The second scam arrives as help: recovery promises after a loss
Someone knows what happened and says they can get the money back. Check the route, the promise and the next payment before trusting the role.
After a loss, the most persuasive message may be the one that sounds like the end of the problem. A person offers to trace the funds, unlock a frozen balance, move your complaint to the front of a queue or connect you with an investigator. They may know details that make their arrival feel legitimate.
Knowledge of the loss is not authority to recover it. An unexpected recovery offer should not lead to another payment, a wallet recovery phrase, remote access or more identity documents. Start with the institution that handled the money and official reporting routes you find independently.
Why the details can sound convincing
You may have posted publicly, sent records to an earlier scammer or discussed the loss with a supposed support team. The FTC’s recovery-scam guidance explains that information about previous victims can be reused and traded. A caller’s knowledge can therefore come from the problem, not from legitimate access to its solution.
Even without a detailed record, an offer can begin broadly and become specific as you answer questions. You do not have to explain every account, transaction and document to someone before deciding whether their identity is established. Verification should precede disclosure, not be promised after it.
The role may change between messages: investigator, lawyer, consumer advocate, hacker, regulator or exchange employee. Do not evaluate the claim only by how impressive the title sounds. Ask how you independently reached that organization and whether the requested action belongs to its published process.
Separate three different kinds of help
A payment provider’s process concerns a transaction handled by that provider. You reach the bank, card issuer, payment app or exchange directly and ask what can be stopped, disputed or recalled. The provider determines what options exist under its process and applicable rules.
An official report provides information to an authority or consumer agency. It may help identify patterns or support an investigation. Filing it does not automatically reverse a payment or mean an investigator has been assigned to your individual case.
An unsolicited recovery service is a new counterparty making a new claim. Its promises need independent scrutiny. It does not become official because it cites a report number, uses a badge image or says it works with an authority.
| Route | What to verify | What not to assume |
|---|---|---|
| Bank or payment provider | You reached the provider through an established app, statement or official site | That every transfer can be reversed |
| Police or consumer reporting | You are using the agency’s genuine reporting route | That a report guarantees repayment |
| A professional you independently seek | Identity, credentials, scope, fees and applicable jurisdiction | That credentials guarantee an outcome |
| Someone who contacts you unexpectedly | Why they have your details and whether the organization confirms the contact independently | That accurate details prove authority |
The existence of legitimate paid legal or technical work does not validate an unsolicited promise of guaranteed recovery. If you choose professional advice, establish the relationship independently and understand what service is actually being provided.
The “last fee” does not make the next payment safer
A claimed release fee can be described as a tax, insurance payment, anti-money-laundering deposit, network cost or administrative charge. The label may sound procedural. What matters is that another payment is being demanded before an unverified party delivers the promised result.
Do not send a small amount as a test if doing so leaves you dependent on the same person’s explanation of what happens next. Do not trust a dashboard showing recovered funds without independent confirmation from the institution supposedly holding them. A new screenshot can be as unverified as the original balance.
Do not disclose a wallet recovery phrase or private key. Those secrets are not evidence of a loss; they can give control of assets. A recovery story does not change their function. Similarly, a one-time code or remote session may authorize account access rather than merely help someone inspect a case.
Build a useful record without reopening the scam
Write down the original payments, the method, dates and transaction references. Keep the messages and account identifiers you already possess. Record any later recovery approaches separately so it is clear which money went to which party.
Avoid rewriting the record as a confident technical explanation. You may know that you followed a link and sent money, but not who operated the site or where the funds ultimately went. State the observable facts and mark uncertainties. That is more useful to a provider than a theory copied from a discussion board.
Do not return to suspicious sites or send another message merely to collect more evidence. Do not publish unredacted documents asking strangers to identify the recipient. Share private records through the verified process of the institution or authority that needs them.
Contact the provider while the facts are still fresh
The FTC’s guidance for people who were scammed recommends contacting the relevant payment service and asking about available remedies. Describe accurately whether someone used your account without permission or deceived you into making the payment yourself. Do not change the facts to fit a category you think sounds more refundable.
Ask for a reference number and the next step. If documents are required, confirm where to submit them through the provider’s own system. If you receive a later call referencing the case, you can still end that call and check it through the provider’s established route.
For identity exposure, use the relevant official guidance for your country. In the United States, IdentityTheft.gov provides a reporting and recovery-planning route. For internet-enabled crime reports, IC3 is an official US starting point. Our source directory distinguishes these routes from this publication.
Public posts can attract private offers
Support communities can help people recognize a pattern and feel less isolated. But an unsolicited direct message following a public post is not vetted advice merely because it appears in a community context. Be cautious of commenters who immediately direct you to a particular recovery account or claim a contact retrieved all their money.
You can ask general questions without posting account numbers, private chats, wallet secrets or identity documents. Keep discussions of a suspected person factual and avoid targeting someone whose name or image may have been copied. Reporting an account to a platform is different from publicly identifying an alleged operator.
The emotional cost is part of the situation
The urge to recover money quickly is not evidence of poor judgment. It is an understandable response to uncertainty, financial pressure and a loss of control. A scammer can exploit that urgency by presenting a short path back to normality.
Try to give one trusted person a defined supporting role: help organize the records, sit with you during a provider call, or review an unexpected offer before you answer it. Do not make another payment just to avoid telling them about the first one.
If the original loss involved a job, read the task-deposit guide. If remote access was granted, use the device and account branches in the fake-support guide. Different exposures can coexist; securing one does not automatically resolve the others.
Found a factual error or a source that has changed?
Send a correction →
