Crypto Recovery Scams: How Victims Get Hit Twice

A crypto recovery scam targets people who have already lost money and promises to get it back for a fee. The "recovery firm", "lawyer" or "agency" is a second scammer, and paying it only adds to the loss. US law enforcement does not charge victims to investigate, and no private company can force the return of stolen crypto.

How the second scam works

The CFTC calls recovery fraud a form of advance-fee fraud aimed at people already defrauded.^[1] The victim pays something now in exchange for a promise of a much larger sum later.

The scammers know who to call. The FTC says they buy and trade lists of people who have already paid scammers.^[2] The CFTC adds that such lists can include the amount and type of the loss.^[1] That is why a stranger may know exactly how much you lost and when.

The approach comes in three main disguises.

Fake tracing or recovery firms. In 2023 the FBI warned of businesses that claim to trace cryptocurrency and promise to recover lost funds. Some contact victims on social media or messaging apps. Others advertise in search results, social media or news comment sections. They take an upfront fee, then either go silent or deliver an incomplete or inaccurate tracing report and ask for more money.^[3]

Fake law firms. The FBI has warned twice about fictitious law firms targeting crypto scam victims. In 2024 it said these "lawyers" often claim the case was referred to them by the FBI or another agency, ask for partial fees upfront, and then ask for back taxes and other fees. Victims of this scheme reported over $9.9 million in losses from February 2023 to February 2024.^[4] The 2025 update added more red flags: fake documents using a real firm's letterhead, a made-up "International Financial Trading Commission", WhatsApp group chats, and requests to pay "bank fees" before a withdrawal.^[5]

Fake government officials. Scammers pose as staff of real agencies. The FBI has warned about people impersonating the IC3, its complaint centre, to contact past victims and promise recovery.^[6] The CFTC has warned about callers posing as its Office of Inspector General, offering to recover money held in foreign bank accounts.^[7] The FTC says scammers also claim to be the FTC, a consumer group or a law firm.^[8]

What real agencies say they will not do

These statements come straight from the agencies. If someone does the opposite, they are not who they say they are.

• The FBI does not charge fees. "Law enforcement does not charge victims a fee for investigating crimes."^[3]
• IC3 does not ask for payment or refer you to a paid recovery company. It also says it never contacts individuals directly by phone, email, social media or chat apps.^[6]
• No law firm is an official partner of US government agencies.^[5]
• The CFTC's Inspector General does not offer to recover investment losses. Real CFTC emails come only from @cftc.gov addresses.^[7]
• Legitimate organisations do not charge to help with refunds and do not ask for account numbers.^[2]

The "tracing report" problem

This is where fake recovery overlaps with fake AML tools. A tracing report or a risk score can look official. It may show transaction graphs, wallet labels and an exchange name. None of that moves money.

The FBI is direct about it: private recovery companies cannot issue seizure orders to recover cryptocurrency. Exchanges freeze accounts only through their own processes or in response to legal process.^[3] A firm that says it can "freeze the scammer's wallet" once you pay a fee is claiming a power it does not have.

A genuine AML check is a different thing. It describes the history of an address and the risk categories linked to it, such as scam. It does not recover funds, and an honest service does not promise to. We list services that pretend otherwise on our fake AML checkers page, and explain how to spot them in the guide to fake AML checkers.

Red flags

Any one of these should stop you:

• They contacted you first, and they already know details of your loss.^[5]
• They ask for a fee, "tax", "donation" or deposit before any money is returned.^[1]
• They want payment in crypto, gift cards or wire transfer.^[2]
• They will only talk on Telegram, WhatsApp or another messaging app, or use a web-based email address.^[1]
• They refuse to appear on video or show a licence.^[5]
• They name an agency you cannot find, or claim an official partnership with a real one.^[5]
• They ask for your bank details so "recovered" funds can be deposited.^[1]

What to do

1. Do not pay anyone who promises to recover lost crypto. Paying a second time does not unlock the first loss.
2. Report the original theft yourself. Go to www.ic3.gov by typing the address into the browser, not through a search ad.^[6] In the US you can also report to the FTC and your state attorney general.^[8]
3. Include the transaction details. The FBI asks for wallet addresses, amount and type of crypto, date and time, and the transaction ID (hash).^[9] Also describe any contact with recovery firms.^[3]
4. Verify any caller through official channels. Look up the agency's or firm's contact details yourself. Do not use the number or link they sent.^[2]
5. If the funds sit at an exchange, contact the exchange directly. See our guide on what to do when an exchange freezes funds.
6. If you already paid a recovery scammer, contact the service you paid through at once and report it the same way.^[8]

This article is general information, not legal advice. If you need a lawyer, find one yourself through your local bar association, not through someone who contacted you.