Table of Content
Table of Content
Table of Content
Recovery Scams: When Fraudsters Target Victims Again
Losing money to fraud is usually treated as a single event. For a large share of victims, it is the first of two. A recovery scam targets people who have already been defrauded, offering to trace and return the money in exchange for an upfront payment.
The approach often arrives months after the original loss, from someone who already knows what happened, how much went missing and which platform took it.
That knowledge is what makes the second approach work. It arrives at the point when the loss is still unresolved, and it asks for a decision while hope is doing most of the thinking.
What a recovery scam is and why it works
Refund and recovery scams are a second-stage fraud built on the first. The operator contacts someone known to have lost money, claims the funds have been located or frozen, and asks for a payment to release them.
The payment is described as a filing cost, a legal retainer, a transfer tax or an escrow deposit. Once it is sent, another obstacle appears, and an additional payment is requested.
The pool of people to target is large. The EU Agency for Fundamental Rights found that one in four people in the EU has fallen victim to online fraud in their lifetime, that more than a third of those victims were caught by more than one type of fraud, and that only 15% report it to the police.
The low reporting rate matters here: someone who never told the police, and perhaps never told their family, has little to compare a plausible-sounding offer against.
horizontal scroll
| Online fraud in the EU | Share |
|---|---|
| Adults have been defrauded online at some point in their lifetime | 1 in 4 (24%) |
| Victims caught by more than one type of fraud | 37% |
| Victims who experienced an investment scam | 20% |
| Victims who report the fraud to the police | 15% |
Lifetime experience of online fraud among EU adults, from a Eurobarometer survey of 26,453 respondents. Source: EU Agency for Fundamental Rights, 2026
Three things about follow-up fraud that are easy to miss.
The caller often has your file. Contact details, loss amounts, and platform names are often taken from the form the victim filled out during the first fraud, which is why the second approach sounds so well-informed.
Regulators get impersonated more than they get consulted. France’s markets regulator, for example, has warned that fraudsters phone previous investment-scam victims, posing as its own investigators, with its switchboard number displayed.
The second fraud can be run by the same people as the first. In a call-centre taken down in February 2026, the group that ran the fake investment platform also ran the follow-up, charging victims again for supposed legal help to get their money back.
The people they claim to be
A fund recovery scam needs an identity with enough authority to justify a payment. Four are used repeatedly. A fake recovery lawyer or law firm is the most common, because legal work often requires upfront payment before results.
Schemes include:
- A scam recovery company that presents itself as a specialist asset-tracing business, often with a professional website and a registration number that belongs to somebody else.
- A crypto recovery scam that promises blockchain forensics, trading on the idea that digital assets can be traced and clawed back by technical means.
- A victim support scam that poses as a charity, advocacy group or class-action organiser gathering victims together.
Regulators are impersonated, too. The French Autorité des marchés financiers warned that around 50 people who had previously lost money to investment fraud reported receiving calls from someone claiming to be an AMF investigator or a fraud department officer, offering to recover their losses, with the authority’s own switchboard number displayed.
The AMF’s position, stated in that warning, is that it never contacts investors on its own initiative to offer fund recovery or compensation. The same holds for supervisors across the euro area, and for payment providers: a supervisor does not run a refund desk.
The upfront fee is the business model
Whatever identity is used, the mechanism is the same. An upfront fee recovery scam requires payment before anything is delivered, because nothing will be delivered. The request is rarely framed as a fee for recovery, which would sound mercenary.
It is framed as a cost the recovery requires: a court filing, an insurance bond, an anti-money-laundering clearance, and a tax on repatriated funds. Asset recovery fraud also relies on the arithmetic feeling of reasonableness. A payment of €500 against a loss of €20,000 reads as a sensible gamble.
In February 2026, Eurojust coordinated the takedown of a call centre that had run a fake investment platform and then approached the same victims a second time, asking for further funds supposedly to pay for legal support to recover the assets they had lost.
At least nine victims in Latvia and Lithuania lost more than €160,000 before eleven people were arrested and over €400,000 in cash was seized.
What works after a scam
Where should you report a recovery scam, and what else is worth doing?
- Tell your payment provider immediately. Speed affects whether a transfer can still be recalled, and an unauthorised transaction carries a legal right to a refund under EU payment rules.
- Report it to your national police. Low reporting rates are part of what keeps these operations viable, and a report is normally needed before anything else can proceed.
- Put the complaint to the provider in writing, keeping the dates, amounts and correspondence together, so that there is a record to escalate if the reply doesn’t resolve it.
- Check any firm that approaches you against the national regulator’s own register and warning list, reached by typing the regulator’s address yourself rather than following a link you were sent.
For a cross-border dispute, the European Commission runs FIN-NET, a network of national out-of-court dispute bodies covering the EU, Iceland, Liechtenstein and Norway. You first complain to the provider; if that doesn’t resolve it, you submit the FIN-NET form to a member in your country or to the provider.
Most members handle complaints free or at low cost.
Their decisions are not usually binding on the firm, though they are often followed. Recovering money lost to fraud is frequently difficult, particularly across borders, and no legitimate body will tell you otherwise before looking at your case.
Protecting the account you still have
If you have been approached, assume your details are circulating and secure the account that is still live. Every Blackcat payment card is enrolled in 3D Secure by default, and transactions are monitored continuously, with payments either declined automatically or passed for manual review.
If a card may have been exposed, you can block it yourself: open the app, select the card, tap “Block card”. It applies immediately and can be reversed. Support arranges permanent closure and reissue after a block, with a replacement posted to your registered address.
Blackcat support will never ask you to pay a fee to release funds. Reach us at support@blackcat.app or through in-app chat, and read more about Blackcat security.
Frequently asked questions
What is a recovery scam?
What is a recovery scam? It is a fraud aimed at people who have already lost money to another fraud. The operator claims to have located the funds and asks for a payment before releasing them, then requests further payments as new obstacles appear.
How do recovery scammers find previous victims?
How do recovery scammers find victims? Usually, through details the victim supplied during the first fraud, sometimes resold between groups, and sometimes through online advertising aimed at people searching for help after a loss.
Can a lawyer guarantee the recovery of stolen money?
No lawyer can, because the outcome depends on where the money went, which jurisdictions are involved and whether anything remains to be traced. A guarantee is itself a warning sign.
Are cryptocurrency recovery services legitimate?
Some blockchain analytics work is genuine and is normally commissioned by law enforcement or courts. A crypto recovery scam is the type that approaches you directly, promises results, and demands payment first.
Should I pay an upfront fee to recover funds?
No. Treat any request for money before recovery as the fraud itself. The payment does not reduce the original loss; it adds a second one.
How can I verify a recovery company?
Check it against your national regulator’s register and warning list, typing the regulator’s web address yourself. Confirm that the registration number belongs to that firm, and call the regulator using a number you found independently.
Who can legitimately help after a financial scam?
Your payment provider, the national police, your national financial dispute body, and FIN-NET for cross-border complaints. None of them asks you for a fee to release recovered funds.
