Crypto recovery scams: how fake fund-recovery services target victims

A recovery scam is a second scam aimed at people who have already lost money. Someone posing as a lawyer, investigator, “blockchain recovery expert” or even a government agency promises to get your crypto back, then takes more of your money.

How common recovery scams are

The FBI's 2025 IC3 Annual Report counted 10,516 recovery scam complaints with about $1.4 billion in reported losses. The FBI notes that figure can include money lost in the earlier scam that led to the recovery contact. People 60 and older filed the most complaints, 2,529, with about $540 million in reported losses.

The FTC calls these “the worst of the worst” because they deliberately target people who are already hurting. The FTC's data also shows that people who lost money on fake investment platforms often reported follow-up losses to scammers offering to trace and recover funds for a fee.

How recovery scams work

1. They find you. According to the FTC, scammers buy and trade lists of people who have already been defrauded. Others post in online support groups for victims or run ads aimed at people searching for help.
2. They look official. Fake law firm letterheads, real lawyers' names, invented agencies, badges and case numbers. Some claim to be from the FBI, the IC3 or the FTC.
3. They know your story. They may cite your exact losses, dates and the platform you used, which feels like proof. It is not.
4. They ask for money or access. A “retainer,” “processing fee,” “tax,” “bank verification deposit” or your seed phrase so they can “scan” your wallet.
5. The fees never end. Each payment unlocks a new obstacle until you stop paying.

Red flags the FBI has flagged

In an August 2025 warning about fictitious law firms, the FBI listed signs that include:

• Claims of being an official partner of US or foreign government agencies. The FBI says no law firms are officially authorized partners of US government agencies.
• References to agencies that do not exist, such as an “International Financial Trading Commission.”
• Requests for payment in crypto or gift cards. The FBI notes the US government does not charge for law enforcement services.
• Saying you appear on a government list of scam victims and can recover money through “legal channels.”
• Telling you your funds are held at a foreign bank and asking you to open an account there.
• Moving you into a WhatsApp or similar group chat with supposed bank officers and attorneys.
• Refusing to show credentials or meet on video.

The IC3 has also warned about impersonators who join victim support groups on social media, pose as fellow victims, and point people to a fake IC3 “director” on Telegram. The real IC3 does not contact individuals directly and will not refer you to a company that charges for recovery.

How to vet anyone offering help

• Start the contact yourself. Ignore unsolicited offers in DMs, comments, emails and calls.
• Verify licenses independently. Check a lawyer on your state bar's website and call the firm on a number you look up yourself.
• Insist on a live video meeting and a written agreement that spells out services, fees and outcomes. The FBI even suggests asking for notarized proof of identity.
• Never share your seed phrase or private keys, and never install remote-access software for them.
• Distrust guarantees. Nobody can reverse blockchain transactions or “hack back” stolen crypto.

What actually helps

Real recovery is uncommon and usually comes through law enforcement seizures or exchanges freezing funds after a report. Your best moves are free: file at ic3.gov and ReportFraud.ftc.gov, file a local police report, and notify any exchange involved with transaction IDs and wallet addresses.

If you lost access to a wallet rather than having funds stolen, our wallet recovery guide covers what you can safely do yourself. For the broader scam picture, visit the security and scams hub.

Updated October 4, 2026 by The Crypto Guide editorial team. Educational content, not financial, legal or tax advice. Spot an error? Request a correction.