"We Can Get Your Money Back" Is Usually the Second Scam
✓ Last verified 2026-07-27
There’s a specific kind of fraud that only targets people who have already been defrauded once. Regulators call it recovery fraud, and it works because it arrives at the exact moment someone is most willing to believe a way out exists.
The scale isn’t small. The UK’s FCA reported 4,465 reports of fake FCA scams in the first half of 2025 alone, with 480 people actually sending money to the fraudsters — and that’s impersonation of a single regulator, in a single country, in six months.
Why you specifically get targeted
Victim lists are an asset. When an investment fraud operation collapses, the list of people who paid — with amounts, contact details, and evidence of susceptibility — is sold, traded, or reused by the same group under a new name.
From the fraudster’s perspective, you are the highest-quality lead available. You have demonstrated that you will send money to a stranger online. You are now under financial stress. And you have a strong, specific, emotionally loaded goal that they can offer to fulfil.
This is why the second approach often arrives within weeks of the first loss, and why it frequently references details of your actual case. Those details aren’t proof of legitimacy. They came from the first scam.
The forms it takes
Regulator impersonation. Someone claiming to be from the SEC, FCA, ASIC, or a similar body contacts you saying funds have been recovered or seized and can be released to you — after a fee, tax, or verification payment.
Fake law firms. Professional-looking websites, credible-sounding names, sometimes real lawyers’ names and photographs lifted from legitimate firms. They ask for a retainer.
Blockchain “tracers” and ethical hackers. Common where crypto was involved. They send you a convincing-looking tracing report showing your funds sitting in an identified wallet, then ask for payment to complete the recovery.
Fake asset recovery companies. Frequently found by people searching online for how to get money back — which is exactly why they buy ads against those searches.
The same operators, returning. Sometimes the original scam contacts you directly, framed as “compensation for affected clients,” requiring a fee to process.
The structural tell
Every version reduces to the same shape, and this is the part worth memorising:
You are asked to pay money in order to receive money.
The fee has many names — release fee, tax, legal retainer, gas fee, escrow deposit, anti-money-laundering verification, insurance bond. The name changes; the structure doesn’t. Money must leave your account before the promised money arrives. It never arrives, and there’s usually a second fee.
Things that look like proof but aren’t
Recovery fraud is convincing because it is well-produced. None of the following mean anything:
- A regulator’s logo, letterhead, or a reference number. All trivially copied.
- An email from an address that looks official. Display names are forgeable; lookalike domains are cheap.
- A phone number that matches the regulator’s public number. Caller ID spoofing is routine.
- Knowing your case details. They have the victim list.
- A registered company with a real address. Registration is not authorisation, and addresses can be virtual offices.
- A tracing report showing “your” funds. Blockchain explorers are public. Anyone can produce a screenshot of any wallet.
- Positive reviews. Review sites are gamed hardest in exactly the categories where victims are searching.
The one rule that defeats all of it
Regulators and law enforcement do not charge victims a fee to return their money, and they do not contact victims out of the blue asking for payment.
If the SEC, FCA, or any other authority genuinely has funds to distribute, that happens through a formal published process — not a private message, not an urgent call, and never conditional on you paying first.
So: end the conversation, and then verify independently. Look up the agency’s contact details yourself, on a site you navigated to by typing the address — never a number or link supplied by the person who contacted you. Then ask them directly whether the contact was genuine.
Nothing legitimate is lost by taking a day to check. Which is precisely why every version of this fraud insists you must act now.
If you are already in it
Stop paying. The sunk cost is real and painful, but each additional payment is a fresh loss, not an investment in recovering the first one.
Then report it as a new offence — because it is one. The reporting process is the same as for the original fraud, and the second incident often produces better evidence than the first, because you were paying attention this time.
And be prepared for a third approach. Being defrauded twice moves you further up the list, not off it.
Educational content only. This is not investment or legal advice.
Source: FCA — Almost 5,000 fake FCA scams reported in first 6 months of 2025