Losing money to a scam is bad enough. Some criminals have decided that the moment afterward, when a victim is desperate and looking for help, is the best time to strike again.
Federal agencies have issued repeated warnings about so-called recovery scams this year, and a Fox News report published Sunday shows how they look in the wild. It described paid Facebook ads offering to retrieve stolen funds and hacked crypto wallets, along with a page dressed up with images of the White House and FBI headquarters. Meta told Fox it removed the accounts and ads the outlet flagged for breaking its impersonation rules.
The offers may look different from one another, but the underlying trick rarely changes: someone claims they can get your money back, and getting it back turns out to cost you more.
How the con is built
The FBI updated its alert on this scheme on July 20. In one version it describes, a person who is being defrauded threatens to go to the FBI. Later, someone claiming to be an agent appears on Facebook Messenger, carries on the conversation there and on Telegram, and sends a link for “updating” the victim’s complaint with the bureau’s Internet Crime Complaint Center, known as IC3. That link may install malicious code or harvest more financial details.
A second version relies on deepfakes. According to the FBI, AI-generated video of a senior bureau official has been used on social media to steer people toward a counterfeit IC3 site. The imitation asks only for a name, phone number, email address, type of scam and estimated loss, then issues a reference number and promises a follow-up. Everyone who fills it out has just handed over a tidy summary of how they were hurt.
That kind of information is valuable. In an August 3 alert, the Federal Trade Commission said recovery scammers buy lists of people who have already been defrauded, betting that they can be fooled twice. A stranger who seems to know what happened to you may simply have paid for that knowledge.
The scale of official impersonation is large. The FBI says IC3 logged nearly 61,000 complaints about fake police and government officials from January 2025 through July 2026, with losses above $1.6 billion. That total covers many schemes, most of them false accusations of a crime, and is not a count of recovery fraud alone.
Four things that give it away
The “agent” found you on social media. The FBI is blunt here: IC3 has no social media presence, and any profile claiming to represent it is fraudulent. IC3 also does not contact people directly by phone, email, chat or app. If more information is needed, the bureau says, the contact will come from employees of a local FBI field office or from other police.
There is a fee. It might be called a retainer, a processing charge or an administrative cost. The FTC says real agencies and legitimate organizations do not ask for money or financial details in exchange for helping with a refund, and the FBI says IC3 neither charges for recovery nor refers people to companies that do.
There is a dollar cutoff or a guarantee. Fox reported that one page claimed losses above $4,000 might qualify for federal review, a threshold it could not find in FBI guidance. Nobody can honestly promise that stolen money will return, particularly cryptocurrency.
You are being moved somewhere else. Shifting from one app to another, clicking a special link or installing remote-access software all take the conversation away from any platform that might detect it.
What to do instead
File your report yourself by typing www.ic3.gov into the browser. The FBI specifically advises against relying on search engines for this, since sponsored results can be paid imitators. You can also report to the FTC at reportfraud.ftc.gov and to your state attorney general.
Keep the evidence, including screenshots, profile names, phone numbers, transaction records and crypto addresses. If you already sent money, call your bank or payment service right away and ask whether it can be stopped or reversed. If you shared banking details or a wallet recovery phrase, treat those accounts as compromised and move to secure them. Report any impersonating profile through the platform’s own tools.
Be realistic about what a report does. Filing one gives investigators information, but it is not a promise of repayment. Anyone who tells you otherwise is probably selling something.
