The caller knew your name. They knew how much you lost, when you lost it, and how you paid. They said they worked for a government agency — or a law firm, or a consumer advocacy group — and they had good news: your money had been located. They just needed a small fee to process the recovery.
If that sounds familiar, you are not alone. And the person on the phone was not there to help you.
I spent 17 years inside bank fraud investigations. I have reviewed dispute files from victims who came back a second time — not because they made the same mistake twice, but because someone contacted them after the first scam and sold them hope. That hope cost them thousands more.
This is how the second scam works. Not the one that takes your money the first time. The one that finds you afterward, knows exactly what happened, and offers to make it right.
“If someone asks you to pay to recover your money, stop and verify.”
— Rebecca Harlow
Key Takeaways
Refund and recovery scammers buy lists of people who have already been scammed. The FTC calls these “sucker lists,” and they include your name, contact information, the type of scam that worked, and how much you paid.
Nearly 61,000 complaints of law enforcement or government impersonation scams were filed with the FBI’s IC3 between January 2025 and July 2026, with losses exceeding $1.6 billion.
The FBI has confirmed that scammers are using AI-generated deepfake videos of FBI personnel to direct victims to spoofed IC3 websites that collect personal information.
Legitimate recovery services never charge upfront fees. Under the Telemarketing Sales Rule, recovery room operators cannot request or receive payment until seven business days after they deliver recovered money to you.
If you have been contacted by a recovery scammer, do not engage. Document the contact, report it to the FTC and IC3, and tell someone.
How They Find You: The List You Didn’t Know You Were On
The moment you were first scammed, your information became a data point. And that data point is for sale.
Refund and recovery scammers buy lists of people who have already been scammed, hoping they can be scammed again. The FTC calls these “sucker lists.” They typically contain names, phone numbers, email addresses, demographic details, and behavioral markers — including the specific scam that succeeded, how the victim responded, and their communication habits. Some lists even contain notes on emotional states, such as whether the person is lonely, grieving, or elderly.
These lists come from multiple sources. Scammers who run the original scam may sell their own victims’ information to other fraudsters. Data brokers have been prosecuted for knowingly selling lists of vulnerable consumers to fraudsters. And scammers sometimes infiltrate support groups for scam victims, posing as fellow victims to identify people who are still struggling and still hoping for recovery.
The logic is brutally simple. If you fell for a scam once, the fraud networks consider you a proven responder. Scammers are not just looking for individuals who fall for a scam once. They are looking for those who respond predictably, obey instructions without resistance, and maintain contact even after warning signs emerge.
Your name is on a list. The question is what you do when someone uses it.
How the Scam Works: A Step-by-Step Anatomy
Recovery scams follow a script. Recognizing the steps makes them harder to fall for.
Step 1: The Contact
Someone reaches out to you. It may be a phone call, a text message, an email, a social media message, or even a letter. You did not initiate this contact. You do not know this person.
The FBI has documented that scammers contact victims through multiple channels, including phone calls, emails, instant messaging apps like Facebook Messenger and Telegram, social media ads, and online forums. Some victims receive an unsolicited call. Others see an advertisement on social media promising recovery services. Others are approached in a messaging app after commenting on a post about scam recovery.
Step 2: The Pretense
They claim to be someone with authority. The impersonation targets are specific and deliberate:
FTC employees or “agents.” The FTC has issued alerts about scammers pretending to be FTC employees who claim they can help you recover money lost in a scam. They may send you a photo of a fake employee ID and badge to “verify” their identity.
FBI or IC3 personnel. The FBI has repeatedly warned that scammers impersonate IC3 employees, contact victims through phone calls or messaging apps, and direct them to fake IC3 update pages. The IC3 has no social media presence, never initiates contact by phone, email, or chat app, and never asks for payment to recover lost funds.
Law firms or “consumer advocacy groups.” Fake “money recovery law firms” pose as legal professionals who can recover stolen funds. They often appear through social media ads, search ads, and messaging apps such as WhatsApp or Telegram. Sygnia, a security firm, identified a large-scale recovery scam network spanning more than 100 domains, with law firms representing a primary impersonation target.
Step 3: The Trust-Building
They use the details from your original scam to sound credible. They may reference transaction amounts, dates, or the payment method you used. They may cite a “case number” or “claim ID.” The FBI has confirmed that scammers have escalated their tactics to include AI-generated deepfake videos impersonating IC3 leadership to add legitimacy to the scheme.
These videos depict senior FBI leaders encouraging users to submit victim complaints on spoofed IC3 websites. The fake sites mimic the real ic3.gov but strip the complaint workflow down to a single form requesting only name, phone number, email address, scam type, and estimated financial loss. Once you submit the form, the site gives you a reference number and says someone will be in touch. That someone is the recovery scammer.
Step 4: The Ask
This is the moment the scam reveals itself. They need something from you before they can “recover” your money. The FTC has documented the exact language they use: they will tell you to pay a “retainer fee,” “processing fee,” or “administrative charge,” or share your financial information so they can supposedly deposit the refund.
Under the Telemarketing Sales Rule, recovery room operators cannot request or receive payment until seven business days after they deliver the recovered money to you. That means any upfront fee is not just a red flag — it is a violation of federal law.
Step 5: The Repeat
If you pay, they will ask for more. The “recovery” will encounter “complications.” There will be “legal fees” or “clearance charges.” Or they will simply disappear with your money and your information. The average secondary loss is estimated at $5,000 to $15,000, and recovery scams target an estimated 30–40% of identified fraud victims, often within 90 days of the original loss.
The Pressure Tactics They Use
Recovery scammers are not passive. They are trained to overcome your hesitation. Here are the tactics they use most often.
Urgency. You are told to act quickly or risk losing the opportunity to recover your funds. Scammers use pressure to stop you from checking their claims. “The funds will be released today only.” “Your claim will expire in 24 hours.” The deadline is manufactured to prevent you from thinking clearly or verifying their story.
Isolation. Some scammers tell you to keep the recovery process “confidential.” They may say the investigation is sensitive, or that speaking to family or your bank could jeopardize the case. This is not a legitimate process. Secrecy isolates you, which is exactly what they want.
Authority and fear. They may claim to be from the FBI, the FTC, or a law enforcement agency. They may use aggressive tones, refuse to speak to anyone other than you, and keep you on the phone for the duration of the scam. The FBI has documented that some scammers demand payment through prepaid cards, couriers, bank wires, cryptocurrency, or cash inserted into cryptocurrency kiosks.
Guaranteed recovery. No legitimate investigator can guarantee the outcome of a recovery effort. If someone promises you a specific result — especially with 100% certainty — they are lying.
Payment methods that cannot be traced. If they ask for cryptocurrency, gift cards, or a wire transfer, it is a scam. These payment methods are untraceable and irreversible. Legitimate legal and recovery services accept traceable payments through normal financial channels.
What Real Agencies Will Never Do
The FBI and FTC have both published clear guidelines. Learn these. They are your defense.
A real FTC employee will NOT:
Contact you by text message or a messaging app like WhatsApp
Text you a photo of their employee ID to “verify” their identity
Claim to help you recover money you lost in a scam and ask you to pay them, move your money into an account they specify, or give them your financial information
The FBI’s IC3 will NOT:
Have any social media presence
Initiate contact by phone, email, or chat app
Ask for payment to recover lost funds
The CFPB will NEVER:
Contact you and ask you for sensitive information or to pay money
Ask you to pay an upfront fee or taxes, or tell you that you’ve won a lottery or class-action lawsuit
No legitimate organization will:
Ask you to pay upfront for a refund or for help getting one. Under the Telemarketing Sales Rule, recovery room operators cannot request or receive payment until seven business days after they deliver the recovered money
Guarantee that you will get your money back
Ask you to keep the process secret from your bank or family
If someone does any of these things, they are a scammer. The FTC states this in plain language: “Anyone who does is a scammer”.
Red Flags: How to Spot the Second Scam
Run through this list before you engage with anyone who contacts you about recovering lost money.
The contact came out of nowhere. You did not seek them out. They found you. Legitimate recovery services do not cold-call scam victims.
They know details about your original scam. This feels reassuring. It should feel alarming. It means they have your information from a list.
They ask for an upfront fee. This is the single most reliable red flag. Legitimate recovery services do not charge upfront. Under the Telemarketing Sales Rule, it is illegal for recovery room operators to request or receive payment until seven business days after they deliver the recovered money.
They ask for your bank account information to “deposit” recovered funds. They do not need your account number to deposit money. They need it to steal from you.
They want payment by gift card, cryptocurrency, wire transfer, or payment app. These methods are untraceable and irreversible. No legitimate business operates this way.
They create urgency. “The funds will be released today only.” “You must act within 24 hours.” Urgency is a manipulation tactic.
They tell you to keep it secret. Legitimate processes do not require secrecy from your bank or family. Secrecy isolates you, which is exactly what they want.
They claim to be from a government agency. The FTC, FBI, and CFPB do not call you to offer recovery services. They do not charge fees. They do not ask for your financial information.
They claim to “work with” or “have contacts inside” the FBI, SEC, or Interpol. Real agencies do not accept private contractors. No legitimate recovery service has special access to government databases or law enforcement operations.
How to Verify Before You Engage
If someone contacts you claiming they can recover your money, do not take their word for anything. Verify independently.
Search their name online. Add words like “complaint,” “scam,” or “review.” The FTC explicitly recommends this step.
Look up government agency contact information yourself. Do not use any number or link they provide. If they claim to be from the FTC, go to ftc.gov directly and find the contact information yourself. The FBI advises typing ic3.gov directly into your address bar and avoiding sponsored search results.
Check attorney credentials through your state bar association. If they claim to be a law firm, look up the attorney’s name in your state’s bar directory. Fake recovery law firms often use the names of real attorneys without their knowledge, or invent credentials entirely. Real law firms can be verified through state bar registries.
Check the email domain. Recovery rooms generally use web-based email addresses, such as Gmail, Yahoo, Hotmail, or other free providers. Legitimate government agencies, law enforcement, and law firms do not use webmail providers to contact consumers.
Ask how they got your information. If they claim to be from a government agency or law enforcement, ask how they obtained details about your case. Reports of fraud can only be shared between law enforcement agencies. They cannot be shared with a private business operating a recovery room.
What to Do If You Are Contacted
If someone contacts you claiming they can recover your lost money, here is your sequence.
Do not engage. Do not call back. Do not reply. Do not click links. Do not provide any information.
Document the contact. Write down the phone number, email address, name used, and what they said. This information is valuable for reporting.
Report it. File a report with the FTC at ReportFraud.ftc.gov. If the scam involves cryptocurrency, a fake law firm, or online fraud, report it to the FBI’s IC3 at ic3.gov. If they impersonated a government employee, that is a federal crime and should be reported.
Warn others. If you are part of a support group, online community, or family network, share what happened. Your experience protects others.
If You Already Paid a Recovery Scammer
Do not blame yourself. That is the first thing.
The shame you feel is the scammer’s most effective tool. It keeps you from calling your bank. It keeps you from filing a report. It keeps you from telling anyone. The system is designed to make you feel stupid so you stay silent. You are not stupid. You were targeted by professionals who do this for a living.
Here is what to do now:
Stop all contact. Do not send more money. Do not provide more information. Block the numbers and email addresses they used.
Contact your bank immediately. If you paid by debit card, credit card, wire, or payment app, report the transaction. Use the language from our guide on unauthorized vs. authorized transactions. If the payment qualifies as unauthorized under Regulation E, you may have liability protections.
Report to the FTC and IC3. File at ReportFraud.ftc.gov and ic3.gov. Even if recovery is unlikely, the report creates a record and helps authorities connect your case to broader patterns.
Secure your identity. If you shared personal information, place a fraud alert or credit freeze with the credit bureaus. Report to IdentityTheft.gov if your Social Security number or other sensitive information was exposed.
Tell someone. You do not have to carry this alone. Call the AARP Fraud Watch Network Helpline at 877-908-3360. This free resource is available to people of any age, and trained volunteers can help you evaluate what happened and what to do next.
Protecting Yourself Going Forward
You cannot remove your name from every list. But you can make yourself a harder target.
Place a credit freeze with all three bureaus. A freeze prevents creditors from accessing your credit report, which stops most new account openings. It stays in place indefinitely until you lift it.
Use multi-factor authentication on every account. Especially on your email, which is the recovery key for everything else.
Be skeptical of unsolicited contact. If someone contacts you about a refund, a prize, or a recovery, assume it is a scam until you can independently verify otherwise. The FTC’s advice is simple: don’t trust someone who contacts you claiming they can recover your lost money for a fee.
Talk about what happened. Isolation is the scammer’s ally. Tell a family member, a friend, or a support group. If you are contacted again, tell them. They can help you spot what you might miss.
No comments yet.