Refund and recovery scams - how scammers target people who lost money

There is a particular cruelty in this one. The people most likely to be targeted by a refund scam are the people who can least afford it — because they have already lost money once.

Quick answer

A refund or recovery scam is a second fraud aimed at victims of a first one. Someone offers to get your money back — as a lawyer, an investigator, a government official, a recovery service — and asks for a fee, a tax, a deposit or your account details before anything can happen. Nothing is recovered.

One rule identifies every version of it:

Everything below is detail about how the story is dressed up. The rule does not change.

Why they came to you specifically

This is the part that unsettles people, and it deserves a straight answer.

You are probably on a list. The FTC describes what the trade calls sucker lists — records of people who have paid scammers, containing "your name, address, and phone number, the kind of scam that tricked you, and how much money you paid". Scammers buy, sell and trade them, on the reasonable assumption that someone scammed once is a better prospect than a stranger.

Or you said so in public. Fraud support forums, product review sites, comment sections and social media replies are all monitored. The FBI's April 2025 alert described scammers creating fake profiles and joining online groups for fraud victims specifically to find people to approach.

Or the first scammers simply kept your file. Nothing prevents the same group from returning under a new name.

The practical consequence: a caller knowing your name, the platform you used, the date and the exact amount you lost is not evidence that they are official. It is evidence that they have the list.

How the scam is built

The structure is consistent across every variation.

1. Contact arrives unexpectedly — a call, an email, a text, a WhatsApp message, a direct message on social media, sometimes a comment reply.
2. Credibility is manufactured. The FTC notes they may pretend to be from a government agency, a law firm or a consumer group. Names, case numbers, badge photos and letterheads are cheap to produce.
3. You are told the money is findable. Often that it has already been located, frozen, or is sitting in an account awaiting release.
4. A barrier appears. A processing fee. A court filing cost. A tax. An exchange charge. A refundable deposit to "verify your identity".
5. The payment method is untraceable. The FTC's list is specific — cash, gift cards, cryptocurrency, wire transfers through companies like Western Union or MoneyGram, or a payment app. "Anyone who says you have to pay in any of these ways is a scammer."
6. The barriers multiply. One fee becomes a second, then a third. This is the stage where most of the loss happens.

The versions the FBI and FTC have named

These are documented alerts, not hypotheticals.

Fake law firms, for crypto losses

In August 2025 the FBI issued a public service announcement about fictitious law firms targeting cryptocurrency scam victims. The described pattern: the firms claimed victims appeared on government-affiliated victim lists, invented a regulator called the "International Financial Trading Commission", demanded payment in cryptocurrency or prepaid gift cards, told victims to open accounts at fake foreign banks, and ran the whole thing through WhatsApp groups populated with supposed processors and attorneys.

The FBI's own note in that alert is the one to keep: the US government does not request payment for law enforcement services.

People impersonating IC3 itself

In April 2025 the FBI warned about scammers impersonating the Internet Crime Complaint Center — the very place you report a scam. Over 100 reports came in between December 2023 and February 2025. The method involved fake social media profiles, infiltration of fraud victim groups, and referral to a supposed IC3 official on Telegram who claimed the money had already been recovered.

IC3's statement of what it actually does is worth memorising:

The IC3 will never directly communicate with individuals via phone, email, social media, phone apps, or public forums. The IC3 will not ask for payment to recover lost funds, nor will they refer a victim to a company requesting payment.

People impersonating the FTC

In June 2026 the FTC warned about scammers claiming to be FTC employees or "agents" who could help recover losses, sending photographs of employee IDs and badges to prove it. The FTC's three flat statements: a real FTC employee will not contact you by text message or an app like WhatsApp, will not text a photo of their ID to verify who they are, and will not offer to recover your money and then ask you to pay, move funds, or hand over financial information.

The FTC does not have "agents". Anyone using that title is telling you what they are.

Warning signs

• They contacted you. Recovery services that find you are the problem; ones you find yourself and check are a different situation.
• Any payment before any result — fee, tax, deposit, "unlocking" charge, currency conversion.
• Payment in gift cards, crypto, wire transfer or a payment app.
• A guarantee. Nobody honest guarantees recovery of stolen funds.
• Badge photos, ID cards, case numbers and letterheads offered as proof of identity. All trivially faked; a real official does not prove themselves this way.
• Pressure and deadlines — the refund expires tonight, the court date is tomorrow. Manufactured urgency is the mechanism that stops you checking.
• A move to WhatsApp, Telegram or Signal. Agencies and law firms do not conduct business there.
• They know a lot about your loss. Expected, and meaningless.

What to do instead

If you want to try to recover money, this is where the real avenues are:

1. Contact whoever moved the money. Your bank, card issuer, wire company, payment app or exchange. The FTC publishes guidance for each payment method. Speed is the main variable.
2. File at IC3.gov if a large wire is involved. The FBI's Recovery Asset Team works with banks to freeze fraudulent transfers — but it is reached by filing a report, not by answering a phone call.
3. Report at ReportFraud.ftc.gov. It will not return your money directly, but it is how the pattern gets recorded. How to report an online scam and what happens next walks through what each agency does with a report.
4. If you want professional help, go and find it yourself. Look up a solicitor or attorney through a bar association directory, call the number listed there, and never through a link or number someone sent you.
5. Say no to anyone who approached you. There is no version of this where the unsolicited contact turns out to be genuine.

If you have already paid a recovery scammer

Not the same as making the first mistake twice. This scam is built by people who know exactly how much someone wants their money back.

• Contact the payment provider now and ask them to stop or reverse it.
• Change passwords on anything you shared details for, and turn on two-factor authentication starting with your email.
• Report it at ReportFraud.ftc.gov and IC3.gov, or your country's equivalent.
• Expect more approaches. Paying twice can add you to a further list. In the US, older adults can reach the Department of Justice Elder Justice Hotline on 1-833-FRAUD-11 for help navigating what comes next.
• Consider going quiet. If you have posted publicly about the loss, taking those posts down removes an active recruitment channel.

Key takeaways

• A refund or recovery scam is the second scam, aimed at victims of the first.
• The single test is the fee: nobody legitimate charges to return your own money.
• Knowing the details of your loss proves nothing — the details are traded on lists.
• IC3 does not contact people directly. The FTC does not have agents. Neither asks for payment.
• Real recovery runs through the institution that moved the money, and it depends on speed.
• Unsolicited contact offering to recover funds is the definition of the scam, not an exception to it.

Understanding why the story works on people is worth as much as the checklist — impersonation scams and authority scams cover the two levers this one pulls hardest.