The Second Hit

Imagine losing $40,000 to a cryptocurrency investment scam. You spent months believing it was real — building what looked like a portfolio, trusting someone you thought was a friend, watching the numbers grow on a convincing fake platform. Then one day, the platform locks you out and the contact goes silent. The money is gone.

You file a report with the FBI’s Internet Crime Complaint Center (IC3). You tell the FTC. You tell your bank. Weeks go by. You have almost accepted that the money is simply lost.

Then your phone rings. The caller says they are a law firm specializing in cryptocurrency fraud recovery. They have your name, the approximate amount you lost, and the name of the platform that scammed you. They say they have a 90% success rate. They say they can get your money back — but they need a $2,500 retainer fee upfront.

This call is the second scam. And it is devastatingly effective.

What Is a Recovery Scam?

A recovery scam — also called a reload scam or refund scam — is a fraud specifically designed to target people who have already been victimized by another scam. The perpetrators pose as legitimate entities capable of recovering stolen funds: law firms, government agencies, consumer protection organizations, cryptocurrency recovery specialists, or private investigators.

Their pitch is built on four elements:

  1. Specific knowledge of the original fraud (making them seem legitimate and informed)
  2. Plausible authority (impersonating law enforcement, lawyers, or regulatory bodies)
  3. Emotional leverage (exploiting the victim’s grief, desperation, and lingering hope)
  4. A demand for upfront payment (the actual theft, often framed as a fee, retainer, or processing charge)

The FTC defines recovery scams as a category of imposter fraud and has maintained active consumer alerts about them. In May 2026, the FTC updated its guidance on imposter scam trends, noting significant increases in schemes where criminals impersonate legitimate recovery services, law enforcement, and consumer advocates.

How Scammers Find Victims — The Data Trail

This is the question that surprises most people: how does the second scammer know about the first scam?

The answer is uncomfortable. Prior fraud victims are valuable data points in the criminal economy, and their information travels through several channels:

The Dark Web and Victim Lists

When fraud operations run their scams, they accumulate databases of victims — names, contact information, the nature of the fraud, and the amounts lost. When these operations are shut down, arrested, or simply wind up, their victim databases are sold on dark web marketplaces. Other criminal operations buy these lists specifically to run recovery scams.

IC3 and Public Fraud Reports

The FBI’s Internet Crime Complaint Center encourages fraud victims to file reports, and this is genuinely good advice — reports feed law enforcement intelligence. But fraud victims who post publicly about their experiences on social media, Reddit forums, or consumer complaint sites are creating a discoverable profile. Recovery scammers monitor these platforms for leads.

When fraud victims pursue legal action — civil suits, arbitration, or insurance claims — these filings often become part of the public record. Organized recovery scam operations have been documented searching court records to identify recent fraud victims by name.

The First Scammer Sells the List

In some documented cases, the original scammer simply sells or provides victim information to a recovery scam affiliate. The coordination can be intentional — a two-stage fraud operation where the first fraud generates victims and the second fraud extracts additional money from those same people.

The Double-Victimization Pattern

The psychological mechanics of recovery scams are precisely why they work so well.

Fraud victims are often in a state of acute distress that researchers describe as “cognitive vulnerability” — the emotional aftermath of betrayal, financial loss, and shame makes people more susceptible to manipulation, not less. They want desperately to believe that recovery is possible. They are primed to trust someone who seems authoritative, knowledgeable, and helpful.

The recovery scammer exploits all of this. By demonstrating specific knowledge of the original fraud (which they obtained from the dark web list or other source), they instantly build false credibility. By impersonating law enforcement, lawyers, or government agencies, they add the weight of institutional authority. By expressing urgency — “we need to act in the next 48 hours before the funds are transferred offshore” — they prevent victims from consulting trusted advisors.

Maryland law enforcement has documented multiple cases in which victims who initially lost money to pig-butchering cryptocurrency investment scams subsequently lost additional sums of tens of thousands of dollars to recovery scammers — sometimes within weeks of the original fraud.

The Pig-Butchering Recovery Variant

The pig-butchering scam — where criminals build long-term fake romantic or friendship relationships to convince victims to invest in fraudulent cryptocurrency platforms — has become one of the most lucrative fraud categories in the world.

The recovery scam variant targeting pig-butchering victims is particularly insidious because of the emotional dimension. After losing savings to a pig-butchering scam, victims are dealing with two layers of grief: the financial loss and the betrayal of what felt like a genuine relationship. Recovery scammers sometimes approach these victims as apparent romantic contacts themselves — or as supposed mutual friends of the original scammer — to build rapport before introducing the recovery pitch.

In other cases, the recovery scammer impersonates law enforcement, claiming to be an FBI agent who has “frozen” the victim’s stolen funds and needs a release fee or a tax payment to return them.

The FBI’s Operation Level Up specifically targets crypto fraud operations and has rescued victims before some pig-butchering scams could complete their extraction. But the recovery scam ecosystem has adapted: criminals now impersonate Operation Level Up and similar federal task forces in their recovery pitches.

Common Recovery Scam Scripts

Knowing the playbook helps you recognize it in real time. Recovery scammers tend to use variations of a small number of scripts:

The Law Firm Call: “We represent a class of cryptocurrency fraud victims. Your case has been included in our filing. We have already recovered funds for 200 clients. To proceed with your claim, we require a $1,500 retainer.”

The Government Agent Call: “This is Special Agent [Name] with the FBI Financial Crimes Unit. We have frozen assets linked to the platform that defrauded you. To release your specific funds, we need to process a release fee of $800.”

The Consumer Advocate Email: “As part of a settlement with [fraudulent platform], unclaimed victim restitution funds are being distributed. You are eligible for $[large amount]. To claim your funds, please submit a processing fee of $500.”

The Crypto Recovery Specialist: “We specialize in blockchain tracing and cryptocurrency recovery. We have already located your funds on-chain. Our success fee is 20%, but we require an upfront technical fee of $2,000 to initiate the wallet recovery process.”

What all of these have in common: an upfront payment is required before any recovery occurs. This is the defining feature of a recovery scam. Legitimate attorneys, government agencies, and recovery services do not require prepayment from fraud victims to access funds that are supposedly already recovered or frozen.

FTC Data — The Scale of the Problem

The FTC’s most recent data illustrates how large the imposter scam ecosystem — which encompasses recovery scams — has grown.

In 2025, the FTC received more than 1 million reports about imposter scams, with reported losses increasing by nearly 20% year-over-year to $3.5 billion. Reports of government imposter scams — the specific type that recovery scammers often mimic — were up 40%.

In May 2026, the FTC published updated guidance on imposter scam trends, noting that criminals are increasingly posing as recovery specialists, consumer advocates, and law enforcement officials to double-dip into the fraud victim population.

What Legitimate Recovery Actually Looks Like

Not every offer of help is a scam. But there are clear distinctions between legitimate resources and fraudulent ones.

Legitimate options for fraud victims include:

  • Your bank or credit card issuer — for eligible transactions, banks and card networks have dispute and chargeback processes. These are free and require no intermediary.
  • The FTC at ReportFraud.ftc.gov — filing reports is free and contributes to enforcement actions. The FTC does not charge fees to process complaints or return money.
  • The FBI’s IC3 at ic3.gov — for cyber-enabled fraud, including cryptocurrency scams. Free to file. FBI agents do not call victims to request payment.
  • Your state Attorney General’s office — many have consumer protection divisions that mediate fraud disputes at no charge.
  • Licensed attorneys in your jurisdiction — a legitimate attorney will provide a written engagement agreement, will not demand gift card payment, and will not promise guaranteed recovery.

Red flags that indicate a recovery scam:

  • Any upfront fee demanded before recovery occurs
  • Payment requested by gift card, cryptocurrency, wire transfer, or peer-to-peer payment apps
  • Pressure to act immediately to avoid missing a window
  • The caller knows details of your original fraud (this feels like legitimacy but is actually a red flag — it means your data was sold)
  • Claims to be from the FBI, FTC, DOJ, or another government agency calling you unsolicited
  • Guarantees of recovery — no legitimate legal or law enforcement process guarantees outcomes
  • Requests for your Social Security number, bank account information, or remote access to your computer

If You’ve Already Been Contacted by a Recovery Scammer

If you have received a recovery scam contact and you are unsure whether it is legitimate:

  1. Do not pay anything. Stop all contact until you have independently verified the organization.
  2. Verify independently. Look up the organization through official sources — not the phone number or website provided by the caller. Call the agency’s published main number.
  3. Contact the FTC. Report the contact at ReportFraud.ftc.gov. Even if you did not lose money, your report helps investigators map these operations.
  4. Contact your state Attorney General. Many states have fraud units specifically equipped to investigate recovery scams.
  5. Tell someone you trust. Recovery scammers instruct victims to keep the contact secret. Breaking that isolation is one of the most protective steps you can take.

If you have already paid a recovery scammer, report it immediately to the FTC, the FBI’s IC3, and local law enforcement. While recovering cryptocurrency or wire transfer payments is genuinely difficult, reporting creates a record that law enforcement can act on and may prevent the same operation from victimizing others.

The Broader Truth

Recovery scams persist because they target one of the most fundamental human impulses: the desire to make things right after something has gone terribly wrong. They are engineered to exploit that impulse at its most acute moment — when a victim is still reeling, still hoping, and still desperate to believe that someone credible can help.

The protection is knowing that the call you most want to receive is the call you most need to scrutinize. Real help from real agencies is available — and it is free.