The recovery scam: whoever lost money in one scam becomes the target of the next

People who lose money in a scam usually get an offer, weeks later, to recover it. In New York, the Brooklyn District Attorney's Office showed where that offer can come from. On October 14, the office's Virtual Currency Unit announced, alongside the FBI, that it had taken down 241 domains and 112 servers belonging to a fake crypto investment scheme aimed at Russian speakers, with a heavy concentration of victims in Brooklyn itself. In the data pulled from the servers, investigators found a second operation: the same scammers were going back to their victims "a few weeks after the initial deception," promising to recover what had been taken.

The first scam followed a script that is familiar in Brazil. A Facebook ad led to an "investment advisor" who called, helped open an account on a crypto platform, and walked the victim through buying coins and sending them to addresses tied to the platform. Weeks or months later, at withdrawal time, the account froze or additional fees and taxes appeared. Prosecutors estimate losses in the tens of millions of dollars, with victims who lost a lifetime of savings, and say they have seized roughly US$300,000 so far. The announcement mentions no arrests: it describes search warrants and the takedown of the infrastructure, which, according to the office, strips the scammers of the ability to spin up new sites and to go back after former victims.

The caller already knows what you lost

The Brooklyn detail explains why the second scam works. Whoever approaches the victim knows how much was lost, on which platform, and when — because they have the data from the first scam, or because they are the same crew. The FTC, the U.S. consumer protection agency, describes lists that are bought, sold and traded among scammers, carrying names, addresses, phone numbers, the type of scam the person fell for, and how much they paid. Anyone who has been hit once is treated as a good bet to be hit again. The approach arrives carrying information that looks like inside knowledge, and that is precisely why it lands.

The FBI has been flagging the pattern since 2023. In August of that year, it described companies presenting themselves as crypto tracing specialists that charge up front and disappear, or deliver an incomplete or flat-out wrong tracing report and then ask for more money for the "recovery." In June 2024, the alert covered fictitious law firms claiming to represent the victim against the scammer or before a government body, asking for "back taxes and other fees" to release the money. Between February 2023 and February 2024, victims of this second scam reported more than US$9.9 million in losses to the FBI. An August 2025 update added forged letterhead, invented regulators, and WhatsApp groups charging a "bank fee" to release the withdrawal.

In the annual report from the FBI's Internet Crime Complaint Center, IC3, the recovery scam accounted for 10,516 complaints in 2025, 2,529 of them from people aged 60 or older. The report also gives a dollar figure, but warns that it may include what the victim lost in the previous scam — the one that prompted the contact. For that reason, the figure is not reproduced here.

In Brazil, the same machinery goes by another name

We found no alert from a Brazilian government body dedicated to the recovery scam under that name. What does exist, in volume, are alerts about the same machinery: paying up front to release money the victim believes is theirs.

The Comissão de Valores Mobiliários describes offers to "recover" a forgotten investment in exchange for advance payment of "income tax," "brokerage," or even a "fee charged by the CVM," and tells investors to be suspicious of any demand for new payments "of any kind, to release withheld balances." It is the same thing that happens inside fake investment platforms at withdrawal time. The CVM also warns that it has no legal authority to order assets returned or losses reimbursed: anyone calling in its name promising to give money back is lying about what the agency itself can do.

The Banco Central says, regarding the Valores a Receber system, that the service is free, that nobody pays anything to access the funds, and that the BC does not send links or contact anyone about the matter.

The judiciary deals with the most widespread version of the mechanism, the fake-lawyer scam. The Ombudsman's Office of the Conselho Nacional de Justiça has logged 88 complaints since May 2025 about scammers who, posing as lawyers, "promise the release of settlements or court-awarded funds in exchange for advance payment." The labor courts point out that, in a court case, funds are released "without the need for any prior or additional payment." On October 8, the Polícia Civil do Paraná arrested ten people in Ceará in a case that began with roughly R$2 million in losses suffered by an elderly woman in Curitiba, approached by criminals posing as her lawyer and as representatives of public and financial institutions. "Except that you have to pay to withdraw that money, and victims end up making the payments," the lead investigator explained.

The only difference between the two scams is the invented credit. In the fake-lawyer version, it is a settlement or a won case. In the recovery scam, it is the very money the victim has already lost — which makes the offer that much harder to turn down.

What nobody legitimate ever does

No government body charges to give money back, and the FTC sums up the rule: government agencies and legitimate organizations never ask for money to help someone obtain a refund. Recovering money lost in a scam, when it happens at all, runs through one of the following routes, and none of them starts with someone calling to charge a fee.

With Pix, it is the victim's bank that triggers the Mecanismo Especial de Devolução, the MED, and the refund depends on there being a balance in the account that received the money. We explained why the money often doesn't come back, and what to do when it doesn't.

In crypto, what locks the money up is a freeze by the token issuer or the exchange, and the request comes from an authority or a judge. The FBI writes that private recovery companies cannot issue seizure orders for cryptocurrency, and that exchanges only freeze accounts through internal process or in response to a legal order. We showed what a USDT freeze actually reaches, and what it does not give back.

Beyond that, the route is litigation, with a lawyer the victims chose and hired themselves, whose registration they can check with the OAB.

The red flags

An offer to recover money that turns out to be a scam usually carries several of these traits. They contacted you, not the other way around. They already know details of the scam you suffered. They claim to speak for a bank, the Banco Central, the CVM, the police, a court, or a law firm you never hired. They guarantee the outcome. They charge up front, under the heading of a fee, tax, court costs, retainer, or bond. They want payment by Pix to an individual, in crypto, or in gift cards. And they are in a hurry.

If an approach like that has reached you, do not pay and do not send documents or banking details. Verify the person or the agency through a channel you found yourself, not through the number or link that came in the message. And take the contact to the police along with the report on the first scam: the FBI asks victims to report their conversations with anyone offering recovery as well, and the logic is the same in Brazil, because the caller may be the same crew.

A disclosure about us

CyberX works with scam victims, which is why this section is declared and set apart. The crypto wallet lookup is free and requires no sign-up: it shows where the money went, and the preliminary report arrives by email with a protocol number and a hash that anyone can verify at cyberx.to/verify. When a case calls for investigation, CyberX responds with a scope and a proposal. CyberX does not recover funds, does not freeze wallets, is not an authority, and does not guarantee outcomes. What it delivers is documentation for those who can act: the authorities, the judge, the victim's lawyer. Be suspicious of anyone promising more than that — including anyone using our name.

In one line

Nobody who lost money in a scam needs to pay anyone to try to get it back, and whoever charges before doing anything is usually the next scam.

Sources

• Brooklyn District Attorney's Office — Brooklyn DA's Virtual Currency Unit Dismantles Infrastructure of Multinational Crypto Investment Scam that Targeted Russian Speakers (10/14/2026)
• FBI, IC3 — Increase in Companies Falsely Claiming an Ability to Recover Funds Lost in Cryptocurrency Investment Scams (08/11/2023), Fictitious Law Firms Targeting Cryptocurrency Scam Victims Offering to Recover Funds (06/24/2024) and update of 08/13/2025
• FBI, IC3 — Internet Crime Report 2025 (p. 54)
• FTC — Refund and Recovery Scams (December 2023)
• CVM — Ofertas / Atuações irregulares (updated 08/08/2025) and Solicitar atendimento (investidores)
• Banco Central — Valores a Receber: não caia em golpes
• CNJ — Ouvidoria do CNJ registra denúncias de golpe do falso advogado e articula medidas de segurança com tribunais (03/18/2026) and Justiça do Trabalho alerta para golpe sobre pagamento de custas processuais (10/09/2024)
• Polícia Civil do Paraná — PCPR prende 10 pessoas em operação contra golpe do falso advogado no Ceará (10/08/2026)
• CyberX — MED didn't refund your Pix scam: what to do now and Tether freezes USDT: what it means for scam victims