Recovery scams are the cleanest, most-repeatable fraud pattern we track. They target people who have *already* lost money — emotionally raw, financially scared, and statistically the most likely group to fall for it twice. The pitches are nearly interchangeable. Below are the seven red flags that appear in 90%+ of confirmed cases. Tick three or more and the only correct action is to walk away.
1. They contacted you first
If you didn't post publicly looking for help, the conversation should not exist. Real lawyers, real chain-analysts and real consumer-protection bodies do not cold-DM victims. They are too busy and too liability-aware. 94% of confirmed recovery scams start with an unsolicited message — Telegram, X DM, WhatsApp, Instagram, or "reply to a comment you made on a Reddit thread".
2. They quote a number that's "feasible" but exact
Real recovery is uncertain — successful clawback rates are under 5%, and even then take 6 to 18 months. A recovery scammer says *"we can return 78% of your funds in 14 days"*. The specificity is the tell. They want you mentally booking the money before you read the fine print.
3. They ask for a fee up front
Any legitimate professional working on contingency takes a cut on success. Recovery scammers always need a fee first: a "smart-contract gas deposit", an "AML clearance fee", a "tax pre-payment", a "wallet activation". The pretext rotates; the structure does not.
4. They claim a non-existent credential
"FBI Crypto Recovery Division". "FCA Wallet Reclamation Unit". "Interpol Cyber Refund Department". None of these units exist. Real agencies operate complaint portals (IC3, Action Fraud, ReportCyber), not "recovery teams". If you can't find the unit on the agency's official site, the unit isn't real.
5. They have a polished website with no operating history
Type the firm's name into /safe-scanner. 80% of confirmed recovery scammers have a domain less than 6 months old, no Companies House / SEC / state-corporation filing, and no third-party news coverage. Polished UI is cheap; an audit trail is not.
6. They escalate when you hesitate
The legitimate response to "let me think about it" is *"of course, here's our contract — take your time"*. The recovery-scam response is urgency: *"the wallet rotates at midnight, we have to act now"*, or guilt: *"do you actually want your money back or not?"*. Pressure is a leading indicator.
7. They came from the same network that scammed you
The single most damning pattern: the data the recovery scammer uses about your case is data only the original scammer had. Your exact deposit amount. The exact platform name. The name of the "account manager" who walked off with your funds. In 31% of confirmed cases, the recovery operator and the original scam operator share infrastructure (hosting, payment rails, even staff handles). The "recovery" is the second slice of the same cake.
How to verify in 60 seconds
- Paste their domain into /safe-scanner — if it's on the blacklist you're done.
- Paste their company name into Companies House / SEC EDGAR / your country's registrar.
- Search "`firm name` scam" in Google with the year. Real recovery firms have reviews going back years.
- If they're claiming a regulator badge, check the regulator's own register, not the firm's site.
What to do if you've already paid
You almost certainly cannot recover the recovery payment, but you can stop the bleeding:
- Block every channel. Don't try to confront them — that just confirms you'll keep engaging.
- Change every password the firm has touched and revoke all wallet approvals at revoke.cash.
- File a formal complaint with your country's primary fraud agency. See the /blog/how-to-report-a-scam-in-us (and the other country guides) for the right portal.
- Report the recovery firm at /report so the next victim sees it on the public blacklist.
- Read the /recovery-scam-warning-signs page for the long-form rundown.
The cleanest defence is awareness. Once you can spot the pattern in five seconds, you stop being the target.
---
*Originally published at https://gacs.app/blog/recovery-scam-7-red-flags-2026. Recovery-scam playbook: https://gacs.app/recovery-scam.*