SECOND-HIT FRAUD ALERT

They're already planning to scam you a second time.

Up to 1 in 3 fraud victims gets hit again — usually within 90 days — by a "recovery" scam. Same crew, different mask. Here's how to spot it before you pay.

9 red flags of a recovery scam

1. Up-front fee to 'release' your funds

Real lawyers and investigators bill by the hour or take a percentage on recovery. Anyone asking for a wire, crypto, or gift-card payment up-front is the scam.

2. Claims to be a hacker who can reverse blockchain transactions

Bitcoin, Ethereum, USDT and other public chains are irreversible. No hacker, AI, or 'crypto tracer' can 'pull funds back' from a wallet they don't control.

3. Cold-called you on Telegram, WhatsApp, Instagram, or email

Real law enforcement and regulators do not message scam victims directly. They send official letters from a government domain.

4. Uses a gmail / outlook / proton address claiming to be a government agency

Police, FBI, FTC, IC3, CFTC, AMF, FCA — all use official .gov / .gouv domains. A free-email address is an instant disqualifier.

5. Shows you a fake 'court order' or 'frozen wallet' screenshot

Anyone can make a screenshot. Verify by going to the agency's official site directly — never click links sent to you.

6. Pressure tactic: 'act in 24 hours or the funds are gone'

Manufactured urgency is the #1 fraud signal. Real recovery takes weeks to months.

7. Was found via a fake Trustpilot / Reddit / Quora review

Scam rings flood review sites with success stories. Never hire a recovery service you found through a comment or testimonial.

8. Asks for your wallet seed phrase or remote access (AnyDesk / TeamViewer)

Sharing your seed phrase or screen is handing them every dollar you have left.

9. Promises a guaranteed result

No legitimate professional guarantees recovery. They give probabilities, not promises.

Legitimate recovery vs recovery scam

There ARE real professionals who help fraud victims — attorneys, licensed private investigators, and blockchain-analytics firms. The difference is not "who they claim to be" but how they charge, communicate, and set expectations.

Legitimate professional

• Bar-association or licensing body verifiable in 60 seconds
• Bills hourly or takes a percentage on actual recovery — no upfront wire
• Talks in probabilities: "we may recover 10–40%"
• Communicates from a firm domain, not gmail/proton/outlook
• Refuses to promise a specific timeline or amount
• Never asks for your seed phrase or remote access to your machine

Recovery scam

• Cold-messaged you on Telegram / WhatsApp / Instagram / X DM
• Demands an upfront "retainer", "insurance", or "tax" payment
• Guarantees a full refund, often within 48 hours
• Shows a fake court-order screenshot or "frozen wallet" dashboard
• Address is on a free-email service, or a lookalike government domain
• Pressures you: "the window closes tonight"

The 3 lines that end a recovery-scam call

You do not have to explain, argue, or be polite. Read these verbatim and hang up:

1. "Send me your firm's website URL. I'll call you back on the number listed there."
A real firm has a real switchboard. A scammer does not.
2. "I don't pay retainers upfront. Bill me from recovered funds."
Watch them pivot to "tax", "insurance", or "customs". Same money, new label.
3. "I will only proceed through my own attorney. Please send your credentials to them."
They will vanish. Real professionals will happily comply.

What actually works

Report to your country's official fraud line (IC3 in the US, Action Fraud in the UK, your bank's fraud team for card/wire).
File a chargeback within 60–120 days if you paid by card. Banks have a duty to investigate.
For crypto: report the wallet address to GACS, Chainabuse, and the exchange where the funds landed. Exchanges can freeze if reported fast.
Talk to a licensed attorney — bar-association verified — before paying anyone a dollar to "recover" funds.
Lock down email, change passwords, enable 2FA on every financial account.

GACS · free community-verified scam intelligence

More scam guides

Recovery scams target people who've been hit by these other patterns.

By scam type

Full scam index →Latest alerts →Check a link / wallet →Report a scam →

See related alerts

Fresh cases from the GACS intelligence feed that match this hub.

Recovery scam alerts

Latest alert digests

Weekly and thematic scam roundups from the GACS intelligence feed.