Recovery scams: when “we can get your money back” is the second scam

By the Blockhorizon Editorial Team · Updated 2 October 2026 · How we check facts

What is a recovery scam?

A recovery scam is a second scam aimed at someone who has already been scammed. The FCA calls them recovery room scams and describes them as fraudsters who approach “investors who have been scammed or had failed investments, offering to help them get their money back for an upfront fee.” Someone contacts you and offers to get back the money you lost, but only after you pay first.

The FCA says the scam tends to involve cold calling with high-pressure tactics, and upfront charges described as a tax, or as solicitor or administrative fees. Recovery rooms generally insist on being paid a fee or transaction charge before doing anything to recover your losses.

In its warning about online trading scams, which include fake crypto and forex platforms, the FCA says that after the original fraud, fraudsters may try to target you again or sell your details to other criminals.

Why are crypto scam victims targeted again?

Because a list of people who have already sent money to a scam is valuable to criminals. The FCA says the people behind the original scam may run the recovery room themselves and contact the victim again pretending to be a different firm, or sell the victim’s details on to other recovery rooms. That is how a stranger can know details of your loss.

The pool of potential targets is large. The FBI’s Internet Crime Complaint Center (IC3) recorded $11.366 billion in crypto-related losses in 2025, across 181,565 complaints. People aged 60 and over reported the largest crypto-related losses of any age group in those 2025 figures. These are only the losses people reported to the FBI, and they cover all crypto-related complaints, not recovery scams on their own.

FBI IC3 and FTC figures come from different reports and should not be added together.

Who do recovery scammers pretend to be?

Usually someone you would expect to be able to help. According to the FCA, recovery-room fraudsters may:

• pretend to be the FCA itself, or claim to work with the government, the police or another regulator;
• pretend to be from a different firm, even when they are the people behind the original scam;
• clone a real, authorised firm. The FCA says many fake firms use the name, firm reference number (FRN) and address of firms and individuals that really are FCA authorised.

Cloning is designed to survive a quick check. In a 2021 warning the FCA said scammers “will often copy FRN numbers and encourage victims to check the FCA Register to prove their legitimacy”. A matching name and number on the register therefore does not prove the person calling you works for that firm.

One detail gives many of them away: the FCA says it never uses webmail providers to contact consumers, and neither do the government, law enforcement agencies or law firms. The FCA adds that recovery rooms generally use a web-based email address, such as Gmail, Yahoo or Hotmail. An “FCA officer” or “solicitor” writing from a webmail address is a clear warning sign.

What are the warning signs of a recovery scam?

Any one of these is a reason to stop and check independently:

• Requests to pay before you receive anything. A tax, solicitor fee or administrative fee that must be paid before anything happens. The FTC’s advice is never to pay upfront for a refund or for help with a refund.
• Contact out of the blue. The FCA says scammers often call out of the blue. A recovery offer you did not ask for, by phone, email, text or social media, deserves extra suspicion.
• Claims to be a regulator, the police or the government. The FCA lists exactly these impersonations in its recovery-room warning.
• Webmail or look-alike email addresses. The FCA flags emails that look similar to a real firm’s, or that use Outlook or Gmail, as signs of a clone firm.
• Pressure to act now. The FTC says scammers use high-pressure sales tactics; the US Securities and Exchange Commission (SEC), through Investor.gov, lists pressure to invest right now and unsolicited requests for personal information as red flags.
• Requests to pay in unusual ways. Investor.gov lists requests to pay by gift card or credit card, or to wire money abroad or to a personal account, as fraud warning signs. The US Commodity Futures Trading Commission (CFTC) adds being pushed to convert your money into crypto first.
• Detailed knowledge of your loss. This feels reassuring but, as the FCA notes, the caller may be the original scammer or may have bought your details.

For the wider list of warning signs, see our guide to crypto scam red flags.

How do you check whether a recovery caller is genuine?

Do the check yourself, using contact details you find independently, never the ones the caller gives you.

1. Find the firm on the official register. In the UK, type the FCA Firm Checker address into your browser yourself; the FCA’s advice is: “Never click on links in emails or on company websites.” Outside the UK, the EU securities regulator ESMA says authorised firms must appear in the public register of the regulator of the country where they provide investment services.
2. Contact the firm only through the register. Because clone firms copy real names and reference numbers, the FCA advises using only the phone number and email shown on the FCA Register, not the contact details the firm gives you, and looking out for subtle differences.
3. Ask how they know about your loss. The FCA suggests asking a recovery caller how they have information about your lost money.
4. If anything does not match, ask the regulator. The FCA says to call it on 0800 111 6768 if the details don’t match.
5. Search the warning lists, but do not rely on them. The FCA Warning List names firms it is concerned are working without its permission. The FCA also says that if a firm isn’t on the list, “it may still be unauthorised or be a scam.”

Remember the FTC’s rule: government agencies and legitimate organisations will never ask for money to help you get a refund. If the conversation keeps coming back to a payment, treat it as a scam.

What should you do if you have already been scammed?

1. Stop sending money. Do not pay any fee to unlock, release or recover funds, whether the request comes from the original platform or from a new firm offering help. The FCA’s advice if you are asked for a fee or for your financial details is to “end all contact immediately and do not pay any money or provide any banking details.”
2. Protect your accounts. The FCA advises never giving your bank or card details unless you are certain who you are dealing with, and not downloading software from untrusted sources. The SEC’s advice is never to share your private keys or seed phrase; see how crypto wallets and private keys work.
3. Hang up on pressure. The FCA says to hang up or ignore messages if you are being pressured.
4. Report it. In the UK, the FCA asks you to report a scam to it and then contact Report Fraud. In the US, the FBI’s IC3 and the FTC both collect reports from fraud victims.
5. Expect follow-up offers. After you report, treat any unexpected “recovery” approach with the checks above.

What are the risks of answering a recovery offer?

The main risk is losing money twice. An upfront fee paid to a recovery scammer is simply a second loss. You may also be asked for bank or card details, or to download software; the FCA advises against both unless you are certain who you are dealing with.

Be realistic about recovery, too. The FCA says that if you deal with an unauthorised firm you won’t be covered by the Financial Ombudsman Service or the Financial Services Compensation Scheme (FSCS), and “it’s unlikely you’d get your money back.” Anyone who promises otherwise in exchange for a fee is the warning sign this page is about.