An unexpected offer to recover money you lost to a scam needs independent verification. Do not pay a release fee, provide login codes, or reveal wallet secrets because someone says they located your funds. Save the claim, check the person's identity and authority through separate channels, and contact your payment provider if you have already paid them.
Pause before the next fee or verification step
A message about recovered funds can feel like the first useful response after a loss. It may mention the original platform, the amount you paid, or a complaint you filed. Those details make the message relevant; they do not prove who sent it or whether any money has been recovered.
- Do not pay a tax, bond, clearance charge, or release fee to an unverified contact.
- Do not provide passwords, authentication codes, private keys, or wallet recovery phrases.
- Save the message, sender address, website, claimed organization, and payment instructions.
- Contact any named agency or professional through independently obtained details.
- If you already paid, notify the sending provider promptly and identify this as a separate payment connected to a new recovery claim.
The FTC warns about refund and recovery scams that target prior victims, impersonate trusted organizations, and demand money or sensitive information. Scammers may obtain details about earlier losses, so prior knowledge is not a reliable identity check.
Knowing the loss is not controlling the funds: an accurate amount, wallet address, or case detail does not establish that the sender can return your money.
Separate four claims that are often bundled together
“We found your money” can hide several different assertions. Someone may have identified a transaction, attributed it to a service, claimed that funds are still there, and implied they can obtain a refund. Each step needs its own evidence.
A diagram or blockchain screenshot may show a transaction path. It does not by itself establish the current owner of an account, whether assets remain available, or whether a particular person has legal authority to obtain them. Ask what the document actually demonstrates rather than accepting its title.
The FBI's warning about cryptocurrency recovery schemes distinguishes private tracing from seizure authority. Private recovery companies cannot issue seizure orders; exchanges act through their own processes or legal process. The FBI also states that law enforcement does not charge victims a fee to investigate crimes.
| Claim | What it would need to establish | What is not enough |
|---|---|---|
| We identified your transfer | A transaction that matches your own verified records | A screenshot containing an address you posted publicly |
| We located the recipient | Evidence supporting the stated attribution, with its limitations | An unexplained label on a chart |
| Your money is frozen | Confirmation through the institution or official process said to hold it | A letter supplied only by the person demanding payment |
| We can release the funds | Verified identity, authority, and the applicable process | A countdown, guarantee, badge, or request for another fee |
Keep those distinctions in your notes. “The sender claimed the funds were frozen” is accurate when that is all you know. “The funds are frozen” is a stronger statement that should not appear without independent confirmation.
Verify the identity through a route the sender does not control
If the person claims to work for a bank, exchange, regulator, police service, or court, locate that organization's official contact details independently. Ask whether the specific person, case, or notice is genuine and how communication should proceed. Do not call the number printed only on the document being checked.
If the claim involves a lawyer or another regulated professional, check the appropriate official professional register for the relevant jurisdiction. Compare the registered contact details with those used in the approach. A real professional's name can be copied; a listing does not authenticate every email carrying that name.
Save the result of the check, including the date and the official route used. If the organization cannot confirm the contact, do not treat the uncertainty as a reason to pay a small amount “just in case.” The burden of explaining the claimed authority remains with the person making the claim.
Reviews, search prominence, an advertisement, and a polished website can be starting points for research, but they are not substitutes for identity and scope checks. Read the exact domain and business details. Do not send another copy of your original evidence merely to persuade an unverified service to explain itself.
Check the promised work before comparing the price
A clearly defined consultation or document-preparation service is a different proposition from a demand to pay before supposedly seized money is released. Evaluate what will actually be delivered, who is responsible, and which decisions remain with a bank, exchange, investigator, or court.
For any professional service you seek independently, request a written scope that identifies the provider, deliverables, total costs, exclusions, cancellation terms, and limits of authority. A tracing report, for example, should not be described as a guaranteed recovery unless the provider can substantiate that claim. Do not rely on an assurance made only in a sales call.
Be especially cautious if the service refuses to explain its method at a meaningful level, claims secret access, or requires a new payment each time a supposed obstacle appears. You do not need technical expertise to ask what the fee buys and what evidence supports the promised outcome.
Legal action and asset-recovery options depend on jurisdiction and the facts. Obtain qualified independent legal advice where appropriate. This is general information, not a legal assessment of a provider or a promise that a particular process will return funds.
Recognize when the request becomes account access
A transaction ID is a reference to an event. A password, one-time code, private key, or recovery phrase can allow control of an account or wallet. Keep that boundary clear even if the sender calls the request a verification step.
Do not connect a wallet to a recovery website or approve an unfamiliar transaction to “prove ownership” for an unsolicited contact. If a genuine institution needs to verify your identity, reach its process through its official service and understand what information it is requesting.
If remote access is requested, do not give a stranger control of the device used for banking or email. If a session has already started, end it and use a separate trusted device to contact affected providers. The remote-access scam response explains the additional containment work.
If you already exposed wallet secrets or login credentials, securing those assets is urgent even if no additional payment has appeared. Record the exposure without copying the secrets into the evidence file. An account-access problem should not be left unresolved while you debate whether the recovery promise was genuine.
If you already paid the recovery service
Stop further payments and identify each completed transfer from genuine provider records. Preserve the agreement, invoice, messages, receipt, and any promised deliverable. Record whether the promised work was never supplied, differed from the agreed scope, or was followed by an unsupported claim about released funds.
Contact the bank, card issuer, exchange, or payment service through its verified route. Explain the facts and ask what fraud or dispute process applies. A complaint about a service and a transfer you did not authorize can be different matters. Describe accurately who initiated the payment.
The bank-report evidence checklist can help organize that contact. Do not merge the original scam payment and the later recovery fee into one transaction. They may involve different recipients, providers, dates, and evidence.
If the contact now offers to refund the fee after another payment, preserve the new demand and verify it independently. Do not send more money to complete the supposed reversal. Treat a promised refund as pending until your actual provider confirms money received and its status.
Link the second approach to the first incident
Create a short record for the original loss and a separate chronology for the recovery contact. Connect them with facts: the platform name used, the amount mentioned, the date of first contact, and any evidence you had previously shared publicly or privately.
Record how the new sender reached you. Was it a direct message after a public comment, an advertisement, an email, or a referral? If someone recommended the service, record what they said without assuming they knew it was fraudulent. Keep their role distinct from the role of the person requesting money.
Save the full sender identifiers, not only the display name. Preserve the purported recovery report, payment destination, invoice, agreement, and any claimed official case number. Label documents according to what they are: a document received from an unverified sender, not an official seizure notice unless verified.
For a blocked investment account, the investment withdrawal-fee guidance helps separate real deposits from the balance the original platform claimed. That distinction still matters when a new company offers to recover the supposed balance.
Keep attribution honest: the same loss details appearing in two conversations may be relevant evidence. They do not, by themselves, prove the same person operated both schemes.
Report the approach without publicizing your private file
Use the reporting routes identified by the relevant authorities. The FTC accepts reports of refund and recovery scams, and the FBI's warning above asks for details about cryptocurrency recovery approaches. Use your country's official fraud or police service where those U.S. routes are not applicable.
If an organization was impersonated, report the impersonation through its verified contact route too. Keep the reference from each recipient. Do not assume that a platform report automatically creates a police complaint or a bank dispute.
A public warning can expose other people's information or attract more unsolicited offers. Avoid posting unredacted bank statements, identity documents, private chats, or complete case files. Provide sensitive evidence to the appropriate verified recipient through a suitable channel.
You can organize the original fraud and recovery-fee approach in a Scam Incident Record. Keep their payments and claims separate, review the details, and use the record to prepare your own reporting and follow-up. Hacked.com does not automatically submit reports, seize assets, or guarantee returned funds.
Let verified authority replace the promise
A recovery offer is convincing when it seems to resolve the uncertainty left by the first scam. The safer measure is whether the identity, claimed evidence, and authority can be checked independently. Those checks remain necessary even when the person sounds knowledgeable or sympathetic.
A genuine next step can be limited: documenting a transfer, correcting a report, securing an account, or obtaining a qualified opinion. It does not need to arrive with a promise that the whole loss is about to disappear.
The record becomes stronger when every claim is kept at the level the evidence supports. That gives the next decision a foundation outside the person asking for payment.