Recovery Scams: Spot Fake Refund Promises

You Lost Money. Now Someone Promises to Get It Back.

Recovery scams turn the hope of getting your money back into another opportunity to steal from you.

You have already lost money. Perhaps it was a fake investment, an online relationship, a job offer or a trading platform that stopped allowing withdrawals. Then someone contacts you with the news you desperately wanted: your money has been found. They introduce themselves as an investigator, lawyer, hacker or official. They know the company’s name, the amount you paid and perhaps the dates of your transfers. Before they can return the funds, however, there is one more payment.

That is the danger of recovery scams. The first approach persuaded you to trust an opportunity. The second persuades you to trust a rescue. The FBI specifically warns that cryptocurrency-fraud victims are subsequently targeted by people promising to recover their losses. FBI guidance for cryptocurrency-fraud victims.

A recovery offer deserves the same scrutiny as the original offer that cost you money. Before paying anyone, sharing identity documents or granting access to your devices, establish who is contacting you, what they can actually do and whether their claims can be independently verified.

What Are Recovery Scams?

A recovery scam is a fraudulent offer to retrieve money or assets lost through an earlier scam. The supposed rescuer may claim to have located the funds, secured compensation or obtained authority to release a refund. Their real objective is another payment, sensitive information or access to your accounts. These schemes are not limited to cryptocurrency. The FTC warns about refund and recovery approaches following many kinds of fraud. FTC explanation of refund and recovery scams.

The distinction matters: genuine recovery is sometimes possible, but a convincing promise is not evidence that this particular person can deliver it. You do not have to abandon legitimate options. You do need to verify a new approach independently of the person making it.

How Do They Know About Your Original Loss?

Knowing your history can make a stranger sound authoritative. But information about the original fraud may already be in criminal hands. The FTC explains that scammers buy, sell and exchange lists containing victims’ contact details, the type of fraud and amounts paid. The UK’s Financial Conduct Authority also warns that the original scammers may return under a different identity or pass victims’ details to another operation. FTC recovery-scam guidance, FCA recovery-room warning.

You may also encounter recovery advertisements while searching for help, or recommendations beneath scam-related articles and videos. The FBI has documented these routes, alongside direct approaches through social media and messaging platforms. Finding a service yourself does not make it trustworthy. FBI warning about fraudulent cryptocurrency-recovery companies.

Knowing where you sent your money does not prove that someone has recovered it. They may simply have access to the same information as the people who took it.

Scammers also watch where victims talk: comments under scam warnings, Facebook groups and online forums. The FBI has described criminals creating fake profiles, joining support groups for fraud victims, posing as fellow victims, and then recommending a “recovery” contact. FBI warning, reported by Teiss

South Africa has seen this too. In January 2025, the FSCA warned that people and companies were contacting investors who had lost money on Banxso, offering to recover their losses for a fee. Moonstone Banxso was linked to the deepfake investment ads covered in Deepfake Scams in South Africa.

Why the Second Approach Can Feel More Convincing

After a financial loss, you may be exhausted, frightened or reluctant to tell your family. A patient person who appears to understand what happened can feel like the first useful help you have received. The promised recovery offers more than money: it offers relief from debt, embarrassment and uncertainty.

The FBI’s August 2025 warning about fictitious law firms explicitly identifies exploitation of victims’ emotional state and financial need. This is manipulation, not evidence that victims are unintelligent. A useful protective step is to involve someone you trust before agreeing to another payment. An independent person can assess the proposal without carrying the same urgency to make the original loss disappear. FBI warning about fictitious recovery law firms.

How Big Is the Problem in 2025?

• United States: the FBI received 10,516 complaints about recovery scams in 2025, with reported losses of about $1.4 billion. People aged 60 and older reported the most: $540.5 million. The FBI notes these figures may include money lost in the earlier scam that led to the recovery contact. FBI IC3 2025 Internet Crime Report
• United Kingdom: almost one in five scams reported to the Financial Conduct Authority in 2025 (17%) mentioned a recovery room scam, and about 70% of those involved crypto. TransUnion freedom-of-information data from the FCA
• Belgium: the financial regulator received 183 reports of recovery fraud in the second half of 2025, with more than €850,000 lost. FSMA figures, via Keytrade Bank
• Why it works: in a 2025 US survey, two out of three scam victims (66%) said they couldn’t recover any of the money they lost. That desperation is exactly what recovery scammers sell to. Stop Scams Alliance and Gallup

The Different People Who Promise to Rescue You

The fake investigator presents a case file, transaction diagram or supposed discovery of frozen funds. The fake lawyer sends formal correspondence and claims to be handling a settlement. The fake official invokes a regulator, police unit or international authority. Each role gives the payment request a different appearance of legitimacy.

The FBI has documented criminals impersonating actual lawyers, copying law-firm letterheads and claiming government affiliations. Its 2025 advisory also describes fake foreign-bank websites and group chats involving supposed attorneys and bank processors. Several people agreeing with one another in a chat are not independent verification; they may be participants in the same scheme. FBI fictitious-law-firm advisory.

The supposed hacker or technical specialist offers a different promise: a shortcut around banks, exchanges and legal procedures. Treat claims that someone can effortlessly reverse a completed transaction or access a criminal’s wallet as claims requiring evidence, not proof of expertise. Technical language does not establish lawful authority or control over the funds. Never authorise unlawful access as a recovery method.

Some rescuers target people who are being blackmailed over intimate images, promising to delete the material or stop the blackmailer for a fee. If someone is threatening to share images of you, read what to do right now and where to get help.

“Your Money Has Been Found” Is Where the Payment Trap Begins

A typical approach separates the supposed discovery from the supposed release. You are told that recovery has succeeded, but an administrative charge, tax or legal fee remains. The FCA warns that recovery rooms use these explanations to demand advance payments, sometimes producing losses greater than the original fraud. Professional websites and claims of successful recoveries can support the deception. FCA guidance on recovery-room scams.

Consider this fictional example: someone who lost $8,000 receives a message claiming that $7,600 has been recovered. Paying $250 to release it seems preferable to losing everything. After payment, another obstacle appears. The amounts are illustrative, but the decision trap is clear: each new payment is presented as the final step toward a much larger return.

Ask what can be checked outside the recovery company’s own website, documents and messages. A balance displayed on a supplied platform is not confirmation from the institution supposedly holding the money.

Cryptocurrency Tracing Is Not the Same as Recovery

A report tracing transactions may help an investigation. It does not, by itself, give the report’s author access to a wallet or authority to seize assets. The FBI states that private recovery companies cannot issue cryptocurrency seizure orders. Exchanges freeze accounts through their own processes or in response to legal process; civil litigation may also be an option. FBI explanation of cryptocurrency-recovery limitations.

This is why the promised deliverable matters. Are you buying an analysis, legal advice or actual representation? Or are you being promised that money already exists in an account and will become yours after payment? The FBI has warned about firms taking advance fees, disappearing or supplying incomplete or inaccurate tracing reports before requesting more money. A report is not a refund, and a traced transaction is not a recovered asset. FBI recovery-company warning.

They May Want Access, Not Just Another Fee

Australia’s Scamwatch warns that recovery scammers may request identity documents, fake paperwork and remote access to computers or phones. Those requests can expose a victim to further financial loss and identity misuse. Do not let an unverified recovery contact control a device used for banking or email. Scamwatch warning about repeat targeting.

Never disclose banking passwords, one-time security codes, wallet private keys or a wallet’s recovery phrase to a supposed rescuer. A recovery phrase is not a case reference or verification code: it can provide control of the wallet. Coinbase’s guidance explains that sharing a recovery phrase gives another person access. Coinbase explanation of recovery-phrase security.

How to Verify a Recovery Offer Independently

Do not rely on the contact details, registration certificate or reference number supplied by the person approaching you. Start a separate verification process:

• For a lawyer: check the relevant legal regulator’s register, then contact the genuine firm through independently obtained details. Confirm that the named person works there and that the firm actually sent the proposal.
• For an official: find the agency’s contact details yourself and ask it to verify the person, case and claimed process.
• For a financial or claims-management business: check whether authorisation is required locally and whether its permissions cover the offered service.
• For any proposed payment: establish the recipient, purpose, written terms and verifiable basis for the charge before considering it.

A real professional’s name can be stolen. The Solicitors Regulation Authority warns about bogus solicitors and cloned identities; finding a genuine name on a register is only the beginning of verification. These checks should be adapted to the country and profession involved. SRA guidance on bogus solicitors.

• In South Africa: Check the FSCA’s official website to establish whether a financial services provider is authorised for the services it claims to offer. You can also contact the FSCA on 0800 110 443. An FSP registration does not, by itself, prove that a particular recovery offer is genuine or that the provider can retrieve your money. Verify the identity of the actual business and the scope of its authorisation independently. FSCA
• For suspected criminal fraud: Report the incident to the South African Police Service (SAPS) and retain your case reference. Notify your bank or payment provider promptly if money was transferred. See our guide, How to Report a Scam in South Africa.
• Check a lawyer with the Legal Practice Council (or your country’s law society), then phone the firm on a number you found independently.
• Check the website itself: how old the domain is, who’s behind it, and whether the success stories appear anywhere independent. Our guide How to Check if a Business Is Legit walks you through the free tools.

Before You Trust Another Online Offer, Investigate It

A recovery service may sound convincing, but what does the evidence actually show?

Before committing to a new offer, examine the website, the promises being made, the identity of the business and the payment instructions. Look for inconsistencies between what is advertised and what can be independently verified.

AdUncovered helps consumers investigate suspicious online offers using information such as website URLs, screenshots, advertisements, messages and supporting documents.

An investigation can help identify warning signs and unanswered questions before you make another financial commitment. It does not guarantee recovery of lost funds or replace an official fraud investigation.

Have you received a suspicious recovery offer? Visit AdUncovered to learn how to investigate the offer before deciding what to do next.

Recovery Offer Verification Checklist

Before trusting a recovery service, work through these checks:

• Identity: Can you verify the person’s full name, professional credentials and actual role?
• Business registration: Does the business exist independently of the website or documents supplied by the person contacting you?
• Regulatory status: If the service claims to be a financial services provider, is it authorised for the activities it offers?
• Independent confirmation: Can the named law firm, bank, regulator or other institution confirm the person’s involvement through contact details you found yourself?
• The proposed work: Is the service offering transaction analysis, legal representation or something else? Is the deliverable clearly defined?
• The payment: Is the recipient identifiable, and is the fee explained in a written agreement?
• The recovery claim: What independent evidence supports the claim that funds have actually been located or secured?
• Access and privacy: Are you being asked for passwords, one-time PINs, wallet recovery phrases or remote access to your device?

A professional-looking website, registration certificate, transaction diagram or case reference is not sufficient proof on its own.

If you cannot independently verify the identity, authority and proposed recovery process, do not proceed on the strength of the promise alone.

Does Charging a Fee Always Mean Fraud?

No. Legitimate lawyers may charge for advice, representation and legal work. The SRA explains that clients should receive information about costs or how they will be calculated. A professional fee for a clearly defined service is different from an unverified demand to unlock supposedly recovered money. SRA guidance on understanding legal costs.

Before instructing a professional, ask what work will be done, who will do it, what it costs and what limitations apply. Ask about jurisdiction, likely timescales and the possibility that recovery will fail or cost more than it produces. Do not treat a contract, registration or “no recovery, no fee” slogan as a guarantee. Independently verified identity and understandable terms are essential, but the proposed work must also make sense for your circumstances.

Genuine Refunds and Official Recovery Processes Do Exist

Some enforcement cases produce real refunds, restitution or other distributions. For example, the FTC publishes active refund programmes and their administrators on its official website. It also warns that it will not require you to transfer money to obtain a refund. FTC official refund programmes.

A genuine process may require evidence of your loss or identity. That does not mean you should submit documents through an unsolicited link. Locate the official case notice yourself, confirm the administrator and follow the verified instructions. The question is not simply whether someone contacted you. It is whether the contact and process can be independently authenticated.

From Our Own Experience: Even Trained People Get Caught

The founder of AdUncovered worked for many years on the IT payments side of a major South African bank, where fraud awareness was part of regular compliance training. Even so, cheap prices and online offers caught her out more than once. If it can happen to someone trained to spot fraud, it can happen to anyone.

What got her money back wasn’t a “recovery agent”. It was three things:

• Calling the bank’s fraud helpline straight away. The fraud teams are very well trained. They stopped the card and started the recovery process.
• An evidence folder. Screenshots of the offer, the website, the messages and the payment, ideally taken before paying. That evidence is what made the recovery possible, even for an EFT payment.
• Acting fast. A normal EFT can’t be reversed once it has settled. But while it’s still clearing, the bank may be able to stop it. Minutes matter.

One important exception: instant payments such as PayShap clear in seconds, and banks state that they can’t be stopped or reversed once submitted. Standard Bank PayShap terms Be extra careful before paying a stranger that way.

What to Do If You Have Already Paid

Stop further payments and contact the bank, card issuer, payment service or exchange you used immediately. Explain both the original fraud and the recovery approach. Ask what can still be stopped, recalled, disputed or otherwise investigated. Options depend on the payment method, timing and applicable rules; a refund is not guaranteed. The FTC recommends contacting the company used to send the money promptly. FTC steps after paying a scammer.

In South Africa, report it to SAPS and get a case number, since banks and insurers often ask for it. For a full list of who to contact, see How to Report a Scam in South Africa.

Preserve messages, agreements, invoices, payment details, website addresses and account names before blocking contact. For cryptocurrency, retain wallet addresses, the asset and network used, transaction hashes, amounts, dates and times. IC3 identifies transaction details as important evidence for cryptocurrency-fraud reports. Do not confuse a public transaction hash with a secret recovery phrase. IC3 cryptocurrency-reporting guidance.

Report the second scam as well as the first to the relevant police or cybercrime reporting service in your country. If credentials or device access were shared, use a trusted device to contact your bank and secure affected accounts; obtain reputable technical help where needed. If identity documents were disclosed, seek local identity-protection guidance. For a broader action checklist, read what to do immediately after being scammed.

Do Not Let Shame Make the Next Decision

Tell someone you trust what happened, including any new payment requests. You do not need to solve the entire loss before asking for support. Being targeted again is not a reason to hide; it is a reason to bring another person into the decision.

Recovery scams sell the possibility of undoing a painful mistake. But the next approach must stand on independently verifiable evidence, not on how badly you need its promise to be true.

You lost money once. Someone knowing your story does not give them the right to take more.

More Help Before You Pay Again

For immediate steps after a loss, read our guide to what to do after being scammed. Explore our scam research and help guides for more warning signs and practical checks.

If you’d rather not check a recovery firm alone, AdUncovered can research its website, registration claims and public track record for you and give you a source-linked report, so you can decide before you pay. To be clear: we don’t recover money, and we don’t give verdicts. We show you what the public evidence says. See report options.