A crypto recovery scam is a second fraud aimed at people who already lost money to a first one: someone offers to trace or unfreeze your coins, then asks for a fee, a tax, or your wallet keys. No real investigator works that way. The FBI’s Internet Crime Complaint Center (IC3) will never ask for payment to recover lost funds. Genuine recovery starts with your bank, your exchange, or the government, and it costs nothing.

What a crypto recovery scam is

The CFTC describes the shape of it as advance-fee fraud with a particular target: “Recovery frauds target victims already harmed by other frauds.” The pitch arrives after the first loss, from someone who claims to trace blockchain transactions, to hold your money already, or to work with a court or an agency. The FTC’s guidance on refund and recovery scams reduces the whole category to one instruction: “Never pay upfront for a refund or help with a refund.” In the UK the FCA uses the older term “recovery room” for operators who approach people who lost money, “offering to help them get their money back for an upfront fee”.

The FBI treats these offers as part of the fraud cycle rather than a separate crime. Its July 2026 advisory on IC3 impersonation defines re-targeting scams, “often called ‘recovery’ or ‘double-dip’ scams”, as schemes where people posing as law enforcement, banks or cybersecurity firms promise to recover lost money or find the original thieves, and steal more instead.

The reported scale sits in the FBI’s 2025 Internet Crime Report, released in April 2026. Its recovery-scam category records 10,516 complaints and $1.4 billion in reported losses, alongside an increase in complaints naming impersonation of government officials and recovery firms. The report’s own footnote changes how that number should be read: losses in the category may also include money lost in the earlier scam that prompted the contact with the recovery company, so $1.4 billion is not a count of fees paid to recovery scammers alone. Complainants aged 60 and over filed 2,529 of those complaints and reported $540,505,980 in losses.

Why a recovery scammer knows what you lost

The unsettling part of the first contact is usually how much the caller knows. The FTC explains it without mystery: “Scammers buy lists of people who’ve paid scammers.” The trade name for the file is a “sucker list,” and it can carry a name, address and phone number, the kind of scam involved and the amount paid. The CFTC adds that such lists hold payment and contact information and personal details, and that fraudsters monetize them either by waiting a few months and running a second scam themselves or by selling the file on the dark web.

Often it is the same organization twice. The FCA warns that the people behind the original scam may operate the recovery room themselves and come back under a different firm name, or sell the details to other recovery rooms. Dutch police said the same in July 2026 about an investment-fraud network that employed around 700 people: victims who stopped investing were sometimes contacted by a recovery business, and those businesses were “likely part of the same fraudulent criminal organisation”. In an Albanian call-centre network dismantled with Europol and Eurojust support, announced on July 27, 2026, with losses of at least EUR 50 million, investigators found the same loop: the perpetrators re-contacted people who had already lost money on fraudulent platforms, offered to recover their funds, and told those who agreed to open accounts on crypto platforms and make “an initial deposit of EUR 500”.

Advertising fills the rest of the funnel. In 2023 the FBI noted that victims meet ads for fraudulent crypto recovery services in the comment sections under news articles and videos about cryptocurrency, in search results and on social media. The CFTC describes the sites those ads lead to as built to pass a quick inspection, with customer testimonials, A-plus ratings and five-star reviews, plus planted press releases that are hard to distinguish from the news site’s own articles and that sometimes cite real CFTC advisories.

Fake recovery companies and crypto tracing firms

The plainest version is a business that sells tracing. In 2023 the FBI described representatives of fraudulent businesses claiming to provide cryptocurrency tracing and promising to recover lost funds, contacting victims directly on social media or messaging platforms. After the up-front fee arrives, they either stop answering or produce an incomplete or inaccurate tracing report and ask for more money. The FBI’s advice on the advertisements themselves is to research the company and treat vague language, a minimal online presence and promises about recovering funds as warnings.

Even a real tracing firm runs into the same wall as a fake one. The FBI states it directly: “Private sector recovery companies cannot issue seizure orders to recover cryptocurrency.” Exchanges freeze accounts on their own internal processes or in response to legal process, and a victim’s other route is civil litigation. An SEC investor alert from 2016 described asset recovery companies that charge from hundreds to thousands of dollars, pull names and contact details of victims from court filings and investor lists, and in some cases “do little more than draft a demand letter to the original scam artist” and send a boilerplate complaint to the obvious regulator, two steps a victim can take alone and for free.

France’s financial regulator documented the technical flourish in January 2023. Victims who had been drawn into crypto fraud were then called by an “engineer” who was supposed to help them recover their crypto-assets “directly on the Blockchain.”

Fake law firms and the “crypto recovery law firm” pitch

A law firm is the most useful disguise in this fraud, for a reason written into US law. In June 2024 the FBI warned that fraudsters posing as lawyers from fictitious firms contact scam victims and claim authorization to investigate fund recovery cases, validating themselves by saying they work with, or have case information from, the FBI, the Consumer Financial Protection Bureau or another agency. They ask the victim to name a judgment amount, collect part of the fee up front with the balance due on recovery, demand payments for back taxes and other charges, and name real financial institutions and money exchanges to build credibility. Between February 2023 and February 2024, crypto scam victims further exploited by fictitious law firms reported losses of more than $9.9 million.

The FBI’s August 2025 update says the schemes now target vulnerable people, particularly the elderly, and exploit the emotional state and financial need left by the first scam. Its warning signs include impersonation of real lawyers and real firms, documents carrying a legitimate firm’s letterhead, references to invented regulators such as the International Financial Trading Commission, demands for payment in cryptocurrency or prepaid gift cards, and the claim that the victim appears on a government-affiliated list of scam victims. One line from that advisory is worth memorizing: “There are no law firms which are officially authorized partners of US Government agencies.”

Prosecutions show the back office. On September 14, 2026, Juliet Mora, 42, pleaded guilty to money laundering conspiracy in a $36 million fraud scheme, according to the US Attorney for the Eastern District of California. The organization stole from more than 400 American victims, mostly elderly, by pretending to be attorneys who approached timeshare owners and fraud victims with the promise that they were entitled to restitution; victims signed fake representation agreements and bogus non-disclosure agreements, then paid fees. Mora used fake emails of fake paralegals to communicate with them. Investigators arrested 15 US-based defendants across four states in October 2025 and seized more than $2.1 million in victim funds. Sentencing is set for December 14, 2026, and the maximum sentence is 20 years.

Fake FBI agents, fake IC3 staff and spoofed IC3 websites

In April 2025 the FBI reported that between December 2023 and February 2025 it received more than 100 reports of IC3 impersonation, and that “Almost all complainants indicated the scammers claimed to have recovered the victim’s lost funds” or offered to help recover them. The method described there was social: female personas joined online groups for financial fraud victims, presented themselves as fellow victims, and recommended that real victims contact a male persona called “Jaime Quin,” the alleged “Chief Director” of IC3, on Telegram.

The July 2026 update combines re-targeting with AI video and fake websites. In the first scheme, once a victim tells the scammers they will report them and file an IC3 report, an impersonator posing as an FBI agent contacts them on Facebook Messenger, moves the conversation to Telegram, and sends a link to update the submitted IC3 report; the link may carry malicious code or collect more financial data. In the second, a social media platform shared AI-generated videos of a senior FBI leader encouraging people to submit complaints on a spoofed IC3 site, where a single form step asks only for a name, phone number, email address, scam type and estimated loss, then returns a reference number and says someone will be in touch. The same advisory notes that scammers generate video for real-time chats with supposed company executives, law enforcement or other authority figures, which is the same technique behind cloned family emergency calls. The FBI’s 2025 report counted 22,364 complaints involving AI, with losses of nearly $893 million, and the bureau has issued separate warnings about AI-driven government impersonation.

The fake websites are a standing problem on their own. In September 2025 the FBI described threat actors spoofing the IC3 website with domains that use alternate spellings or a different top-level domain, which people reach while trying to find the real site to file a report.

Four statements from the July 2026 advisory settle almost every doubtful contact. IC3 “will never directly communicate with individuals via phone, email, social media”, phone apps, online chat or public forums; when more information is needed, FBI employees from local field offices or other law enforcement officers make contact. IC3 will never ask for payment to recover lost funds and will never refer anyone to a company that charges for recovery. “IC3 does not maintain a social media presence”, so any profile or page claiming to represent it is fraudulent. And to reach the real thing, type www.ic3.gov into the address bar instead of using a search engine, skip sponsored results, which are usually paid imitators, and check that the address ends in .gov. The broader rule has been constant: law enforcement does not charge victims a fee for investigating crimes, and the US government does not request payment for law enforcement services.

Fake regulators and fake government officials

In May 2025 the CFTC warned that imposters claiming to represent its Office of Inspector General were promising to help fraud victims recover money from foreign bank accounts. The office does not make such offers, and the agency’s test for email is simple: “All legitimate CFTC emails will come from @cftc.gov”. Its imposter guidance adds that the CFTC never asks for a fee or collects taxes, that there is no CFTC digital wallet that can send or receive crypto assets, and that the agency does not represent individual victims in fraud recovery efforts.

The SEC’s position matches: anyone claiming to be from the SEC and requesting an upfront payment to recover funds is running a scam, and harmed investors should never pay up front. France’s AMF reported in January 2023 that about fifty victims had received calls from a supposed “AMF investigator” while the display showed what appeared to be the AMF switchboard number; the regulator never contacts investors on its own initiative to recover funds or offer compensation, has no legal authority to do so, and notes that in a scam “only the courts have the power to intervene”. The FTC adds that a caller may claim to be from a government agency, even the FTC itself. The FCA’s version covers the email domain: “We never use webmail providers to contact consumers”, and neither does the government, law enforcement or a law firm.

Government impersonation across all payment types produced 32,424 complaints and $797,943,193 in reported losses in the FBI’s 2025 report. The tax-authority variant works the same way and is covered in our guide to AI-assisted IRS impersonation.

Release fees, back taxes and the frozen-account story

The fee has many names. The FTC lists “retainer fee,” “processing fee,” “administrative charge,” “tax,” “shipment and handling charge”; the FCA lists upfront charges described as a tax, solicitor or administrative fees, which can leave a victim worse off than the original loss. The CFTC describes the standard framing: the fraudsters claim to have the money already in hand or to be working with the court to distribute it, and tell the victim that most or all of it is assured once a small donation, retainer or overdue tax is paid, after which requests for more money follow.

The demand often mirrors the original fraud. In the FBI’s 2025 report, crypto investment fraud victims who try to withdraw are charged taxes and fees as a final extraction before the scammers disappear, and the same victims are then targeted in recovery scams. If you ask the recovery firm to take its fee out of the money it says it has found, the UK’s Action Fraud notes you will be told why that is impossible, for example that the money is under the control of a court and can only be paid back to you by them. If instead they ask for your bank account so they can deposit the recovered funds, Action Fraud’s warning is blunt: “They will use this information to empty your account.” The FTC adds the check variant: never deposit a refund check for more than you lost and return the balance, which is always a scam. In the crypto version the request may be for the keys themselves, and the SEC warns that fraudsters may demand upfront fees, costs, or the private key to the assets while claiming to recover losses or deliver a settlement payout. Fake exchange and compliance staff use the same release-fee story, which is how scam calls that claim to come from an exchange usually end.

How real crypto recovery works

Speed decides the part that can work, and it runs through banks rather than vendors. The FBI’s Recovery Asset Team, established in 2018, streamlines communication between financial institutions and FBI field offices to freeze funds through the Financial Fraud Kill Chain. In 2025 it worked 3,900 incidents covering $1,163,919,846 in attempted theft and froze $679,013,183, a 58% success rate. That process acts on transfers moving through financial institutions, which is why the report’s instruction is to contact your financial institution immediately and request a recall of the funds, and to file at ic3.gov regardless of the amount lost. Our guide to the first hour after money is taken covers the sequence in detail.

Where crypto is frozen, investigators and platforms do it. In July 2026 the US Secret Service described five civil forfeiture complaints filed by the US Attorney for the District of Columbia covering more than $25 million in crypto, with investigators freezing addresses and tracing them to more than 270 suspected fraudulent transactions in one case and freezing six addresses in another. One of the five, worth about $285,000, began as a recovery scam: the victim of an earlier unrelated fraud was contacted by people claiming to have recovered the stolen funds and was scammed into paying a fee to get it. The release puts the Scam Center Strike Force total at more than $800 million recovered.

Money that is forfeited can come back to victims through remission, and the Justice Department sets the terms. Remission compensates victims from assets forfeited from the perpetrators; it is a discretionary decision by the Attorney General, available only to victims who qualify based on the crime connected to the forfeiture, and the Assets Forfeiture Fund is not a general victim fund. Victims are generally identified by the seizing agency, such as the FBI, during its investigation, or notified by a US Attorney’s Office, which then tells them how to file a petition. The cost is nothing: “There is no fee for filing a petition for remission.” The department states the corollary for anyone who hears otherwise: “The Department and its Remission Administrators will never ask for payment” to participate in or receive funds from the process. Eligibility under 28 C.F.R. Part 9 requires a pecuniary loss of a specific amount caused directly by the crime, no complicity or willful blindness, no compensation already received and no other recourse reasonably available.

The arithmetic is sobering. The department says it cannot give a timeline, that the steps take a considerable amount of time, and that where net proceeds fall short of total losses the money is distributed proportionally, so “the funds available for remission do not fully compensate the victims” in most cases. The OneCoin process announced in April 2026 shows both halves: victims invested over $4 billion worldwide, and more than $40 million in forfeited assets was available for compensation, administered by a named settlement administrator through a published petition website with a June 30 filing deadline that has now passed. Since 2000, the department’s program has returned more than $12.5 billion in forfeited assets to crime victims.

Regulators run their own distributions. The SEC says a successful enforcement action sometimes results in recovered funds being distributed to harmed investors, directs questions about a specific matter to its Office of Distributions at ENFOfficeofDistributions@sec.gov, and notes that investors who do recover money may receive substantially less than their losses. The CFTC describes what a genuine notice looks like: victims eligible for legitimate restitution will likely be notified by mail, and the right response is to verify the letter by going to the agency’s or court’s website independently or calling it yourself, without ignoring it, because it could be real.

An unsolicited contact from the government is therefore not automatically fake. Under Operation Level Up, which notifies people who are still being defrauded, the FBI reports more than 8,000 victims notified and $500 million in savings to those notified; in 2025 it notified 3,780 victims of crypto investment fraud, and 78% of them did not know they were being scammed. The difference is the ask. A real notification does not come with an invoice.

Up-front recovery fees and the law

In the United States the central rule is the FTC’s Telemarketing Sales Rule. Under 16 CFR 310.4(a)(3), it is an abusive telemarketing practice for a seller or telemarketer to request or receive payment for services represented to recover money paid in a previous transaction “until seven (7) business days after such money or other item is delivered” to that person. The same paragraph exempts goods or services provided by a licensed attorney, which is one reason so many of these pitches arrive on law-firm letterhead and why the FBI’s advisories keep returning to “a ‘crypto recovery law firm’” as a warning sign. The rule governs telemarketing and does not by itself outlaw every online recovery offer, so treat the up-front fee as the signal the FTC says it is: “Did someone contact you and ask for an upfront fee? That’s a scammer.”

In the UK, a firm must be FCA-authorized to advertise or carry out claims management services, and the register can be checked with the FCA Firm Checker. The FCA also closes one of the recovery room’s favorite claims: a report of fraud can only be shared between law enforcement agencies and cannot be shared with a private business operating a recovery room, so a caller who says they have your police report does not.

Some US states have added their own routes. In November 2025 the Illinois Attorney General said that under a new state law, victims of crypto ATM scams may obtain a refund if they contact the ATM operator within 30 days to report the scam and submit a police report to the operator within 60 days, while repeating the limit that matters here: “Crypto assets can only be seized and recovered through valid law enforcement channels.” The FTC notes that crypto payments do not carry the legal protections of credit and debit cards, though some states have passed laws that might help. Kiosks remain a heavy channel: the FBI’s 2025 report counts 13,460 complaints and $389 million in losses involving crypto ATMs, 23% more complaints and 58% more losses than in 2024, and some cities have moved against the machines, as in Albuquerque’s crypto ATM ban.

This is general information rather than legal advice. If you are weighing a civil claim or a contract someone wants you to sign, a lawyer you find and vet yourself can say what applies where you live, and the criminal side starts with a police report.

Red flags in a recovery offer

  • Payment of any kind before any service, including a small deposit or fee (CFTC, FTC).
  • A caller who knows the exact amounts and dates of your earlier transfers and the company you sent money to (FBI); the CFTC’s version is that “The person or organization knows a lot about the money you lost.”
  • A claim that you appear on a government-affiliated list of scam victims, or that the firm is an authorized partner of a US agency (FBI).
  • Requests for payment in cryptocurrency, prepaid gift cards, wire transfers or a payment app, or to a third-party company unrelated to the service (FBI, FTC).
  • A regulator you cannot find, such as the International Financial Trading Commission (FBI).
  • Contact that moves to Telegram, WhatsApp, Facebook Messenger or a group chat with supposed bank processors and attorneys (FBI, CFTC).
  • A webmail address instead of an organizational domain (CFTC, FCA).
  • No physical address on the site, an address that cannot be found in map or street-view searches, or no phone number at all (CFTC).
  • Refusal to appear on camera or to show a license or credentials (FBI).
  • Reasons why the fee cannot be deducted from the recovered money, or a fee renamed a donation or tax (CFTC).
  • A request for your bank account details so the “recovered” funds can be deposited (CFTC), or for your private key (SEC).
  • Any social media account, link or video claiming to be IC3, including a link to update your IC3 report (FBI).
  • A guarantee that you will get your money back; government agencies do not make that promise.

Action Fraud’s one-line summary holds for the whole list: “Genuine agencies never ask for fees to recover money lost to fraudsters.”

What to do if a recovery firm contacts you

The FBI’s instruction for an unknown person who claims to be able to recover stolen cryptocurrency is to release no financial or personal identifying information and send no money. The CFTC suggests writing down the details without confirming any personal information, ending the call, and then calling the agency using the contact information on its official website. The FTC’s research step is to search the organization’s name online together with words like “complaint,” “scam” or “review,” to check with your state attorney general, and to look up a government agency’s number yourself rather than using a number they gave you or the one on your caller ID. The FCA adds a question that usually ends the conversation, which is to ask how the caller has information about your lost money, and advises ending all contact if you are asked for a fee or for bank, card or other financial details. For the AI-assisted versions of these calls, our checklist for protecting accounts covers the account-level steps.

What you can do if you already paid (United States)

  1. Contact whoever moved the money, immediately. The FTC’s instructions depend on the method: tell your bank or credit union to reverse a transfer, tell a card issuer to refund the charge, tell a wire company that a scammer tricked you into sending money, contact a gift card issuer, and for crypto contact the exchange or ATM operator, say the transaction was fraudulent and ask them to reverse it. For cash sent by mail, the US Postal Inspection Service line is 1-877-876-2455. The FBI’s own framing is that time is of the essence and that you should request a recall of the funds.
  2. File with the FBI at ic3.gov, typing the address yourself. The bureau asks for identifying information about the person or company that contacted you, the methods of communication used, including websites, emails, fake profile names and phone numbers, and the financial details: date, payment type, amount, account numbers, the name and address of the receiving institution and any receiving crypto addresses. Your local FBI field office can confirm whether anyone claiming FBI affiliation is real.
  3. If the victim is 60 or older, the Justice Department’s Elder Justice Hotline is 1-833-FRAUD-11, or 833-372-8311.
  4. Report to the FTC at ReportFraud.ftc.gov and to your state attorney general (FTC).
  5. If the original loss was investment-related, the SEC’s Office of Investor Education and Advocacy takes complaints at 1-800-732-0330 and Help@SEC.gov, and the CFTC asks that frauds be reported to local, state and federal law enforcement and regulators.
  6. If you handed over personal data, the FTC directs you to IdentityTheft.gov for a recovery plan.
  7. Expect a third round. A new helper who appears soon after you report, offering to fix the report or chase the money, is the same scheme: in the FBI’s July 2026 advisory, the fake FBI agent arrives precisely because the victim announced they would file a complaint.

Reporting in the UK and the EU

The UK’s national reporting service changed name and platform. From December 4, 2025, City of London Police launched Report Fraud, replacing Action Fraud as the national platform for reporting fraud and cyber crime, at reportfraud.police.uk or on 0300 123 2040, which is the same number as before. The phone line runs Monday to Friday, 8am to 8pm, callers from abroad use +44 300 123 2040, and a report produces a crime reference number. The FCA asks people who lost money to a scam to report it to the FCA and then to Report Fraud, with its consumer helpline on 0800 111 6768, and to check any firm against the Firm Checker and the Warning List. If you gave the fraudsters your bank account details, alert your bank immediately.

Reimbursement is where UK victims should read the small print. Under the Payment Systems Regulator’s rules, mandatory reimbursement for authorized push payment fraud has applied since October 7, 2024 to UK Faster Payments and CHAPS transfers, with a maximum of £85,000 per claim, a claim window of 13 months, a decision usually within five business days and up to 35 if the bank stops the clock, and an optional excess of up to £100 that does not apply to vulnerable customers. The regulator’s consolidated policy statement of May 2025 states the exclusion that matters in crypto cases: the requirement does not cover payments across other payment systems, such as money sent to your own account at a crypto exchange and then paid to a fraudster in cryptocurrency, nor international payments. A recovery fee paid by bank transfer to a UK account may fall inside the scheme; the same fee paid in crypto from your own exchange account does not.

There is no single EU-level portal for this. Reports go to national police and to the national financial regulator, and any firm offering recovery should be checked against that regulator’s register. France’s AMF asks for suspicious calls to be reported to its Epargne Info Service and stated in 2023 that only the courts can intervene in a scam. The enforcement record from 2026 explains why the firm that calls you rarely exists: both the Dutch investigation and the Europol-supported case in Albania found recovery offers coming from the same organizations that ran the first fraud.

How we checked this

We used primary sources only: FBI and IC3 public service announcements and the 2025 Internet Crime Report, consumer guidance from the FTC, CFTC and SEC, the text of the Telemarketing Sales Rule in the eCFR, Justice Department and Secret Service releases and a US Attorney’s office announcement, and UK and EU material from the FCA, the Payment Systems Regulator, City of London Police, the European Commission and Dutch police. Figures that predate 2025 are given with their year. Facts checked on October 5, 2026.