GACS Research Team

SECOND-HIT FRAUD ALERT

They're already planning to scam you a second time.

Up to 1 in 3 fraud victims gets hit again — usually within 90 days — by a "recovery" scam. Same crew, different mask. Here's how to spot it before you pay.

9 red flags of a recovery scam

1. Up-front fee to 'release' your funds

Real lawyers and investigators bill by the hour or take a percentage on recovery. Anyone asking for a wire, crypto, or gift-card payment up-front is the scam.

2. Claims to be a hacker who can reverse blockchain transactions

Bitcoin, Ethereum, USDT and other public chains are irreversible. No hacker, AI, or 'crypto tracer' can 'pull funds back' from a wallet they don't control.

3. Cold-called you on Telegram, WhatsApp, Instagram, or email

Real law enforcement and regulators do not message scam victims directly. They send official letters from a government domain.

4. Uses a gmail / outlook / proton address claiming to be a government agency

Police, FBI, FTC, IC3, CFTC, AMF, FCA — all use official .gov / .gouv domains. A free-email address is an instant disqualifier.

5. Shows you a fake 'court order' or 'frozen wallet' screenshot

Anyone can make a screenshot. Verify by going to the agency's official site directly — never click links sent to you.

6. Pressure tactic: 'act in 24 hours or the funds are gone'

Manufactured urgency is the #1 fraud signal. Real recovery takes weeks to months.

7. Was found via a fake Trustpilot / Reddit / Quora review

Scam rings flood review sites with success stories. Never hire a recovery service you found through a comment or testimonial.

8. Asks for your wallet seed phrase or remote access (AnyDesk / TeamViewer)

Sharing your seed phrase or screen is handing them every dollar you have left.

9. Promises a guaranteed result

No legitimate professional guarantees recovery. They give probabilities, not promises.

Legitimate recovery vs recovery scam

There ARE real professionals who help fraud victims — attorneys, licensed private investigators, and blockchain-analytics firms. The difference is not "who they claim to be" but how they charge, communicate, and set expectations.

Legitimate professional

• Bar-association or licensing body verifiable in 60 seconds
• Bills hourly or takes a percentage on actual recovery — no upfront wire
• Talks in probabilities: "we may recover 10–40%"
• Communicates from a firm domain, not gmail/proton/outlook
• Refuses to promise a specific timeline or amount
• Never asks for your seed phrase or remote access to your machine

Recovery scam

• Cold-messaged you on Telegram / WhatsApp / Instagram / X DM
• Demands an upfront "retainer", "insurance", or "tax" payment
• Guarantees a full refund, often within 48 hours
• Shows a fake court-order screenshot or "frozen wallet" dashboard
• Address is on a free-email service, or a lookalike government domain
• Pressures you: "the window closes tonight"

The 3 lines that end a recovery-scam call

You do not have to explain, argue, or be polite. Read these verbatim and hang up:

1. "Send me your firm's website URL. I'll call you back on the number listed there."
A real firm has a real switchboard. A scammer does not.
2. "I don't pay retainers upfront. Bill me from recovered funds."
Watch them pivot to "tax", "insurance", or "customs". Same money, new label.
3. "I will only proceed through my own attorney. Please send your credentials to them."
They will vanish. Real professionals will happily comply.

What actually works

Report to your country's official fraud line (IC3 in the US, Action Fraud in the UK, your bank's fraud team for card/wire).
File a chargeback within 60–120 days if you paid by card. Banks have a duty to investigate.
For crypto: report the wallet address to GACS, Chainabuse, and the exchange where the funds landed. Exchanges can freeze if reported fast.
Talk to a licensed attorney — bar-association verified — before paying anyone a dollar to "recover" funds.
Lock down email, change passwords, enable 2FA on every financial account.

GACS · free community-verified scam intelligence

More scam guides

Recovery scams target people who've been hit by these other patterns.

By scam type

Full scam index →Latest alerts →Check a link / wallet →Report a scam →

See related alerts

Fresh cases from the GACS intelligence feed that match this hub.

Recovery scam alerts

Latest alert digests

Weekly and thematic scam roundups from the GACS intelligence feed.

Quick answers

A recovery scam is a second scam that targets people who already lost money by promising to retrieve it for an upfront fee. No legitimate service guarantees fund recovery in advance.

What is a recovery scam?

A recovery scam targets previous fraud victims with a promise to recover their lost money for an upfront fee, a 'tax', or a 'wallet unlock' payment. The recovery never happens and the fee is stolen.

How do I spot a fake fund-recovery service?

Warning signs are an upfront fee, a guarantee of recovery, contact that came to you unsolicited, claims of law-enforcement or exchange connections, and pressure to pay in crypto or gift cards.

Are there legitimate ways to recover scammed funds?

Yes — through your bank's chargeback or recall process, your card issuer, the receiving exchange's compliance team, and law enforcement. All of these are free to initiate and none guarantee an outcome.

Authoritative sources

Independent primary sources used to check and corroborate the guidance on this page.

FBI Internet Crime Complaint Center (IC3)
Official US channel for reporting internet-enabled fraud and cybercrime.
US Federal Trade Commission — ReportFraud
Consumer fraud reporting and published enforcement data.
UK Action Fraud
UK national reporting centre for fraud and cybercrime.
Canadian Anti-Fraud Centre
Canada's central repository for fraud reports and scam alerts.