Guide Scams and phishing
Recovery scams: how to spot the offer to get your lost money back, and what to do
You lost money to a fake investment or crypto platform. Months or years later, a 'recovery specialist', a law firm or a crypto tracing company gets in touch: they've found your money and can return it – you just need to pay a fee, verify your account or install an app. It's the second round of the same scam. The FBI and the FTC both warn about it, and Czech police have described victims losing hundreds of thousands more, in one case bringing the total loss to over 2.2 million Czech koruna (about €90,000). Here's how to recognise it and what to do if you've already paid.
Key points
- Anyone who contacts you out of the blue offering to recover lost money for a fee is a scammer. Police don't charge victims to investigate, and private companies can't seize funds.
- Knowing your name, email and how much you lost doesn't make them real. Scammers buy and share lists of people who have already been scammed.
- Never install remote access software or hand over your online banking login or card details. That is exactly how victims lose even more.
- Already paid or installed something? Call your bank now, uninstall the app, change your banking password and report it to the police (and in the US to IC3 or the FTC).
What the scam looks like
The second round follows the first – most often a fake investment or crypto platform (see Investment scams: what to do). The UK's Financial Conduct Authority calls these "recovery room" scams; the FBI and FTC describe the same pattern.
The scammer poses as a crypto tracing or fund recovery company, a law firm, a consumer advocacy group, a government agency – or even the company that scammed you in the first place (FTC). According to the FBI, they reach victims through social media and messaging apps, or advertise in comment sections, search results and social media, and some claim ties to law enforcement to seem credible.
Real cases
The FBI's 2023 warning and the FTC's guidance describe the general pattern. Czech police have published detailed cases:
- About €90,000 in total. A man who lost around 900,000 koruna in 2024 was contacted in July 2025 by "investment company staff" offering to return it. They used that promise to extract further payments, bringing his total loss to 2,286,892 koruna. In a second case in the same district, the scammers used remote access to the victim's online banking to divert 1,000,000 koruna (Czech Police, 20 November 2025).
- "Help managing your account". A man who had put his savings into crypto that never existed was contacted by name, sent a password and shown an account holding 333,000 koruna. The payout required his card details including the CVV code. Nothing was paid out; money left his account instead. A 70-year-old who had lost almost 1.7 million koruna in 2022 fell for a "financial specialist" with the same story and lost another 140,000 koruna (Czech Police, 28 May 2025).
How to spot it
Any one of these is enough:
- They contacted you first to say they've found your money or can get it back.
- They want money up front – a "retainer", "processing fee", tax, licence or verification payment. FTC: anyone who asks for an upfront fee to get you a refund is a scammer. Government agencies and legitimate organisations never ask for money to help you get a refund.
- They promise results. The FBI points out that private recovery companies can't issue seizure orders.
- They want remote access, your banking login or card details. That's how they take over the account.
- They insist on cash, gift cards, crypto, wire transfers or payment apps. The FTC says anyone who requires these payment methods is a scammer.
- They claim to work with the FBI or the police. Verify by calling the agency yourself, on a number you've looked up independently.
Already paid or installed something?
- Stop paying. Including the "final fee" that's supposed to release the money. It won't.
- Call your bank on the number on your card or its official website – not a number the "recovery firm" gave you. Block the card, change your banking login and go through recent payments together.
- Remove remote access software. If the scammer had access to your computer or phone, change your email and banking passwords from a different, clean device. Our guide Entered your details on a phishing site? walks you through it.
- Report it. Tell the police and mention the original scam as well. In the US, report to the FBI at ic3.gov and to the FTC at ReportFraud.ftc.gov. The FBI recommends keeping detailed records of transactions and of every interaction with the "recovery service".
- Expect a third round. Ignore anyone else who reaches out offering help, and block their numbers.
If you genuinely want to try to recover money
- Your bank, quickly. Ask about a card dispute (chargeback) or a recall of a bank transfer.
- The police. Reporting is free. Law enforcement doesn't charge victims to investigate (FBI).
- A lawyer you choose yourself. The FBI notes that victims can pursue civil litigation. Find a lawyer independently – not the one who called you or appeared in an ad.
- Check any firm independently. Search its name together with words like "complaint", "scam" or "review" (FTC), and check your financial regulator's register – in the UK, the FCA Register. Call only on numbers from the firm's official website.
How to avoid it next time
- An unsolicited offer to recover your money is a scam. Every time.
- Never pay up front to get a refund. Fake loan brokers use the same trick – see Advance-fee loan scams.
- Never install remote access software because someone on the phone told you to.
- Don't share card details, one-time codes or banking logins with anyone.
- If you've been scammed once, tell family and friends so they can warn you when the "recovery firm" calls.
FAQ
A lawyer called saying they've traced the crypto I lost. Could it be real?
Almost certainly not. The FBI says fake recovery firms often claim links to law enforcement or legal services, take an upfront fee and then go silent – or hand over a vague 'tracing report' and ask for more. Hang up and don't pay anything.
How do they know my name and how much I lost?
From the first scam, or from lists they've bought. The FTC warns that scammers buy 'sucker lists' of people who've already lost money. In one Czech police case, the 'helper' contacted the victim by name at his own email address – and it was still a scam.
They only want a small fee or tax before releasing the money. Should I pay it?
No. The FTC is blunt: anyone who asks for an upfront fee to get you a refund is a scammer. A small first payment is used to show you a fake balance, then come the much bigger 'licence', 'account verification' or 'legalisation' fees – the pattern Czech police describe.
They showed me an account with my recovered money in it. Why would that be fake?
A balance on a screen proves nothing – a fake platform can display any number. One Czech victim was shown an account holding 333,000 koruna and promised a payout if he entered his card details, including the security code. No money arrived; instead, money left his account.
Can I get anything back at all after a scam?
Sometimes, but only through real channels: your bank (as soon as possible after the payment), a police report, and potentially a civil claim through a lawyer you choose yourself. The FBI notes that exchanges freeze accounts only through their own processes or in response to legal process, and that law enforcement doesn't charge victims to investigate.
Sources
- FBI IC3 – Increase in Companies Falsely Claiming an Ability to Recover Funds Lost in Cryptocurrency Investment Scams (11 August 2023)
- FTC – Refund and Recovery Scams (December 2023)
- FTC – Report fraud (ReportFraud.ftc.gov)
- FCA ScamSmart – How to avoid investment scams
- Czech Police – Rise in investment fraud (Hradec Králové Region, 20 November 2025, in Czech)
- Czech Police – They believed the promises again (Jičín, 28 May 2025, in Czech)
Spotted a mistake? Let us know and we will correct it openly.
Related
Guide
I sent a photo of my ID to a scammer: what to do now
Scammers ask for a copy of your ID under all sorts of pretexts: “identity verification” for a loan, a flat you want to rent, a prize you've supposedly won, a job offer or a message that claims to be from a government agency. If you've already sent it, money won't vanish from your account because of the photo alone. But a document image with your name, date of birth and document number can be used to open credit or accounts in your name, and makes the next scam aimed at you far more convincing. Here's what to do, step by step.
Guide
SIM swap scam: your phone suddenly has no signal – what to do
Your phone suddenly shows “No service” or “SOS only”, maybe right after someone called claiming to be your mobile carrier and asked for a code from a text message. That's the classic sign of a SIM swap: a criminal has moved your phone number to a SIM or eSIM they control. From then on, your calls and verification texts go to them – including codes from your bank and email. The FBI's Internet Crime Complaint Center received 1,611 SIM swapping complaints in 2021 alone, with more than $68 million in losses. Here's how to spot it, what to do in the first minutes and how to protect your number.
Guide
A "hotel" message asks you to verify your card or pay a balance: how to spot the scam and what to do
The message knows your name, your dates and your booking number. It says your payment failed, or that the reservation will be cancelled unless you verify your card within the hour. It can still be a scam – and police have described travellers who lost thousands this way. Here's how to tell, and what to do if you've already entered your card.