How to Spot a Crypto Recovery Scam

Key Takeaways

1. A recovery scam is a second scam aimed at people who already lost money. Fraudsters buy or reuse victim data, then pose as lawyers, investigators, or government staff who can get the money back for a fee.
2. Any upfront fee is the clearest warning sign. The FTC states that government agencies and legitimate organisations do not charge people money to help them get a refund, and the FBI says the IC3 never charges a fee to recover funds or refers victims to companies that do.
3. Recovering stolen crypto is rare, slow, and driven by law enforcement and exchanges, not by a website that promises results in 48 hours. Reporting is free, and it is the step that actually creates a chance of recovery.

What Is a Crypto Recovery Scam?

A crypto recovery scam is a follow-up fraud that targets people who have already lost cryptocurrency to a scam, a hack, or a fake investment platform. The scammer offers to trace, freeze, or return the stolen funds. In exchange, they ask for an upfront payment, personal documents, wallet access, or all three. Nothing is recovered. The victim loses a second time.

The FBI uses the term re-targeting for this pattern and also refers to it as a recovery or double-dip scam. Investigators describe it plainly as revictimization, because the people being approached have already been identified as reachable, emotionally invested, and willing to pay.

Regulators in North America use several names for the same thing. Securities regulators call it a recovery room scam. Consumer agencies file it under refund and recovery fraud or advance fee fraud. California's financial regulator lists it in its crypto scam tracker as an asset recovery scam. The label changes. The mechanics do not.

Why This Scam Is Growing

Crypto fraud provides a large and easily identified pool of targets. The FBI's 2025 Internet Crime Report recorded 181,565 complaints involving cryptocurrency, with reported losses above 11 billion US dollars, out of a total of more than 20.8 billion dollars in reported cybercrime losses that year. Investment fraud alone accounted for roughly 8.6 billion dollars.

Recovery fraud feeds on those numbers. Between February 2023 and February 2024, victims who were further exploited by fictitious law firms reported additional losses of more than 9.9 million US dollars to the FBI's Internet Crime Complaint Center. That figure only covers people who reported the second loss. Many do not, because of embarrassment, which makes the real total higher than the reported one.

These are reported figures from complaint data, not audited totals. Actual losses are widely believed to be higher because most fraud goes unreported.

How the Scam Works, Step by Step

The approach is consistent across cases documented by the FBI, the FTC, and state regulators.

1. The target list. The FTC describes lists of previous fraud victims that scammers buy, sell, and trade, sometimes called sucker lists. These contain names, contact details, the type of scam involved, and the amount lost. In some cases the original scammers sell the list, or simply pass it to a colleague running the recovery operation.

2. First contact. Approaches come by phone, email, text, social media message, forum comment, or paid advertisement. Search results are also used, including sponsored links that imitate official websites.

3. Manufactured credibility. The contact claims to be a lawyer, a blockchain investigator, a cybersecurity firm, an exchange compliance officer, or a government official. The FBI has documented fraudsters claiming they received the victim's case file from the FBI, the Consumer Financial Protection Bureau, or another agency. Real banks and exchanges are name-dropped to sound convincing.

4. The fee. The request is framed as a retainer, filing fee, processing charge, tracing report, unlock fee, bond, back taxes, or a small verification payment on the account that will receive the funds. Payment is requested in crypto, gift cards, wire transfer, or a payment app, because those are hard to reverse.

5. The drip. After the first payment, either communication stops, or a low-quality tracing report arrives followed by a request for more money to complete the job. The pattern of a repeated final fee is a defining feature of the scheme.

New Tactics: AI Video, Fake Agencies, and Spoofed Websites

In July 2026 the FBI issued an updated public service announcement about criminals impersonating IC3 staff. The alert describes AI-generated videos showing a senior FBI figure encouraging people to file complaints on a fake IC3 site. The spoofed site copies the look of the real one but only accepts a short form asking for name, phone number, email, scam type, and estimated loss, then issues a reference number and promises follow-up contact.

The FBI also documented cases where a victim tells the original scammer they plan to report the fraud, and is contacted shortly afterwards by someone posing as an FBI agent on Facebook Messenger, who moves the conversation to Telegram and sends a link to update the complaint. The link harvests data or delivers malicious code.

Two facts cut through all of it. The IC3 does not maintain a social media presence and does not recover funds through Facebook, Telegram, or similar platforms. The IC3 will never ask for payment to recover lost funds, and will never refer someone to a company that charges for recovery.

Red Flags Checklist

Legitimate Help Versus a Recovery Scam

A note on paid services. Some blockchain forensics firms and licensed lawyers do real work, usually for large or commercial losses, and they can produce tracing evidence that supports a law enforcement case or a civil claim. Even then, securities regulators warn that some third-party asset recovery firms charge thousands of dollars to compile publicly available blockchain information or to file complaints that the victim could file free of charge. Before paying anyone, ask what is being delivered, what it costs, and how the fee is charged, and get the answers in writing. Verify a lawyer through the relevant bar association directly, using contact details you looked up yourself.

A Five Minute Verification Check

Before engaging with anyone offering help, run these four checks yourself.

• Check the domain. Look at the exact spelling and the ending. Names such as sec-recovery or ftc-refund are not government domains, and official United States agency sites end in .gov.
• Check the registration. Search the company name in the relevant corporate registry, and search the lawyer's name and bar number with the bar association directly.
• Check the search results. Search the company name together with words such as scam, complaint, or review, and avoid sponsored results when looking for an official body.
• Check the contact route. Call the agency or firm on a number you found yourself, never a number, link, or reference code supplied by the person who contacted you.

If any check fails, or if the person discourages you from running it, stop there.

What to Do Instead

1. Stop communicating. Do not reply, do not pay, do not send documents. Block and keep the messages.
2. Preserve evidence. Save transaction hashes, wallet addresses, dates, amounts, exchange names, screenshots, usernames, URLs, and phone numbers. Transaction details are the most valuable information you can give investigators.
3. Report it. Use official channels only. Type the address into your browser rather than clicking a link or trusting a sponsored search result, and confirm the domain before entering anything.
4. Tell the exchange. If funds moved to an account at a regulated exchange, its compliance team may be able to act, and speed matters.
5. Secure what remains. Move remaining assets to a new wallet with a newly generated seed phrase, review connected applications, and revoke token approvals.
6. Expect a second approach. Once you are on a list, more offers will follow. Treat every one of them as fraud.

The Honest Outlook

Blockchain transactions are generally irreversible, and stolen funds are usually moved quickly through mixers, bridges, and multiple wallets. Recovery, when it happens, comes from law enforcement seizures, exchange freezes, or court action, and it typically takes a long time with no guarantee of return. That reality is uncomfortable, and it is exactly the gap recovery scammers exploit. A realistic understanding of the odds is the best protection against a pitch built on urgency and hope.

This article is educational information, not legal or financial advice.

FAQ

Can stolen cryptocurrency ever be recovered? Sometimes, but it is uncommon. Recovery generally depends on funds reaching a regulated exchange that can freeze them, or on law enforcement action and asset seizures. It does not depend on paying a private service that contacted you.

Are all crypto recovery companies scams? No. Licensed lawyers and established blockchain forensics firms do legitimate work, mostly on larger cases. The concern raised by regulators is that many firms charge high fees for tasks a victim can do free, and that outright fake operators are common. The safe rule is that you approach them, they never approach you.

Why does the person contacting me know details about my loss? Details are not proof of legitimacy. Victim information circulates on lists that are bought, sold, and traded, and sometimes it comes directly from the people who ran the original scam.

Will the FBI or another agency ever contact me about recovering funds? Agencies do contact victims, but the IC3 does not communicate through social media or messaging apps, does not charge fees, and does not refer people to paid recovery firms. If someone claims an FBI affiliation, verify it by contacting a local field office directly.

What if I already paid a recovery scammer? Stop all contact and report both losses through official channels, including how you were approached and how you paid. If a bank card or transfer was used, contact your bank immediately. Do not accept help from anyone new who contacts you about the second loss.

Related Terms

• Advance fee fraud: Any scheme where a payment is demanded before a promised benefit is delivered.
• Sucker list: A traded list of previous fraud victims, used to select targets for follow-up scams.
• Revictimization: Targeting a person who has already been defrauded, in order to defraud them again.
• Blockchain tracing: Following the movement of funds between wallet addresses using public ledger data.
• Deepfake: Synthetic video, audio, or images generated with AI to impersonate a real person.

Sources

• FBI Internet Crime Complaint Center, "FBI Warns of Scammers Impersonating the IC3," Alert I-072026-PSA, 20 July 2026. https://www.ic3.gov/PSA/2026/PSA260720
• FBI Internet Crime Complaint Center, "Fictitious Law Firms Targeting Cryptocurrency Scam Victims Offering to Recover Funds," Alert I-062424-PSA, 24 June 2024. https://www.ic3.gov/PSA/2024/PSA240624
• Federal Trade Commission, "Refund and Recovery Scams," Consumer Advice. https://consumer.ftc.gov/articles/refund-and-recovery-scams
• FBI, "Cryptocurrency and AI Scams Bilk Americans of Billions," press release on the 2025 Internet Crime Report, April 2026. https://www.fbi.gov/news/press-releases/cryptocurrency-and-ai-scams-bilk-americans-of-billions
• CFTC, "6 Steps to Take After Discovering Fraud." https://www.cftc.gov/LearnAndProtect/AdvisoriesAndArticles/6Steps.html
• NASAA, "Informed Investor Advisory: Crypto Recovery Room Scams." https://www.nasaa.org/78036/informed-investor-advisory-crypto-recovery-room-scams/

Further Reading

1. FBI IC3, "Increase in Companies Falsely Claiming an Ability to Recover Funds Lost in Cryptocurrency Investment Scams," Alert I-081123-PSA. https://www.ic3.gov/PSA/2023/PSA230811
2. FBI, "Cryptocurrency Investment Fraud," victim resources page covering what transaction details to include in a report. https://www.fbi.gov/how-we-can-help-you/victim-services/national-crimes-and-victim-resources/cryptocurrency-investment-fraud
3. California DFPI, "Crypto Scam Tracker," a searchable database of reported scam types including asset recovery scams. https://dfpi.ca.gov/consumers/crypto/crypto-scam-tracker/

Disclaimer: This article is educational and is not financial, legal or investment advice. Regulatory rules and register locations change, so verify details with the relevant authority before acting.