How Recovery Scams Work — Every Tactic, Mapped
A deep-dive into how second-stage recovery scams operate. The fake regulator listings, the credibility theatre, the script milestones, and the patterns we see most often. Reference resource for victims, journalists, and researchers.
Why Recovery Scams Are So Effective
Recovery scams target an audience already conditioned for trust: people who just lost money, who are emotionally desperate, and who have been told by everyone else that “the money is gone.” When someone appears offering hope, the psychological pull is overwhelming — especially because the recovery scammer often appears as a fellow victim, a respected authority figure, or a technically sophisticated specialist with insider knowledge.
The Six Recovery-Scam Archetypes
The “Fund Recovery Agent”
Cold contacts victims claiming to specialise in tracing and retrieving stolen funds. Charges upfront fees disguised as “investigation costs”. Provides fabricated “tracing reports” showing located funds in fake wallet addresses or offshore accounts.
The “Scam Recovery Lawyer”
Often impersonates real law firms or fabricates one. Claims to file lawsuits, issue court orders, or pursue criminal charges against the scammer. Bills for “retainer”, “court filing fees”, “process serving”, “international jurisdiction setup”. No litigation ever happens.
The “Crypto Tracer”
Claims to use blockchain-analysis tools (often impersonating Chainalysis, CipherTrace, Elliptic) to “trace and recover” stolen crypto. Real blockchain tracing requires law-enforcement subpoena powers — no private party can actually retrieve crypto from an exchange.
The “Government Liaison”
Poses as an FBI agent, FTC official, Interpol contact, or “regulator’s investigation team”. Claims your case has been escalated and “funds are being released” pending a “tax clearance” or “international banking fee” you must pay.
The “Fellow Victim”
Reaches out via DM, forum reply, or email claiming to be another victim who “successfully recovered” using a specific agent/lawyer/service — which they conveniently recommend. The most common entry point for recovery scams.
The “Exchange Insider”
Claims to work for a crypto exchange or bank where the scammer’s funds are “frozen”. Offers to unlock them for a fee. Sometimes shows fake internal screenshots or “exchange portal” links that route to fake login pages.
The Recovery-Scam Script — Stage by Stage
Most recovery scams follow a consistent narrative arc. Knowing the script makes the scam visible from the inside:
Victim identification (passive scraping)
Recovery scammers monitor Reddit, Twitter, Quora, Trustpilot reviews, Facebook groups, and even mainstream news article comments. They look for posts containing loss amounts, scam type, and emotional language. Indicators of fresh victims are heavily weighted.
First contact (cold outreach)
Unsolicited DM, email, comment reply, WhatsApp message, or LinkedIn connection. The most common opener is a “fellow victim” persona — someone who “recovered” thanks to a specific service. The recommendation is the payload.
Credibility theatre (the website)
Polished website with stock photography of “expert” team members (often stolen from LinkedIn or stock photo sites). Fake regulator licenses — frequently impersonating FCA, SEC, ASIC, CFTC, or Bafin. Fake addresses in London, New York, Singapore, or Dubai. Sometimes registered businesses do exist but are shell companies.
Investigation theatre
Asks the victim for transaction IDs, wallet addresses, screenshots — information often already public. Produces a “tracing report” or “case file” showing fabricated discovery of the funds in offshore accounts, frozen exchange wallets, or “court custody”. The report often looks professional.
First payment request
“Blockchain access fee”, “court filing”, “tax clearance”, “international wire fee”, “lawyer retainer”, “exchange unlock fee”. Usually moderate — designed to be paid without prolonged hesitation. Often demanded in crypto for irreversibility.
Escalation (milking)
Each subsequent stage requires an additional fee. “The funds are almost out, just one more tax payment”. “The bank is releasing the money but requires verification fees”. “A court order needs filing for international transfer”. Many victims lose more here than in the original scam.
Sunk-cost reinforcement
When the victim hesitates, the scammer reminds them how much they’ve already paid. “We’re 80% done — if you stop now, you lose everything we’ve already recovered.” Sunk-cost bias is exploited deliberately.
Exit (disappearance or threat)
Eventually the agent goes quiet, or the victim threatens to report. Disappearance is most common. In some cases the scammer pivots to threats — “the case is now in legal limbo and additional fees are required to release the funds you’ve already paid for”.
Credibility Theatre — How Fake Operations Look Real
Recovery scammers invest heavily in making their operations appear legitimate. The standard credibility infrastructure:
Professional website
Bootstrap-themed corporate template, stock photos of “team members”, testimonials section with fabricated quotes attributed to plausible-but-vague names (“John K., New York”, “Sarah M., London”).
Fake regulatory listings
Claims to be “registered with the FCA / SEC / ASIC / CFTC”. May show a real-looking license number that doesn’t appear in the actual public regulator register. Always verify directly on the regulator’s official site.
Fabricated reviews
Trustpilot or Google reviews showing 5-star ratings from accounts with no other review history. Sometimes paid review-farming services are used to generate dozens of fake positive reviews.
Prestige addresses
Office addresses in London, Manhattan, Singapore, Geneva, Dubai. Often virtual mail-forwarding services. Sometimes real shared office spaces where they have no physical presence.
Toll-free numbers
VOIP numbers in target-country area codes. UK +44, US 1-800, AU +61, India local landlines. None lead to real offices — calls are routed via VOIP regardless of where the agent actually sits.
LinkedIn profiles
Fake LinkedIn accounts for “team members” — typically with stolen photos, fabricated work histories, and small but plausible connection counts. Real LinkedIn audits would identify them but rarely happen.
How to Verify a Claimed Regulator License
Recovery scammers frequently claim to be regulated by major financial authorities. Real verification — done the right way — exposes these claims in under a minute:
- 🇺🇸 SEC (Securities and Exchange Commission) — search SEC EDGAR directly. Don’t click links the agent provides.
- 🇺🇸 FINRA BrokerCheck — brokercheck.finra.org — verify any “broker”, “advisor” or “investment professional” claim.
- 🇬🇧 FCA Register — register.fca.org.uk — every UK-regulated firm and individual is searchable here. If they’re not in this register, they’re not FCA-regulated, full stop.
- 🇦🇺 ASIC Register — asic.gov.au/search — verify Australian financial license claims.
- 🇩🇪 BaFin Database — bafin.de databases — verify German regulatory claims.
- 🇮🇳 SEBI / RBI — official registers for Indian financial services. Beware of agents claiming “SEBI registration” without an actual registration number that checks out.
Payment Methods They Demand (and Why)
Cryptocurrency
Most common. Irreversible. Often Bitcoin or USDT. Bonus for the scammer: they can claim “blockchain settlement” makes crypto necessary for the recovery process.
International wire transfer
To accounts in Hong Kong, Singapore, UAE, Cyprus, or Eastern Europe. Recall after 24h is near-impossible. Often presented as necessary for “international jurisdictional case filing”.
Gift cards
Less common for recovery scams (used more in tech-support and IRS scams) but does occur. Amazon, Apple, Google Play, Steam.
P2P apps
Cash App, Zelle, Venmo, UPI, Wise, Western Union. Designed as friend-to-friend transfers without buyer protection. Recovery scammers prefer these when targeting victims in their own country.
If You’ve Already Paid a Recovery Scam
Many victims who paid a recovery scam tell us they feel more shame than after the original scam. That feeling is exactly what the second-stage scammers exploit.
- Apply 24-hour emergency recovery for the recovery-scam payment too — call your bank, freeze cards, file a fresh complaint with your country’s reporting authority
- Report the recovery scammer as a separate scam — name them with the website URL, the payment methods used, and any contact details. Many recovery-scam entities are actively investigated and your report contributes evidence
- Cut all contact immediately — block on every channel. Do not respond to “we’re close to recovering” messages designed to extract more
- Tell someone you trust — isolation is what the scammer wants. Saying it out loud breaks the spell
- Reach out for emotional support if you’re struggling — see our Victim Support Resources
- Report to Scammers Expose — your story helps us warn the next person. We anonymise everything by default
Why This Page Exists
Most scam-information sites do not document recovery-scam mechanics in detail. Some do not cover them at all. Some quietly accept recovery-service advertising and avoid the topic for commercial reasons.
Scammers Expose treats recovery scams as the second half of the same problem — and arguably the more harmful half, since they target people already in distress. This page exists as a reference resource for victims, journalists writing recovery-scam stories, and researchers documenting fraud-ecosystem evolution.
If you’re researching recovery scams for a story, paper, or investigation: email info@scammersexpose.com. We share what we know openly and freely.
For the underlying policy commitment, see our Anti-Recovery-Scam Pledge.
Spotted a recovery-scam operator?
Send us the details — website URL, contact details, the script they used. We track recovery-scam operations and publish warnings where evidence supports.
Last reviewed: May 2026 · Updated as new recovery-scam patterns emerge