Scammed once, then offered help getting it back: how to spot a recovery scam

Can stolen crypto be recovered? The legitimate route is the one you start yourself: you report it to the police or the official cybercrime channel where you live, and law enforcement decides whether to investigate, trace and seize. That route costs nothing, and it promises nothing.

The other "route" comes looking for you. A message arrives from someone who says they are a lawyer, a cybercrime officer, a blockchain tracing specialist, or the "compliance department" of an exchange. They have found your money, they say, and one fee is all that stands between you and getting it back. That is the same scam running a second time, aimed squarely at people who have already lost once. Below: how they find you, the faces they wear, what real casework looks like, and what to do if you have already paid.

Why they found you, of all people

After a loss, people do perfectly understandable things. They post the story on social media. They join a victims' group. They comment under an article exposing the scam. They search "can I get my crypto back" and click the first result that looks professional.

Every one of those steps broadcasts the same message: someone here just lost money and badly wants it back.

There is an even more direct source. The people who took your money the first time already hold your full file — the chat history, the amounts, your wallet address. Coming back under a new name costs them almost nothing. IC3's August 2025 notice describes exactly this: fake law firms quote details of the victim's earlier transfers to sound credible.

So suppose the caller opens by telling you the date, the address and the exact amount of USDT you sent. That does not prove they are police or a lawyer. It proves they have the record. And the party most likely to have that record is the one that took the money.

The usual disguises

The costume changes. The request for money does not.

A lawyer or law firm

There is a website, a photo of a licence, a "case number". In June 2024 IC3 issued a notice specifically about fictitious law firms targeting crypto fraud victims: they claim authority to investigate recovery cases and say they work with the FBI or other government agencies.

The demands listed in that notice include paying part of the fee up front with the rest due after recovery, paying "back taxes" or similar charges, and handing over identity and bank details. The same notice gives a figure: from February 2023 to February 2024, victims of these fake firms reported losses of more than $9.9 million.

Police, a cybercrime unit, or "official anti-fraud"

This one carries the most pressure, because most people's instinct with the police is to cooperate. IC3's July 2026 notice says people are impersonating IC3 and FBI staff with fake social media accounts, fake websites, even AI-generated video. Three lines in it are worth keeping next to you: IC3 has no social media accounts; IC3 does not contact individuals directly by phone, email or social media; IC3 does not charge a fee to recover losses.

Chinese police warnings say the same thing in their own terms. A 2025 notice from the Zhangjiagang Public Security Bureau states that any online "lawyer" or "cyber police officer" offering to recover scammed money is a fraudster, and that police do not handle cases online, never ask anyone to move money into a "safe account", and never ask for verification codes.

A tracing team, or a "hacker"

The pitch sounds technical: they have locked onto the scammer's wallet and can "reverse-trace", "freeze the address", or "hack it back". Often they show you a diagram of where the money went.

The diagram might be real. On-chain transfers are public; anyone can look them up in a block explorer and draw the path. Showing where money went and bringing it back are different things. A blockchain transfer has no undo button, and what gets an exchange to freeze an account is a formal request from law enforcement — not a stranger who wants a service fee from you first.

Exchange "support" or "compliance"

Your funds, they say, are sitting in the platform's risk-control account. Pay a release fee, or deposit some "verification funds" to prove your transaction history, and the balance will be unlocked.

Anything in a real exchange account is visible when you log in to the official app yourself. A real support ticket is one you open inside the official app or website; it does not arrive from a private account. How to check an entry point is covered in the three-checks piece, so it is not repeated here.

The 2025 IC3 notice records one more variation: victims get pulled into a group chat that includes a supposed "foreign bank" representative, and the fees escalate step by step. A crowded chat makes it look like an institution is at work. Every account in it may be run by the same people.

Lined up side by side, the four disguises differ only in the opening line. They all end at the same request:

One hard rule, three supporting signs

The hard rule: they contacted you, and they want you to pay first. When both are true, there is nothing left to check. IC3's 2024 notice says law enforcement does not charge victims for investigations; the 2025 one says the US government does not charge for law enforcement services.

The supporting signs are for when you are still unsure:

• Payment is requested in USDT, bitcoin or gift cards. The 2025 IC3 notice names crypto and gift cards specifically.
• You are asked to install an app, share your screen, or read out a text-message code. That is a request for the keys to your account, and it has nothing to do with recovering money.
• There is a deadline: "pay today or the case closes", "only two places left in this batch". Asset recovery does not come with a slot that expires tonight.

Notice that none of these is "do they sound professional". Sounding professional is the cheapest prop in the whole production.

The real route runs the other way

Set the scripts above against the official channels and one difference stands out: you go to them; they do not come to you.

1. In the United StatesType www.ic3.gov into the address bar yourself and file a complaint, or contact your local FBI field office. The 2026 IC3 notice specifically reminds people to check that the address ends in .gov.
2. In mainland ChinaCall 110 or report at your local police station. Look up the station's address and number yourself rather than using one someone sent you.
3. Anywhere elseGo to your local police or the government's official cybercrime reporting service, reached from a government website — not from a search ad or a link in a message.
4. If the money passed through an exchangeOpen a ticket from inside the official app, describe what happened and attach the transfer records. What the platform can do on its own is limited, but when law enforcement makes enquiries or requests a freeze, the exchange is the party that has to respond, and having your report on file helps.

How to gather the evidence, and in what order, is laid out in "If it has already happened" in the eight-playbooks piece.

When an "investigator" calls

Hang up and call back. What matters is the number you call back on: one you looked up yourself, not one they gave you, and not one printed in a text or on their website.

It will feel rude, and they may tell you that you are "obstructing the investigation". That cost is worth paying. A real officer does not drop your case because you hung up and rang the station. A fake one disappears once you do.

If they say they are a lawyer, IC3 suggests asking for video verification and a photo of their licence, and keeping every record of the contact, including recordings of video calls. A lawyer's registration can usually be checked through the public search of the local bar association or licensing body. If it does not match, or they keep finding reasons not to give it, you can stop there.

If you have already paid a "recovery" contact

Stop. The next thing they say will be "just one last payment", and that sentence has no end.

Then keep this round separate from the first: the receiving account or wallet address for the second set of payments, the law firm name or badge number they used, their website domain, every account in the group chat. Save it as its own file. When you report, say clearly that after the original scam you were defrauded again by someone posing as a recovery service — both rounds may lead back to the same people.

If you installed an app they asked for, remove it, and check your phone for any screen-sharing or remote-control permissions that were not there before. If you gave them a code, or logged in on a page they sent, change your password now, reset two-factor authentication, and look at your withdrawal whitelist for any address you do not recognise. How to set up those three is in three things to set up on day one.

One more thing that is not on any checklist: stop posting publicly in search of a "recovery channel". If you need help, go to family and to the police. Announcing to strangers that you just lost money is how the second round started.

Read next

• The eight playbooks beginners run into
• Fake support, fake apps, fake sites: three checks
• The long con, act by act
• Three things to set up on day one