firm's name and read the results as a set rather than one by one. A real business that has been trading for years leaves a footprint in places that make sense for its trade: industry press, a regulator's register, a court record, a consumer body, a journalist who covered a case. The footprint is uneven and some of it is unflattering, because that is what a real record looks like.

A manufactured footprint looks different, and once you have seen it you cannot mistake it. Every result is either the firm's own site or a promotional post praising it, and those posts are sitting on forums that have nothing to do with money, fraud or crypto. We have watched this pattern on operations whose entire search presence consisted of testimonials posted to a 3D-printing forum, a Windows help forum, a spyware-removal board and a design tool's community. Nobody discussing 3D printers has an opinion about crypto recovery. Those posts are there because the forum allowed open registration, and nothing else.

Three more things worth checking in the same half-minute, because they are matters of public record rather than opinion. How old is the domain? A free WHOIS or RDAP lookup returns the registration date, and a firm claiming a decade of experience on a domain registered last year has told you something it did not mean to. Is there a company registration number, a named officer, a licence? Real financial firms are registered somewhere and say so. What does the contact address look like? A supposedly established firm running on a free webmail account is not an oversight.

None of these checks require you to understand crypto, and none of them depend on catching the firm in a lie. They are all things you can verify from the outside, before any money moves — which is the only moment when checking is still cheap.

If you've lost money: the actual, free, boring, effective steps

No retainer. No agent. No magic. Just the unglamorous things that actually give you a chance:

You're allowed to be angry. Just don't be a target.

If you've read this far because it already happened to you — the first scam, maybe the second — I want to be clear that the sarcasm in this piece was never pointed at you. It's pointed at them: the ones who built an industry on people's worst day, and the systems comfortable enough to let it run.

You were not foolish for hoping someone could help. Hope is not a character flaw. It's the most human thing there is, and they weaponize it precisely because it's universal. The shame belongs to the people selling false hope back to you at a markup — not to the person desperate enough to want to believe them.

So be angry. It's the appropriate response. Then channel it into the one thing that actually inconveniences these people: refusing to pay, telling someone, and reporting it.

And remember the rule that turns every recovery scammer back into the nobody they are: you never pay upfront to get your money back. Ever.