Active threat
Category hub
Recovery scam alerts
Recovery fraud is the second wave that hits victims who've already lost money. Scammers buy or scrape lists of prior victims, then DM them claiming they can retrieve the stolen funds — for an upfront fee, of course. The FTC and FCA list this as the fastest-growing fraud subtype of 2025.
Last updated · sorted newest first
Go deeper on this topic
Weekly digests move fast — jump into the evergreen hubs and guides for the full playbook, red flags, and reporting steps.
What this is
A recovery scam is a secondary fraud targeting victims of a prior scam, in which the perpetrator falsely claims the ability to recover lost funds — typically via a 'forensic blockchain firm', 'licensed recovery agent', 'white-hat hacker', or 'class-action' — and extracts an upfront retainer or 'tax' that is itself the scam.
Red flags to watch for
- Found you via comment on a YouTube scam-recovery video, Reddit post, Trustpilot review, or DM after you posted about being scammed
- Guarantees a recovery percentage and shows screenshot 'testimonials' from people you can't verify
- Asks for an upfront retainer, 'gas fee', 'tax', 'KYC bond' or 'court bond' before any work begins
- Claims to use proprietary tools, 'cyber-forensic' tech, or contacts inside major exchanges
- Uses WhatsApp / Telegram / Signal as the primary channel — refuses video or office address
Live cases from the GACS feed
Loading current cases…
What to do if you've been targeted
- 1
Stop all communication
Block the recovery account. Do not 'request a refund' — any reply re-opens the funnel.
- 2
List who contacted you
Write down every handle, email, and wallet that approached you about recovery. These often cluster — one bust catches several.
- 3
Report to fraud authorities
File at IC3.gov, ActionFraud, CAFC, Scamwatch, or your national equivalent. Reference both the original scam and the recovery attempt.
- 4
Use the real channels
Exchange compliance teams (if within ~48h), card chargebacks, or large-loss class-actions are the only real avenues — never a stranger in DMs.
- 5
Warn your network
Post the recovery actor's handles in the scam forum you originally posted in. It saves the next victim and starves the playbook.
FAQs
Can anyone actually recover scammed crypto?
Sometimes — and only through specific legitimate channels: filing with IC3/Action Fraud/CAFC, working with the receiving exchange's compliance team (if reported within ~48h), or chargebacks on card/bank payments. Anyone DMing you with guarantees is a recovery scammer.
What about law firms that advertise crypto recovery?
Real firms exist but are rare, expensive, and only viable when the loss is large (typically $100k+) and the receiving entity is in a co-operative jurisdiction. They never DM cold and never accept payment in crypto.
I already paid a 'recovery agent' — what now?
Stop sending money immediately. The escalating 'release fees' are the same playbook as the original scam. Report both the original loss and the recovery scam to your national fraud authority and add both actors to your GACS Shield watchlist.
How do I report a scam to GACS?
Submit the wallet address, website, phone number, or social handle at gacs.app. Each report is cross-checked against CryptoScamDB, URLhaus, and on-chain analysis before publication. Activate your free GACS Shield to monitor follow-on activity tied to the same actor.
Is the GACS Shield really free?
Yes. Activating your free Shield gives you unlimited scans, saved history, weekly alerts, and a watchlist — no card, no trial. There is no paid scanner tier.
Related scam profiles & guides
Activate your free GACS Shield
Save scammer handles, wallets, and domains. Get alerted when the same actor surfaces in a new report. Unlimited scans, no card.
Get My Free Scam AlertsAuthoritative sources
Independent primary sources used to check and corroborate the guidance on this page.
- FBI Internet Crime Complaint Center (IC3)
Official US channel for reporting internet-enabled fraud and cybercrime.
- US Federal Trade Commission — ReportFraud
Consumer fraud reporting and published enforcement data.
- UK Action Fraud
UK national reporting centre for fraud and cybercrime.
- Canadian Anti-Fraud Centre
Canada's central repository for fraud reports and scam alerts.
