Lost money to a scam? Beware the stranger who promises to recover it

After a scam, people lose more than money. They lose a sense of control and begin looking for someone who can say, “I know where the funds are and I can recover them.” That is when another scammer may appear—this time disguised as a lawyer, public official, police officer or cryptocurrency specialist.

The scheme is particularly cruel because it exploits an earlier loss. The caller knows the amount, the name of the fake platform and perhaps details from the original conversation. That is not proof of an investigation. In August 2026, the US Federal Trade Commission issued a fresh warning about recovery scams, explaining that fraudsters may trade lists containing information about previous victims.

How the second scam develops

The approach may come days or weeks after the loss. A “law firm” claims it has found a cryptocurrency wallet. An “authority” announces a compensation fund. An “analyst” displays money on a screen that is supposedly ready to be withdrawn.

Then one final obstacle appears: an administration charge, tax, commission, deposit or processing cost. Payment is urgent and often requested in cryptocurrency. In another version, the caller asks for banking details to deposit the refund or wants remote access to the victim’s phone or computer.

The FTC describes the same pattern: unexpected contact, a recovery promise, impersonation of an authority or law firm, followed by a demand for money or financial information. Poland’s 2025 CSIRT KNF report shows adverts for fake recovery services and warns about upfront payments followed by new demands.

Six warning signs

• The “helper” contacts you first and already knows details of your loss.
• They guarantee a complete recovery or quote an exact amount without credible evidence.
• They invoke the police, a prosecutor, financial regulator, foreign authority or recognised law firm, but insist that you use only the contact details they supplied.
• They demand a fee, tax or bond to “release” money that has supposedly been found.
• They want cryptocurrency, gift cards or a fast transfer to an individual’s account.
• They ask for online-banking credentials, an approval code, identity documents or remote control of a device.

A legitimate lawyer charging for professional work is not, by itself, evidence of fraud. The danger is the combination of unsolicited contact, guaranteed success, pressure and a payment supposedly required to unlock funds that already exist. Polish police warn affected consumers that prosecutors and police units do not ask citizens to pay for the recovery of stolen money.

What to do instead of paying the “helper”

Return to a genuine response path. Contact your bank, card issuer, exchange or payment provider using details from its official website. Ask whether the transaction can be stopped or disputed. Speed matters, but nobody should promise a particular outcome.

Report the crime to the police and retain the reference number. Poland’s Central Bureau for Combating Cybercrime recommends preserving correspondence, transfer confirmations and information about the person involved. Suspicious domains and messages affecting Poland can also be reported through incydent.cert.pl.

If you want professional help, find a law firm yourself, verify the lawyer in the relevant public register and call a number obtained independently. Ask for the scope, fees and risks in writing. Never give anyone remote control of your banking session.

If you paid a second time

Do not conceal it for fear of judgement. Contact the bank immediately and explain that the two transfers are related. Report the second approach to the police and preserve adverts, profile names, domains, phone numbers, bank accounts and wallet addresses. If you shared credentials, change passwords on the official sites and close unfamiliar sessions.

A trusted person can help by recording facts and making official calls—not by asking, “How could you believe them again?” The second scammer arrives when the victim is most motivated to repair the damage. That is deliberate manipulation, not proof of poor judgement.

Source facts and Breachroad’s conclusion

The FTC describes victim lists, impersonation, upfront fees and requests for financial information. The Polish examples of adverts, escalating charges and reporting routes come from CSIRT KNF and the police. Breachroad’s conclusion is that an incident plan should cover the weeks after the original fraud, when a second wave of contact may arrive.

You may also want to see how a fake remote-work task scam ends and how a romantic relationship can lead to a fraudulent investment. Our cybersecurity training for employees helps people pause under pressure and verify a supposed helper as carefully as the original offer.