A "fund recovery" service contacts you after you were already scammed
After you've lost money to a scam, you're contacted by a "recovery agent," "law firm," or "crypto recovery specialist" claiming they can get your money back — for an upfront fee. They are usually the same scammers (or partners) using lists of known victims.
Also known as: recovery room scam, secondary fraud, crypto fund recovery scam
Already happened to you? Do this in the next few minutes
- 1 Call your bank or card's fraud line right now. Use the number on the back of your card — not any number from the message or caller. Ask them to stop or reverse the payment and freeze the account.
- 2 If you paid by gift card, wire, or an app (Zelle, Venmo, Cash App): contact that company immediately and report it as fraud. Acting fast sometimes recovers the money.
- 3 Report to the FBI at ic3.gov and the FTC at reportfraud.ftc.gov. The sooner, the better.
- ! If you installed any "support", "server", "refund", or remote-access app at their request (AnyDesk, TeamViewer, Quick Support, etc.): disconnect the internet now, then run free SeraphSecure (https://www.seraphsecure.com) to detect and remove it.
What to do right now
- 1 Treat any unsolicited 'recovery' offer as a second scam targeting you
- 2 The FBI, FTC, and IC3 do not charge fees and do not refer victims to private recovery services. Period
- 3 If a real attorney would actually take your case on contingency, they would not need upfront fees from you
- 4 Block the caller and add the number to your phone's spam list
- 5 Report the recovery scam itself: it is itself a federal crime
- 6 If you installed any 'support' or 'server' or 'refund app' or remote-access app at the scammer's request (AnyDesk, TeamViewer, Quick Support, etc.), run free SeraphSecure (https://www.seraphsecure.com) to detect and remove it.
- 7 Report to the FTC at https://reportfraud.ftc.gov and the FBI's IC3 at https://www.ic3.gov.
Was remote-access software installed?
If a scammer asked you to install AnyDesk, TeamViewer, Quick Support, or any remote-access app, your device may still be compromised.
Run SeraphSecure to detect and remove it →Red flags
- ⚠ They contact you out of the blue and seem to know exactly what scam you fell for
- ⚠ They guarantee recovery — no legitimate service does this
- ⚠ Fees are required upfront, often by gift card, wire, or crypto
- ⚠ They claim to work with the FBI, FTC, IC3, or a court — none of those organizations endorse private recovery agents
- ⚠ Repeat victimization — victim lists are sold among scammers
If you were scammed once, your name and contact may now be on lists sold among scammer networks. Recovery scams are the standard follow-up. They exploit the desperation of victims to extract a second round of money — sometimes more than the original loss.
The legitimate path: report your original scam to the FTC and IC3. Tell your bank. If you sent crypto, file at IC3 within 24-72 hours; the FBI’s Financial Fraud Kill Chain has occasionally recovered funds, but it does not work through paid agents. Anyone calling you with a fee is the next scam.
If you were scammed once, your name and contact may now be on lists sold among scammer networks. Recovery scams are the standard follow-up. They exploit the desperation of victims to extract a second round of money — sometimes more than the original loss.
The legitimate path: report your original scam to the FTC and IC3. Tell your bank. If you sent crypto, file at IC3 within 24-72 hours; the FBI’s Financial Fraud Kill Chain has occasionally recovered funds, but it does not work through paid agents. Anyone calling you with a fee is the next scam.
Known variants
-
Scammers create fake websites mimicking ic3.gov. Fraud victims searching online for the IC3 reporting portal land on a spoofed site, enter personal and banking details, and are then contacted by 'IC3 staff' demanding a fee to 'recover' the lost funds.
Last seen: 6/6/2026
-
Impersonator texts a fake FTC employee photo ID badge to 'verify' their identity, then claims they can recover the victim's lost money. They direct the victim to pay a fee, move funds to a 'protected' account, or surrender cash or gold to a courier. The FTC warns these imposters drain more than $1 billion annually.
Last seen: 6/6/2026
Sources
- FBI — Crypto-recovery scams
- FTC — Recovery scams target people who lost money
- FBI IC3 — PSA250418: Scammers impersonating IC3 to re-victimize prior fraud victims (Apr 2025)
- FBI IC3 — PSA250919: Threat actors spoofing the IC3 website to steal victim data (Sep 2025)
- CyberNews — FBI alert: IC3 impersonation via Telegram fake personas targeting fraud victims (2026)
- HackRead — FBI Warns of Fake IC3 Websites Designed to Steal Personal Data (2026)
- FBI IC3 — 2025 Internet Crime Annual Report: $20.8B total losses, recovery scam re-victimization cited (Apr 2026)
- FTC Consumer Alert — A real FTC employee won't text you their photo ID to 'verify' their identity (Jun 2026)