The second scam
Spot recovery scams
A recovery scam targets people who have just lost money. Someone appears, often out of the blue, claiming they can trace and return your funds, usually for a fee paid upfront. They take a second payment and disappear. Here is how to see it coming.
Warning signs
If you notice even one of these, treat it as a scam and walk away.
- A promise or guarantee to get your money back, especially crypto.
- Any upfront fee, deposit, tax or 'release' payment before funds are returned.
- They contacted you first after you were scammed, often by WhatsApp, Telegram, Instagram or email.
- They claim to be a hacker, a 'certified fund recovery agent', or to work with a government agency or exchange.
- They ask for your wallet seed phrase, private keys, passwords or remote access to your device.
- Pressure to act immediately, or to keep the arrangement secret.
- A convincing dashboard showing a 'recovered balance' that you must pay a fee to withdraw.
What legitimate help looks like
Honest routes exist, but they look nothing like a cold message promising your money back.
- Police and government agencies never charge a fee to take your report.
- No honest service guarantees recovery. Most blockchain transfers are permanent and cannot be reversed.
- Regulated lawyers and firms are open about their credentials, fees and realistic chances, and never ask for your seed phrase.
- Your bank, card network or exchange are the legitimate parties who may be able to act on a transaction.
Already paid a recovery scammer?
You are not alone, and it is not your fault. These people are experts at targeting someone who is desperate to undo a loss. Act on these steps now.
- 1Stop all contact with them straight away and send no more money, whatever they threaten or promise.
- 2Report the recovery scam to the official agencies, noting that it is a second fraud that followed the first.
- 3Tell your bank or card issuer about the new payments so they can try to stop or recall them.
- 4If you shared your seed phrase, keys or passwords, move any remaining crypto to a new wallet and change your credentials now.