Recovery Scam Warning Signs: Check the Second Contact

What are the warning signs of a recovery scam?

A recovery scam promises to return money lost to fraud, then seeks another payment or sensitive information. Unexpected contact, advance release fees, pressure, and claimed government connections are warning signs. Knowing your earlier loss does not authenticate the sender. Stop the exchange and verify any claimed organization through an independently obtained official contact. If you paid or exposed account information, contact your payment provider promptly. Recovery is never guaranteed.

This guide addresses the second approach: the person claiming to solve an earlier fraud. For immediate payment and account-protection steps, use what to do after an investment scam.

Why might a stranger know exactly what happened?

The Federal Trade Commission's recovery-scam guidance explains that scammers trade information about people previously targeted, including contact details, the type of fraud, and the amount lost. A new approach can therefore contain accurate facts without coming from anyone authorized to help.

That distinction matters when the message supplies an old payment date, recognizes the account you used, or refers to a complaint. Treat those details as information the sender possesses, not a credential.

You do not need to discover how the information circulated before ending the exchange. Its presence does not establish that an official agency disclosed your report, either. That would be a separate claim requiring evidence.

An offer arriving beneath a public account of your loss also needs independent verification. Sympathy and familiarity are not substitutes for an identifiable organization and a contact route you obtained separately.

Which claims deserve a separate check?

Read the approach as several claims, not one reassuring story. Our editorial worksheet separates what was asserted from what would establish it. It is for reviewing messages already received, not for questioning the sender or collecting more material from a suspicious website.

The FCA's recovery-room warning describes impersonators copying real firms' names and registration details while substituting contact information. For a UK financial business, its guidance directs readers to the FCA Firm Checker to check authorization and permissions, and to use the listed contact details.

A register entry for a real firm does not authenticate the person who sent the message. Nor does authorization for one activity prove permission for every service being claimed. These are separate checks.

How do you verify without continuing the exchange?

End the suspicious conversation. Do not use its callback number, attachment, QR code, or verification link as your starting point. A second page supplied by the same sender is still part of the same unverified approach.

For a government claim, find the agency's official contact route independently. Explain that someone is claiming to represent it and ask how the claim should be checked. Do not send identity documents or account details to the original contact while waiting.

Real refund processes exist. The FTC maintains an official refund directory with case information and administrator contact details. If someone claims to be arranging an FTC refund, use that directory to identify the relevant process and contact, rather than accepting the message's version. The FTC says it will not require you to transfer money to receive a refund.

Similarly, if you independently seek legal help, verify the professional through the appropriate jurisdiction's official professional regulator or licensing body. A discussion of legitimate legal fees is not the same as an unsolicited demand to release supposedly recovered money. Neither a professional title nor a fee arrangement guarantees recovery.

This is fraud-awareness guidance, not legal advice about a specific claim or retainer. Ask a qualified professional about applicable rights, costs, and deadlines through a contact route you have independently verified.

Does a tracing report mean the money can be recovered?

No. Identifying transactions, restricting access to funds, and returning money to a person are different claims. A diagram or report cannot, by itself, prove all three.

The FBI's cryptocurrency-recovery warning explains that private recovery companies cannot issue seizure orders. Exchanges may freeze funds through their own processes or in response to legal process. The warning also describes businesses demanding advance payment, supplying inaccurate tracing reports, and seeking additional fees.

Do not interpret a displayed balance or transaction diagram as money available to you. Do not send a test transfer, connect an account, install remote-access software, or provide passwords to demonstrate ownership to an unexpected contact.

The FBI's warning about fictitious recovery law firms also describes claims of collaboration with government agencies and requests for personal or banking information. Mentioning a real agency does not establish that collaboration.

The broader mechanics of promised payouts are covered in our investment-scheme red-flags guide. Here, the specific problem is a second payment justified by an unverified promise of recovery.

How can you separate the old loss from the new demand?

Use an existing payment record, not the recovery contact's dashboard. The following is an invented bookkeeping example, not a real case, typical fee, or estimate of recoverability.

An earlier fraud involved $4,000 actually paid. A later contact demands $300 for administration and another $200 described as tax. Those demands total $500. If both were paid, total payments across the two episodes would be $4,500. If neither was paid, the new amount paid would remain $0.

Keep separate notes for:

• The original payment: date, amount, method, and reference already in your records.
• The later approach: when it arrived and the identity it claimed.
• The new demand: amount requested and the sender's stated reason.
• Any new payment actually made: its own date, method, and reference.
• The report or provider contact you initiated: date and acknowledgment, if received.

This prevents a claimed refund from being counted as money returned. Label assertions as assertions: “sender claimed funds were located” is different from “bank confirmed a credit.”

Keep records privately for the appropriate provider or official reporting route. Do not publish unredacted account information, forward evidence to a stranger offering help, or reopen suspicious links to complete the notes.

What if you already paid or shared information?

Contact the bank or payment provider promptly through its official route. Explain both the earlier fraud and the separate recovery approach, identify any new payment, and ask whether reversal or another protective action is possible. Do not pay another fee while that inquiry is pending. Payment method, timing, and local rules affect available options.

The FTC's current post-scam guidance covers payment-method responses, compromised passwords, identity information, and remote-access exposure. Follow the section matching what actually happened. Changing one password does not resolve every kind of exposure.

Tell the provider if account information or access was exposed, even if no new payment has appeared. Use its official account-security process. Reporting or requesting reversal does not guarantee reimbursement.

Where should you report the second approach?

Report through the appropriate official route yourself; a recovery contact should not control your report.

In the United States, the FTC recovery guidance directs reports to ReportFraud.ftc.gov and the state attorney general. For investment-account or financial-professional complaints, Investor.gov provides the SEC complaint route. Internet-enabled crime can be reported through the FBI's IC3.

IC3 states that it does not work with non-law-enforcement entities to recover funds and will not contact people directly seeking information or money. This does not mean every genuine law-enforcement follow-up is impossible: verify any claimed agency independently. IC3 also says it cannot guarantee a response to every complaint.

In the UK, follow the FCA's current scam-reporting guidance. It distinguishes financial services within its remit and directs fraud reports to Report Fraud, with Police Scotland routing for people in Scotland. The FCA expressly says it cannot get your money back. Elsewhere, start with your local police and relevant home financial regulator.

Keep acknowledgment separate from outcome: a received report is not confirmation of an investigation, frozen funds, or a refund. Our reporting and response collection covers these practical distinctions.

Sources

• FTC: Refund and recovery scams, official refunds, and post-scam steps.
• FCA: Recovery-room scams and reporting guidance.
• FBI: Recovery-company warning, fictitious law-firm warning, and IC3 reporting information.
• SEC Investor.gov: Questions and complaints.