She met him on LinkedIn. His name was James Chen, a petroleum engineer on contract in Aberdeen. He was charming, patient, and attentive in a way that felt different from the apps. Over four months, he helped her through a difficult period after her divorce and called her every evening. Then, almost in passing, he introduced her to a cryptocurrency trading platform where he said he’d been quietly building his retirement fund.
She was skeptical at first. But James showed her his own portfolio. He walked her through every trade. She put in $5,000. It grew to $9,000 in two weeks. She put in $20,000 more. That grew too. By month six, she had transferred a total of $80,000 into the platform. When she tried to withdraw her profits, the platform told her she owed a “capital gains tax clearance fee” of $18,000 before any funds could be released. She paid it. Then there was a compliance audit fee. She stopped. She filed an IC3 complaint with the FBI and reported the exchange to the FTC. She told nobody else. She was fifty-three years old, recently divorced, and had just lost most of her liquid savings.
Three days after filing her IC3 complaint, her phone rang. The caller ID showed a Washington, D.C. area code. The man identified himself as Special Agent Michael Torres, FBI Cyber Division. He said her case had been flagged. He had her name. He had the amount she’d lost. He named the crypto exchange she had used. He said the FBI had identified the fraudster’s wallet address, and he read it back to her. The funds, he explained, had been traced and partially frozen pending a blockchain compliance process. To release the assets back to her, she would need to cover a $12,000 processing fee. It would be fully reimbursed, he said, as part of her recovery.
She paid it. The number was spoofed. Special Agent Michael Torres did not exist. This is a recovery scam.
The short answer. A recovery scam is a second fraud that targets people who have already lost money to fraud. Someone contacts you claiming to be law enforcement, a blockchain recovery firm, or a lawyer. They know real details about your case, because your victim profile was sold or you posted about it publicly. They promise to get your money back for an upfront fee, then take that too. No legitimate agency ever charges a fee to return a victim’s money, and confirmed crypto transactions cannot be reversed for a price. If you’re contacted, hang up, and call the agency back on a number from its official .gov site.
What a recovery scam is
A recovery scam is a second fraud that targets people who have already been defrauded. It arrives when you’re at your lowest. You’ve already lost money, already realized you were deceived, and you’re ashamed, exhausted, and desperate for any path back to what you lost.
The structure is consistent. Someone contacts you claiming to represent a law enforcement agency, a blockchain recovery firm, a legal team, or a compliance department. They know details about your case that feel impossible for a stranger to know. They offer to recover your funds. They charge an upfront fee — framed as a processing fee, a compliance deposit, a legal retainer, or a tax clearance — and then they disappear, taking that money too.
The FTC received more than 35,000 reports of recovery scam fraud in 2023 alone, with reported losses exceeding $100 million. That’s only the reported figure. Fraud victims report at much lower rates because of shame, especially romance and investment fraud victims. The actual number is estimated to be three to five times higher. Romance fraud victims are the most frequently targeted group, followed by victims of investment and cryptocurrency fraud.
You can be scammed twice. It happens to careful, educated people. Understanding why requires understanding exactly how these operations work.
How they found you
This is the part that stops most victims cold: how did the second scammer know what the first scammer had done to you?
Your IC3 complaint or FTC report contains your name, contact details, the amount you lost, and the nature of the fraud. These databases are not public. But victim report systems have been compromised before, and your information flows to people who would exploit it through several other reliable pipelines.
The most direct route is the original scammer. Pig butchering operations, the romance fraud model used in the case above, are run by sophisticated criminal organizations. They are often based in Southeast Asia, with structured call centers and detailed victim databases. When a victim stops paying or files a complaint, their profile doesn’t disappear. It gets sold. Dark web forums and private markets trade victim profiles openly: name, phone number, email, amount lost, the emotional angle that worked, how they communicated, what objections they raised. A victim who showed “high loss tolerance,” meaning they kept paying when asked, is worth more on resale than someone who stopped early. The second scammer buys the profile and knows exactly how to approach you.
Social media is another pipeline. After being defrauded, many victims search for answers. They post on Reddit’s r/Scams, on consumer fraud Facebook groups, on Twitter/X. They ask whether anyone has experienced the same thing, and whether any recovery is possible. Recovery scammers run automated monitoring on these platforms. They watch for keywords like “pig butchering,” “crypto scam,” “lost money,” “crypto recovery,” and “romance scam.” When you post publicly about what happened, you’re visible to anyone running those searches. Scammers direct-message victims within hours of their posts.
Search behavior is another vector. If you repeatedly search “how to recover stolen crypto,” “crypto recovery service,” or “can you reverse a bitcoin transaction” over several days, your search profile gets associated with that intent. Data brokers aggregate browsing behavior, demographic data, and purchase history into profiles. Some of those profiles end up in the hands of people who have no legitimate business buying them. The ad targeting that shows you recovery services after you search for recovery services isn’t always coming from legitimate companies.
Sometimes the law enforcement angle works because your complaint actually was filed. The scammer doesn’t necessarily know you filed one. They’re taking a calculated guess. Many fraud victims do file reports. The “we received your FBI complaint” opening line succeeds often enough to be worth trying on every victim profile they purchase.
The types of operations they run
Recovery scams take several forms, and each one is calibrated to a different type of victim and a different type of fraud.
Law enforcement impersonation is the most sophisticated. The caller claims to be from the FBI Cyber Division, the FTC, IC3, INTERPOL, or a financial crimes unit. They use real agency names, real-sounding badge numbers, real-looking spoofed phone numbers. They reference real processes — asset freezes, blockchain compliance, victim restitution funds — using enough accurate language to sound credible. Their goal is to get you to believe that government action has already been taken and that your funds are within reach.
Blockchain recovery specialists present themselves as technical experts who can trace cryptocurrency transactions and reverse or recover funds. This is built on a fundamental misrepresentation of how blockchain technology works. Confirmed cryptocurrency transactions are final. There is no mechanism within the protocol to reverse them. The only realistic path to recovery involves a regulated exchange voluntarily cooperating with law enforcement — and that requires the fraudster to have kept the funds in a centralized, regulated account, which sophisticated operators do not do. No private company can “reverse” a blockchain transaction for a fee.
Legal firm impersonation involves fake law firms with professional-looking websites, official-sounding names, and listed attorneys with bar numbers that either belong to real lawyers being impersonated or are entirely fabricated. These firms claim to be pursuing the fraudster in civil court and to have obtained judgments that allow asset seizure. They charge retainer fees and then bill for each stage of the fabricated legal process.
Crypto exchange impersonation targets victims who used a specific platform. The scammer poses as a compliance officer from Coinbase, Binance, Kraken, or whichever exchange the victim named in their report. They claim the fraudster’s account has been flagged and that the victim’s funds are held pending verification — and that a verification fee is required to release them.
White hat hacker services are marketed as ethical hackers who use specialized tools to trace crypto wallets, infiltrate the scammer’s accounts, and retrieve stolen assets. These services typically advertise on forums where fraud victims congregate. They charge a fee, produce a fake “investigation report,” and then either disappear or keep billing for follow-up work.
Why it works — the psychology of the already-defrauded
To understand why recovery scams succeed, you have to understand the specific mental state of someone who has just been defrauded. It is not the state of someone who is naive or inattentive. It is, in some ways, a state that makes people harder to protect, not easier.
The first and most counterintuitive factor is shame. Most fraud victims do not tell their families or close friends what happened. The social stigma around being scammed is enormous. It carries an implicit judgment that the victim was foolish, greedy, or inattentive. Many victims carry what happened entirely alone. That isolation means nobody is checking the victim’s reasoning, nobody is asking obvious questions, nobody is there to say “wait, the FBI doesn’t charge processing fees.” The recovery scammer operates in that vacuum.
The second factor is desperation. When you have lost $80,000, you are not in a comfortable, rational mental space. You are in crisis. The loss has real material consequences — for your retirement, for your children, for your sense of security. When someone calls and tells you that a portion of that loss might be recoverable, the information doesn’t arrive in a mind that’s calmly evaluating probabilities. It arrives in a mind that wants, very badly, for it to be true.
The third factor is sunk cost pressure. Behavioral economics has a name for this: the sunk cost fallacy. Once you’ve already lost $80,000, spending another $12,000 to get it back doesn’t feel like spending $12,000. It feels like spending $12,000 to retrieve $80,000. The framing shifts the decision entirely. The number in your head isn’t the $12,000 you’re about to spend — it’s the $80,000 you’re trying to get back. Recovery scammers understand this instinctively, and they calibrate their “recovery fees” as a small fraction of the stated recoverable amount.
The fourth factor is eroded trust and its paradoxical consequences. After being scammed, many victims assume they’ve now learned what scammers look like. They imagine they’ll recognize one the next time. But the model they’ve built in their heads is of the first scammer — the romance fraud, the fake investment advisor, the crypto platform. The recovery scammer looks nothing like that. They’re abrupt, official, bureaucratic. They don’t flatter you or build a relationship. They call from a government number, use technical language, and seem impatient — which reads, to someone primed for warm, manipulative charm, as professionalism and authenticity.
The fifth factor is confirmation bias. You filed a police report. You expected something to happen. When a call arrives that appears to confirm that something happened — that the report was received, that an investigation is underway — it aligns perfectly with your expectations and hopes. Confirming evidence requires almost no scrutiny. Disconfirming evidence is what requires effort to process.
How they collect the money
The payment method a recovery scammer asks for is one of the clearest signals of what they are. They know this, and they calibrate accordingly.
Wire transfer to a “Department of Justice asset recovery account” sounds official and is, to many victims, familiar as a payment method. The account doesn’t belong to the DOJ. Once the wire clears, the money is gone.
Cryptocurrency is increasingly the medium of choice. The scammer frames it as necessary for technical reasons — the assets are being released on-chain, and the compliance deposit must also be made in crypto to enable the transaction. Cryptocurrency transactions are irreversible, which benefits the scammer. They may also claim this provides additional privacy protection for the victim.
Gift cards are still used, but primarily by lower-sophistication operators. Any legitimate entity that asks for an iTunes gift card or a Google Play code is not a legitimate entity. The more polished operations avoid gift cards specifically because they’ve become culturally recognized as a scam signal.
Multiple payments are common. The first fee unlocks the “frozen” assets. Then there’s a tax clearance requirement. Then a compliance audit. Then an insurance bond. Each fee is justified as a necessary step in a bureaucratic process that keeps extending. Some victims have paid four or five fees before stopping. At each stage, the emotional math keeps being recalculated: the recoverable amount minus the fees already paid is still more than not paying the next fee.
What you can actually do if you’ve been defrauded
Real options exist, though they’re narrow. The most important step is to report immediately, and to multiple agencies. That means the FBI’s IC3 (ic3.gov), the FTC (reportfraud.ftc.gov), and your state attorney general’s consumer protection office. If the fraud involved a cryptocurrency exchange, report directly to that exchange’s fraud team. Regulated exchanges sometimes cooperate with law enforcement and can place holds on accounts where they still have funds.
Real cryptocurrency tracing firms do exist. Chainalysis, Elliptic, and CipherBlade are companies that analyze blockchain transactions for law enforcement agencies and financial institutions. They trace — they map where funds moved after leaving your wallet. They do not recover. And they work with law enforcement agencies as contracted partners, not directly with individual victims for fees. If a company contacts you claiming to be one of these firms offering to recover your funds for a payment, it is not them.
The realistic probability of cryptocurrency recovery in a romance or investment fraud is very low. Sophisticated fraud operations move funds through mixers, privacy coins, and multiple wallets within minutes of receiving them. The FBI and other agencies do occasionally recover funds. The Colonial Pipeline ransom recovery in 2021 showed that law enforcement can access cryptocurrency in certain cases. But those recoveries involve investigators accessing private keys through technical work, not a compliance process you can pay to start.
Your bank may be able to reverse or dispute a wire transfer if you act immediately — within 24 to 48 hours in some cases. Contact your bank’s fraud department the moment you realize what has happened, not after filing reports.
Legitimate agencies will never do this
The FBI does not call fraud victims out of the blue to offer recovery assistance. They receive your IC3 complaint and process it as part of their intake. They may contact you if your case becomes part of a broader investigation. But that contact comes in writing, from a verifiable office address, and never involves a payment.
The FTC does not charge fees to process fraud complaints. They do not have the authority to freeze individual wallets or release funds to victims. The FTC investigates patterns of fraud and takes action against companies — they are not a recovery agency for individual victims.
IC3 is an intake platform. It receives complaints and routes them to relevant law enforcement agencies. Nobody from IC3 will call you to say your case has been escalated and offer to return your money.
INTERPOL does not contact members of the public directly about fraud cases. They coordinate between national law enforcement agencies. An individual claiming to be an INTERPOL agent calling your personal phone number about your crypto recovery is not from INTERPOL.
No legitimate government agency charges processing fees, compliance deposits, release fees, or any other payment to a victim in order to return that victim’s money.
Red flags of a recovery scam
Not every operation is as polished as the one described above. These are the signs that whoever has contacted you is running a fraud:
- They contacted you first. You did not reach out to them — they called, emailed, or messaged you. Real law enforcement investigations are not announced by outbound calls to victims with fee requests.
- They know specifics about your case. This feels like proof of legitimacy. It is proof that your victim profile was purchased or that you posted publicly about what happened.
- They’re asking for money upfront. Any government agency, legal firm, or recovery service that requires a fee before they can help you is not what they claim to be.
- The fee is framed as a deposit, tax, compliance bond, clearance, or insurance — something that sounds bureaucratically necessary and temporary.
- They’re applying time pressure. “The freeze expires in 48 hours.” “We need the compliance payment by close of business today or the funds will be released back to the fraudster.” Urgency is manufactured to prevent you from thinking clearly or consulting anyone else.
- The contact number doesn’t match any official listing. Always independently verify a number against the official website — .gov domains for U.S. agencies, official national police sites for international agencies — before calling it back or trusting a number someone provides to you.
- The website looks professional but is newly registered. A domain registered within the past few months for a “law firm” or “blockchain recovery service” is not a years-established business.
- Their social media presence is thin or recently created. Real firms have histories, reviews, employees with verifiable professional backgrounds.
- They communicate primarily through WhatsApp, Telegram, or Signal. Legitimate law enforcement agencies do not use personal messaging apps for official case communications.
- They accept gift cards, ask for cryptocurrency transfers to a wallet, or request payment methods that are irreversible. Any request to pay via gift card is, without exception, a scam.
If someone contacts you claiming to be recovering your funds
Do not engage with the call or message beyond getting the caller’s name, badge number (if they claim to be law enforcement), and the agency they claim to represent. Do not confirm the details of your case. Do not agree to anything.
Hang up. Then call the agency directly, using a number you find on their official website. For the FBI, that’s fbi.gov. For the FTC, ftc.gov. For IC3, ic3.gov. If the caller claimed to be a specific agent with a specific office, you can verify whether that office exists through the FBI’s field office directory. You can also submit tips at tips.fbi.gov.
Do not call back the number they gave you. Do not reply to the email they sent you. The number is spoofed and the email is a scam domain. Look up the agency independently and make contact that way.
If you’ve already paid, report it immediately to your bank or the transfer service, to the FTC at reportfraud.ftc.gov, and to IC3. Document everything: the phone numbers, the emails, the names they used, the payment details. This documentation may be useful if law enforcement does investigate the operation as part of a larger case.
The person who called you is counting on the fact that you want to believe them. That wanting is not a character flaw — it’s a human response to loss. Recognizing it for what it is — and pausing before acting on it — is the only defense.
The fraud happened once. It doesn’t have to happen again.