MalwareZero

Crypto recovery services: the second scam aimed at scam victims

Updated August 6, 2026

Almost everyone believes stolen crypto is findable, and that finding it is most of the way to getting it back. The first half is true. The second half is false, and the distance between them is where a whole second fraud industry has set up shop. So if someone contacted you offering to recover crypto you lost, assume it's a scam. The enforcement record is one-sided enough that the contact itself is the red flag, and the FTC published another warning about it on August 3, 2026.

The mechanic is simple and old. You pay an upfront fee, you receive something that looks official, and either the fee grows or the company stops answering. The FTC files it under refund and recovery scams, which is the same fraud that has been sold to people who lost money on timeshares and sweepstakes for decades. Crypto just made the victim list easier to buy.

How a recovery outfit gets your name after the loss

Two ways, mostly. The FTC says outright that recovery scammers buy lists of people who've already been scammed, because a proven victim is worth more than a cold number.

The other way is that you told them. If you posted about your loss in a Reddit thread, under a YouTube video about crypto fraud, in a Telegram group, or in a review on a complaint site, you raised a flag over your own head. The replies come fast, and they're often written to sound like a fellow victim: someone who lost the same way, found a specialist, got some of it back, happy to pass on the contact. That contact is the same crew.

Note what's missing. You didn't go looking for them.

The pitch and the fee names

The FTC lists the exact vocabulary: a "retainer fee," a "processing fee," an "administrative charge." They may claim to be a government agency (including the FTC itself), a consumer advocacy group, or a law firm.

The FBI's alert on fictitious law firms targeting crypto victims goes further into the staging. The fake attorneys claim you've been placed on a government-affiliated list of scam victims. They cite regulators that don't exist, including an invented "International Financial Trading Commission (INTFTC)." They produce documents on the letterhead of real law firms. And they run the whole thing in a WhatsApp group chat, with a supposed lawyer and a supposed bank processor both present, so it feels like a case file rather than a sales call.

The money asks follow a pattern too. Payment in cryptocurrency or prepaid gift cards. "Bank fees" said to be required to verify your identity and ownership before a withdrawal can clear. Payments routed to a third-party trading company, explained away as necessary for secrecy and safety. None of that is how any real legal or financial process works, and the gift card request alone should end the conversation.

Payment addresses sometimes arrive as a QR code, which conveniently hides where the money is going. If you're ever handed one, you can decode a QR code from a photo and read the destination before your wallet touches it.

The tracing report is the product, and it's worthless

In September 2024 the FBI's San Diego office seized the web domains of three companies operating in this space: MyChargeBack, Payback LTD, and Claim Justice. The Bureau's description of what customers actually got is the most useful sentence I've found on this whole subject. People paid an upfront fee expecting help recovering stolen crypto, and instead received a questionable tracing report and form letters to send to financial institutions.

That's the deliverable. A PDF and some templates.

The reports look impressive because blockchain data is public. Anyone can pull up transaction hashes, follow hops between addresses, and print a diagram showing your funds arriving at an exchange with a recognizable name. That part can even be broadly accurate. It's also legally inert. An exchange freezes an account in response to law enforcement process or a court order, not in response to a report from a firm you hired. Tracing and recovery are different things, and the entire business model lives in the gap between them.

The other thing worth knowing: confirmed blockchain transactions can't be reversed. Not by the network, not by a developer, not by anyone. Any offer built on "reversing" or "rolling back" your transaction is describing something that does not exist.

They will impersonate the FBI, and now on video

The IC3 published a PSA on July 20, 2026 about criminals impersonating the IC3 itself, using fake social media profiles, spoofed websites, and AI-generated deepfake videos to reach people who'd already been defrauded.

The PSA gives you three clean rules. The IC3 does not maintain a social media presence and doesn't investigate crimes or recover funds through Facebook, Telegram or similar platforms. The IC3 will never directly contact individuals by phone, email, social media, chat apps or public forums. And it will never ask for payment to recover lost funds, nor refer you to a company that charges for it.

One complication I'd rather you hear from me: the FBI genuinely does phone some victims, through a program that identifies people mid-scam and calls to warn them. So "the FBI called me" isn't automatically fake. The line that never moves is money. A real call from law enforcement does not end with a payment request, a fee, a bond, or a gift card. If the deepfake angle is new to you, the same technology shows up in voice cloning scams aimed at families, and a shared safe word handles both cases cheaply.

The routes that cost nothing

None of these guarantee you get money back. Most people don't. But they're free, they're real, and they're the only channels that can actually trigger a seizure or a freeze.

Is anything in this field legitimate

Some things, yes, and I'd rather be accurate than absolute. Blockchain analytics firms are real businesses, but they sell to exchanges, banks and law enforcement, not to individuals who lost $40,000. Licensed attorneys do take crypto cases, usually when the loss is large enough and the defendant is identifiable enough to sue.

A real lawyer looks different in ways you can verify without expertise. Licensed in a state, checkable against that state's bar directory in about two minutes. Gives you a written engagement letter. Refuses to promise a result. Doesn't take payment in USDT.

I can't tell you that nobody has ever recovered a dollar through a paid service, and I won't pretend the honest answer is cleaner than it is. What I can say is that in the enforcement actions I can read, the outfits that reach out first are effectively always fraudulent. So use that as the rule: if they contacted you, the answer is no.

If you already paid one

Dispute the charge today if a card or bank was involved. File at ic3.gov again and describe it as recovery fraud, separate from the original loss. Fill in the FBI questionnaire. Leave the WhatsApp group without announcing that you've worked it out, because a fight just gets you moved to a different script.

Here's the limit of everything above. None of it is likely to get your money back. The free channels are the only ones that can trigger a freeze or a seizure, and most people who use them still recover nothing. What this page can do is stop the second loss. It can't undo the first. Expect a third approach too, because you're on a better list now than you were before, and if the original loss started with a stranger's text, our page on the wrong number text scam explains the front end of the same pipeline.