In this guide 10 sections
At a glance
The short version.
Watch for
- An unexpected contact who already knows details of an earlier scam
- A guarantee that all or most money has been recovered
- Upfront retainers, taxes, gas fees, insurance or release charges
Already acted?
Stop all further fees and revoke any wallet, app or remote-access permissions that were granted.
See every recovery stepWhat is changing now
The current pattern.
Recovery scams use accurate details about an earlier loss to appear unusually credible. The contact may claim to be a regulator, police officer, lawyer, blockchain investigator, bank agent or claims company. They promise recovered funds but require a retainer, tax, wallet connection, identity document or remote access before release.
How it works
How the scam unfolds.
Victim details can come from the original scammers, public complaint posts, data leaks or lead lists sold between criminal groups. Knowing the amount, platform and timeline proves access to information—not access to recovered money.
The recovery contact creates a visible success: a traced wallet, court document, frozen balance or refund cheque. Release then depends on one more payment or disclosure. Each fee receives a plausible label such as tax, gas, insurance, verification, administration or anti-money-laundering clearance.
Legitimate dispute and law-enforcement processes vary, and recovery is never guaranteed. The safest route begins with the provider that handled the original payment and an official public reporting channel, not with a stranger who guarantees an outcome.
Warning signs
Reasons to stop and verify.
- An unexpected contact who already knows details of an earlier scam
- A guarantee that all or most money has been recovered
- Upfront retainers, taxes, gas fees, insurance or release charges
- A request to connect a wallet, share a recovery phrase or install remote access
- Official-looking documents or balances visible only through the contact’s portal
- Pressure to keep the recovery confidential or act before a case deadline
Spot the signs
What it can look like.
Highlighted phrases are warning signs; the numbered notes explain each one.
Global Asset Recovery Unit1 (warning sign 1) <cases@intl-fund-recovery.example>
Case RCV-20931: $18,450 recovered in your name2 (warning sign 2)
Dear Client,
We have traced the funds you lost to TradePro Markets in March3 (warning sign 3) and frozen them in a secure wallet with the help of international authorities.
To release your $18,450, a refundable compliance fee of $1,200 is required.4 (warning sign 4)
Please connect your wallet through our portal within 48 hours5 (warning sign 5), or the funds will be returned to the state treasury.
- An official-sounding name
Titles like ‘Global Asset Recovery Unit’ are easy to invent. Find any real agency through its own published website instead.
- A guaranteed result
Genuine recovery processes cannot promise an exact amount in advance. A precise figure is bait.
- Details of your real loss
Knowing the platform and month shows they have information about the original scam — possibly because they are connected to it.
- A fee to release money
Legitimate authorities do not charge victims a fee to return recovered funds.
- Wallet access and a deadline
Connecting your wallet can let them drain it. The deadline is there to stop you checking first.
Work through your bank and official reporting channels, and ignore anyone who approaches you offering recovery for a fee — even if they know details of your case.
Composite example: names, numbers and “.example” addresses are fictional.
Worked example
A realistic pattern, separated into evidence.
This composite example is educational. It does not describe a real person or reproduce a live malicious message.
A ‘blockchain investigator’ knows the exact loss
- 01The opening
Weeks after an investment scam, a caller names the fraudulent platform and the approximate amount lost. They say an international task force traced the cryptocurrency to a frozen wallet.
- 02The escalation
A professional portal displays the recovered balance and official-looking documents. To release the funds, the victim must pay a wallet-validation fee and connect a cryptocurrency wallet within 48 hours.
- 03The decision point
Specific knowledge can come from the original crime. The portal and documents remain under the new contact’s control, while the fee and wallet connection create a second path to loss.
Independent verification
Test the request without using its evidence.
These checks deliberately move the decision away from the person, link, number or account that introduced the request.
- 01
Return to the original provider
Use the bank, card issuer, payment app, exchange or wire service that handled the transaction. Ask for its official fraud and dispute process.
- 02
Verify the authority independently
Find the regulator, police service, court or agency through its public website and ask whether the case, employee and process exist.
- 03
Check the fee logic
A demand for new money, wallet access or identity data before release creates fresh risk and is not proof of recovered funds.
- 04
Protect the existing case record
Add new evidence to the original report. Do not let a new contact take over accounts, devices or communication with providers.
Prevention
Make the next attempt harder.
- 01
Expect a second approach
After a scam, treat any new contact about your case — and new investment, job or romance approaches — with extra caution.
- 02
Keep a record of official contacts
Write down reference numbers and contact details for your bank and any official report, so you can check a follow-up through those channels.
- 03
Limit public details about your loss
Posting amounts and platform names in public forums can attract recovery scammers. Share the details with official services instead.
- 04
Secure accounts after a loss
Change passwords, turn on stronger sign-in and review devices on any account the original scammers may have seen or accessed.
If you already acted
Protect access and contact the real provider.
- Stop all further fees and revoke any wallet, app or remote-access permissions that were granted.
- Contact the payment provider for both the original loss and the new recovery payment.
- Move remaining crypto assets only with help from the official wallet or exchange support process; never share a recovery phrase.
- Secure email and financial accounts and preserve the recovery portal, documents, contacts and transactions.
- Add the second approach to the existing fraud or police report and report the impersonated organisation.
Common questions
Short answers to real doubts.
How do recovery scammers know about my loss?
Details can come from the original scammers, from victim lists traded between criminal groups, from data breaches or from public posts describing a loss. Knowing about your case is not proof that someone can help.
Are there legitimate ways to try to get money back?
Yes, although recovery is never guaranteed. Contact the bank, card issuer or payment service you used as soon as possible, report the crime to the police or your national fraud-reporting service, and keep your records. None of these routes asks you for an upfront release fee.
Steps by payment methodWhat about a recovery company with good online reviews?
Be very cautious. Reviews and testimonials can be fabricated, and fake recovery firms invest in convincing websites. Do not pay an upfront fee or share wallet access with a company that approached you, and check any firm independently with your regulator or consumer-protection agency.
Sources
Official guidance used for this article.
Stop & Verify summarises these sources for general education. Reporting routes and legal protections vary by location.