Crypto Recovery Services: Legit or a Second Scam?

Crypto recovery services that contact you after a loss and ask for a fee first are, by the FBI's and FTC's own descriptions, a second scam aimed at people who were already robbed. The FBI's Internet Crime Complaint Center logged 10,516 recovery-scam complaints and $1.4 billion in reported losses for 2025. IC3 never charges to recover funds, never refers victims to paid recovery companies, and never reaches out to you on social media or by phone. Anyone who does is not the government.

That is a hard message to hear when you have just lost savings, and the people running these schemes count on it being hard. This guide explains where they find victims, the script they follow, the fee names they use, what genuine law enforcement does and does not do, and which official channels actually exist. It does not promise that your money can come back, because nobody honest can promise that.

What the 2025 IC3 Report Counts

The FBI's 2025 Internet Crime Report, published by IC3, is the best public count of how large this problem is in the United States. The figures below were read directly from the report PDF on October 22, 2026, and are given with the report's own category names and page numbers.

Category in the 2025 IC3 report	Complaints	Reported losses	Where in the report
All complaints, every crime type	1,008,597	$20.877 billion	Page 4
Complaints involving cryptocurrency	181,565	$11.366 billion	Page 52
Cryptocurrency investment (fraud)	61,559	$7.228 billion	Page 53 (page 12 rounds it to $7.2 billion)
Recovery scams	10,516	$1.4 billion	Page 53
Recovery scams, victims aged 60 and over	2,529	$540,505,980	Page 53

Two cautions sit underneath that table. First, these are complaints people chose to file, so the true totals are higher. Many victims never report, and some report only to their bank or local police. Second, the report flags its own recovery-scam loss figure with a footnote: losses may also include money lost in the earlier scam that prompted contact with the recovery company. In other words, the $1.4 billion is not purely money taken by recovery scammers; some of it is the original theft, reported together. The number still shows the scale of the pattern, and the report adds that complaints reporting impersonation of government officials and recovery firms increased.

The cryptocurrency investment figure matters here because it is the pool recovery scammers fish in. IC3 describes crypto investment fraud as the highest source of financial losses to Americans in 2025, and its narrative on page 12 notes that victims of those schemes "are also targeted in recovery scams." The same report describes how the original platforms often charge victims "taxes and fees" when they try to withdraw, before disappearing. A recovery pitch is frequently the next chapter of that same story. The earlier chapters, from the first "wrong number" text to the withdrawal-tax demand, are laid out in our pig butchering scam stage map.

Why the Second Scam Finds You So Fast

Many people are shocked that a recovery offer arrives within days of the loss, sometimes from someone who knows the exact amount and dates of their transfers. There is no mystery in that, and understanding it removes much of the offer's persuasive power.

Victim lists are traded. The FTC's refund and recovery scams page explains that scammers buy and trade lists of people who have already paid scammers. Those lists can include names, contact details, the type of scam and the amount lost. A caller who recites your losses accurately is showing you that they have access to the criminals' records, which is the opposite of reassuring.

The original gang may be the caller. The CFTC's July 30, 2024 customer advisory on follow-on frauds says victims of trading fraud are often targeted again, sometimes by the same criminal groups. It calls the recovery pitch the second act of a three-act fraud, with the third act being an offer of "part-time work" that turns the victim into a money mule.

You announced the loss. People post about losses on forums, in comment sections and in support groups. IC3's April 18, 2025 alert describes scammers creating fake personas who join victim groups, pose as fellow victims, and then recommend a "contact" who can help. The July 20, 2026 update describes impersonators who approach victims on Facebook Messenger right after the victim says they plan to report to the FBI.

You searched for help. The same 2026 alert warns that "sponsored" search results for IC3 are usually imitators and tells people to type www.ic3.gov directly into the browser. A recovery firm's ad that appears above the real agency is not an endorsement by anyone.

Recognizing these four routes lets you treat an unexpected offer for what it is: evidence that your details are circulating, and a reason to tighten your accounts, not a lifeline.

The Recovery Script, Stage by Stage

Recovery scams vary in costume. Some pose as law firms, some as blockchain forensics companies, some as the FBI or a foreign regulator, some as hackers who can "reverse" a transaction. Underneath the costume, the sequence is consistent. The stage map below is built from the patterns described in IC3's 2025 and 2026 alerts, the FTC's recovery-scam guidance and the CFTC's follow-on fraud advisory.

Stage	What you see	What is actually happening
1. Contact	A message, call, comment reply or ad offering to get your money back. Often unsolicited.	Your details came from a victim list, a public post, or the original scammers.
2. Credibility	Official-looking letterhead, a case number, a badge photo, a video call with an "agent," claims of partnership with government bodies.	IC3's 2025 law-firm alert notes there are no law firms officially authorized as partners of US government agencies. Deepfake video is now part of the toolkit.
3. Good news	They say your funds have been "located," "frozen" or are "held in a foreign bank." You may be shown a portal with your balance.	The balance is a screen they control. IC3 describes victims being told to register on a fraudulent bank platform.
4. The fee	A retainer, a processing fee, a tax, a verification charge, a "release" fee or network gas, usually in crypto or gift cards.	This is the theft. The FTC says anyone who asks for an upfront fee to recover money is a scammer.
5. Escalation	A second fee appears: compliance, anti-money-laundering clearance, insurance, a court cost.	Each payment proves you will pay again. The fees continue until you stop.
6. Data harvest	Requests for ID, bank logins, card numbers, seed phrases or remote access to "trace" or "deposit" funds.	Your identity and remaining accounts are now targets.
7. Disappearance or recruitment	Contact stops, or you are offered work moving money for others.	The CFTC warns that money-mule "jobs" are laundering and can lead to criminal charges.

Seeing the stages in a row makes one point clear: the recovery offer has no step at which your money returns. Every step either builds trust or extracts payment.

What Real Law Enforcement Never Asks

The most useful single thing to know is what the government does not do. These rules come from IC3's April 2025 and July 2026 impersonation alerts, IC3's August 2025 alert on fictitious law firms, the FTC recovery-scam page and the CFTC advisory. If a contact breaks any of them, stop.

If someone claiming to be official...	The official rule	Source
Messages you about your IC3 complaint on Facebook, Telegram, WhatsApp or another app	IC3 does not maintain a social media presence and does not investigate or recover funds through those platforms.	IC3 PSA I-072026-PSA, July 20, 2026
Calls or emails you directly as "IC3"	IC3 never communicates directly with individuals by phone, email, social media, apps, online chat or forums. If more information is needed, FBI field office staff or other law enforcement make contact.	IC3 PSA I-072026-PSA
Asks for a fee to release recovered funds	IC3 never asks for payment to recover lost funds.	IC3 PSA I-041825-PSA and I-072026-PSA
Refers you to a recovery company	IC3 never refers anyone to a company that requests payment for fund recovery.	IC3 PSA I-072026-PSA
Says their law firm is an authorized partner of a US agency	There are no law firms that are officially authorized partners of US government agencies, and the US government does not request payment for law enforcement services.	IC3 PSA I-081325-PSA, August 13, 2025
Asks for your bank or card numbers so they can "deposit your refund"	Government agencies and legitimate organizations do not charge to help with refunds, do not ask for financial account numbers, and do not guarantee you will get money back.	FTC, Refund and Recovery Scams
Emails, calls or texts demanding money on behalf of the government	The government will never email, call or text you demanding money.	CFTC Release 8936-24, July 30, 2024

Note the nuance in the second row. Real investigators may contact you, but that contact comes from an FBI field office or another law enforcement agency, and you can verify it by calling that office on a number you find yourself. IC3 itself, the complaint portal, does not cold-contact victims. The IC3 2025 alert on fake law firms adds a simple test: verify anyone who claims to work for the government by calling the local office of that agency.

Tracing Is Not Recovery

Many recovery pitches lean on a true fact and stretch it. Blockchains are public, so a transfer can be followed from address to address. If you want to understand why, our guide to how a blockchain records transactions shows how every transfer becomes part of a shared, permanent record. A "forensics" firm will often send you a colorful graph of your coins moving through wallets as proof of skill.

The graph proves almost nothing about getting money back. Following funds on a public ledger is something anyone can do with a free block explorer. The hard parts are elsewhere:

Someone has to hold the funds at a point where an order can reach them. Coins sitting in a private wallet controlled by the scammer cannot be pulled back by any outside party, because there is no administrator who can reverse a confirmed transfer. A private recovery firm has no more power over that wallet than you do.

Freezing usually requires a regulated intermediary to act. When stolen funds land at an exchange or a stablecoin issuer, that business may freeze them, generally in response to law enforcement or legal process. A private company that is neither law enforcement nor a court cannot compel it.

Returning funds requires a legal process. In the US, money that the government seizes and forfeits can be returned to victims through a remission process. The Justice Department's forfeiture site states plainly, "You do not need an attorney to file a petition." Legitimate notices of that process are published officially; they do not arrive as a WhatsApp message with a fee attached.

The FTC's crypto scam guidance puts the core limitation in one line: you can usually only get crypto back if the person you paid sends it back. The CFTC advisory describes recovering stolen funds as rare, and harder once money has been converted to crypto. Any pitch that skips these realities and promises a result is telling you about its intentions, not its abilities.

The Fee Names That Give It Away

Recovery scammers rarely say "pay us and we will keep it." They give each charge a respectable label. The FTC lists several of these by name, and IC3's fake law firm alert adds others. The table maps the labels to what the request really is.

Label you are given	How it is framed	What it really is
Retainer fee	"Standard for any legal engagement."	An upfront fee for a service that will not happen. The FTC names it.
Processing or administrative fee	"To file your claim with the agency."	The FTC says government agencies do not charge money to help with refunds, and IC3 never asks for payment.
Tax on recovered funds	"The IRS requires tax before release."	A fabricated charge. The FTC lists "tax" among scam fee labels, and IC3 notes the original fake platforms use the same trick.
Identity or ownership verification fee	"The bank must confirm the funds are yours."	IC3's 2025 alert describes demands for bank fees to "verify identity and ownership."
Release or withdrawal fee	"Your balance is ready; pay to release it."	The balance does not exist outside the scammer's portal.
Network or gas fee	"To move the coins back to your wallet."	On public blockchains the network fee is paid by whoever sends the transaction. Someone genuinely returning your coins would pay it from their own side; nobody needs you to prepay gas.
Payment to a third-party company	"Pay our partner, a trading or compliance firm."	IC3 lists requests to pay a third party, such as an "xyz trading company," as a tactic.

The payment method is a second signal. The FTC says recovery scammers insist on payment by cash, gift card, cryptocurrency, wire transfer or payment app, and IC3 lists requests for crypto or prepaid gift cards as a red flag. Each of those methods is hard to reverse, which is why it is requested.

There is also a legal anchor for US telemarketing. The FTC's Telemarketing Sales Rule, at 16 CFR 310.4(a)(3), makes it an abusive practice in telemarketing to request or receive a fee for services represented to recover money a person lost in a previous transaction until seven business days after the money is delivered to that person. The rule exempts services provided by a licensed attorney, which is one reason recovery scammers so often pose as law firms. A genuine attorney still has to be a real, licensed attorney, and you can check that with the state bar where they claim to practice.

Testing an Offer: A Decision Checklist

If you are weighing a recovery offer right now, go through these questions in order. Any "yes" in the first group ends the conversation; there is no need to reach the end.

Stop immediately if any of these are true:

1.They contacted you first, and you never gave them your details.

2.They ask for any payment before money is in your own bank account.

3.They want payment in crypto, gift cards, a wire or a payment app.

4.They ask for your seed phrase, private key, wallet password or remote access to your device.

5.They claim to work for, or with, IC3, the FBI, the SEC, the CFTC or another agency, and the contact came through social media or a messaging app.

6.They say you are on a government list of victims eligible for a payout through a private firm.

7.They pressure you to keep the arrangement secret from family or your bank.

If none of the above apply, verify before going further:

1.Look up the agency or firm yourself. The FTC says to find a government agency's phone number independently and call it, not the number you were given.

2.Search the firm's name with words like "complaint," "scam" or "review," as the FTC suggests, and check with your state attorney general.

3.If they claim to be a lawyer, confirm their licence with the relevant state bar and call the firm on the number the bar lists.

4.Ask what legal process they intend to use, against whom, and in which court. Real legal work has docket numbers you can look up.

5.Ask for video verification and documents, as IC3's 2025 alert suggests, and keep records of every interaction.

What a legitimate path looks like: it starts with a free report to official channels, involves no upfront fee from you, does not require your keys or passwords, and does not promise an outcome. If an offer does not fit that description, treat it as part of the scam.

The checklist is not a way to find a "good" recovery firm. Its purpose is to stop the second loss. If you want a broader screen for any crypto pitch, our crypto scam red-flag checklist covers investment, giveaway, romance and impersonation patterns before money leaves your account.

The Channels That Actually Exist

Official reporting will not guarantee a recovery, and you should expect that. What it does is put your loss on record, give investigators connected evidence across many victims, and in some cases lead to frozen or forfeited funds. None of the official channels below charges you to report.

FBI IC3, at www.ic3.gov. The FTC's crypto scam page lists ic3.gov/Home/FileComplaint as a reporting destination. IC3's 2026 alert says to report only at www.ic3.gov and to include the scammer's identifying details, how they contacted you, transaction details and a description of what happened. Report recovery scammers there too, not just the original fraud.

Your local FBI field office. IC3's 2025 law-firm alert tells people to report suspected fraud to their local field office as well as IC3.

FTC, at ReportFraud.ftc.gov. The FTC lists this as the place to report crypto fraud and recovery scams.

CFTC and SEC. The FTC lists CFTC.gov/complaint and sec.gov/tcr for crypto fraud tied to trading or investment schemes.

Your state attorney general. The FTC recommends checking with and reporting to your state attorney general.

The exchange or app you sent from. The FTC lists the exchange you used to send the money as a place to report.

The social media platform. IC3's 2026 alert asks people to report accounts impersonating IC3 to the platform's safety or support contacts.

DOJ Elder Justice Hotline, 1-833-FRAUD-11 (833-372-8311). IC3 points victims aged 60 and over to this line for help filing.

Your bank, quickly, if fiat left your account. IC3's Recovery Asset Team works with financial institutions to try to freeze fraudulent transfers, and the 2025 report stresses that "time is of the essence" when a fraudulent bank transfer is discovered. Its freezing work is mostly about bank transfers rather than crypto that has already left your wallet, but if you paid a scammer by wire or ACH, call your bank first.

For a country-by-country version with an evidence pack you can assemble tonight, see our step-by-step guide on where to report a crypto scam and what to send. It covers the US, Canada and the UK and explains what each agency can and cannot do with your report.

If You Already Paid a Recovery Scammer

Paying a recovery scammer does not make you foolish. The FTC calls these scams "the worst of the worst" because they are aimed at people who are vulnerable precisely because they are trying to undo harm. What matters now is limiting further damage.

1.Stop all contact and all payments. Do not pay a final fee to "release" anything. There is no final fee; there is only the next one.

2.Report the recovery scam separately. File a new IC3 complaint and an FTC report for the recovery scam, even if you reported the original fraud. Include names, phone numbers, profile links, websites, wallet addresses and payment receipts.

3.Call your bank or card issuer if you paid with fiat. Ask about recalling the transfer or disputing the charge. Speed matters more here than anywhere else.

4.Secure anything you shared. If you gave out a seed phrase, assume the wallet is compromised and move remaining funds to a new wallet created from a fresh seed. Our seed phrase backup and recovery checklist walks through generating and storing a new one properly. If you approved anything on a site they sent you, check your token approvals and revoke unknown spenders.

5.If you gave remote access, treat the device as compromised. Change passwords from a different, clean device, enable app-based or hardware-key two-factor authentication, and consider a full device reset.

6.If you shared identity documents or your Social Security number, consider a credit freeze with the credit bureaus and watch for new-account fraud.

7.Keep the records. IC3's 2025 alert advises keeping records of all interactions, including recordings of video chats. Those records help investigators connect your case to others.

Edge Cases and Common Mistakes

"They said they are from the exchange where my funds went." Exchanges do have compliance teams that sometimes freeze stolen funds, and a real exchange may contact its own customers. It will not contact a non-customer asking for a fee to return funds. If you want to know whether funds were frozen, ask through the exchange's official support channel, found by typing its address yourself, or through the law enforcement agency handling your report.

"An investigator from the FBI really did call me." That can happen. IC3 says follow-up comes from FBI field office staff or other law enforcement. Hang up, find the field office number yourself on fbi.gov, and call back to confirm. A real agent will not ask you for money, gift cards, crypto or your seed phrase.

"The firm only charges after success." A contingency fee alone does not make an offer genuine; scammers advertise that too and then invent an upfront "tax" or "verification" charge before the supposed payout. The question to ask is whether any money leaves your hands before money arrives in your own bank account.

"They showed me my coins sitting in a wallet and offered to hack it." Hacking a wallet is a crime, and a person offering to commit one for you is not someone who will hand over the proceeds. The "hacker for hire" pitch is a common recovery-scam costume.

Mistake: paying to file a complaint. IC3 never asks for payment, and the FTC says government agencies do not charge to help with refunds. A website charging to "submit your case to the FBI" is not the FBI. IC3's 2026 alert describes a spoofed IC3 site that collects only name, phone, email, scam type and estimated loss, then promises that someone will be in touch. That follow-up call is the scam.

Mistake: forgetting the tax side. Losses from theft and fraud raise separate federal tax questions, and the rules are narrow. Don't let a "tax on your recovery" demand from a stranger stand in for real tax treatment; read our overview of how the IRS treats digital assets and speak with a qualified tax professional about your own facts.

Mistake: keeping it secret. Shame keeps people in these schemes longer. The fake law firm alert lists secrecy, including moving victims into private group chats "for safety," as a tactic. Telling a trusted person is one of the most effective protections available.

Helping Someone Who Is Being Targeted

IC3's numbers show people aged 60 and over reported the largest recovery-scam losses of any age group in 2025, $540,505,980 across 2,529 complaints. If you are worried about a parent or friend, the approach matters as much as the facts.

Lead with the rule, not the judgment. "The FBI says it never charges to recover money" is easier to accept than "you are being scammed."

Offer to make the verification call together. Look up the agency number on its official website, side by side, and call it.

Watch for the money-mule turn. The CFTC's advisory describes victims being asked to open bank accounts or receive funds for others. If your relative mentions a new "job" moving money, that is a serious legal risk, not a recovery.

Use the hotline. The DOJ Elder Justice Hotline at 833-372-8311 can help older victims file reports.

Lock down the basics. Help them set up stronger two-factor authentication, remove remote-access software, and review where their crypto is held. Our explainer on what a crypto wallet actually holds is a calm starting point for that conversation.

For more on scams that target crypto holders, including how fraud patterns connect, browse the scams and fraud research hub. And if your money left through a centralized platform that later stopped processing withdrawals, the warning signs in our exchange reserve risk checklist explain how to judge a platform before you deposit again.

The most practical step now is to get your loss on record before anyone else contacts you: our guide on reporting a crypto scam to the right agencies lists the exact transaction hashes, addresses and screenshots to gather, so a single report gives investigators what they need.

Frequently Asked Questions

Are crypto recovery services legit?

A company that contacts you unprompted, promises to recover crypto, and asks for any fee before your money is back in your own bank account matches every pattern the FBI and FTC describe as a recovery scam. IC3 never refers victims to paid recovery companies, and the FTC says anyone who asks for an upfront fee to recover money is a scammer. Free reporting to IC3, the FTC and your state attorney general is the legitimate starting point.

Can I get my scammed crypto back?

Sometimes, but rarely, and never by paying a stranger. Crypto payments are typically not reversible, and the FTC notes you can usually only get crypto back if the person you paid returns it. Funds can occasionally be frozen when they reach a regulated exchange or issuer and law enforcement acts, and forfeited funds can be returned through an official remission process that does not require an attorney.

Will IC3 or the FBI contact me about my complaint?

IC3 itself never contacts individuals directly by phone, email, social media, apps or chat. If more information is needed, FBI employees from a local field office or other law enforcement officers make contact. You can confirm any such contact by calling the field office on a number you look up yourself, and no genuine agent will ask you for payment.

Is it legal for a recovery company to charge me upfront?

In US telemarketing, the FTC's Telemarketing Sales Rule (16 CFR 310.4(a)(3)) bars requesting or receiving a fee for recovering money lost in a previous transaction until seven business days after the money is delivered to you, with an exemption for licensed attorneys. Scammers ignore the law and often pose as lawyers for that reason, so check any claimed attorney with the state bar.

A law firm says I'm on a government list of scam victims. Is that real?

IC3's August 2025 alert describes this exact pitch as a tactic used by fictitious law firms. It states that no law firms are officially authorized partners of US government agencies, and that the US government does not request payment for law enforcement services. Unexpected contact from a law firm, especially when you never reported the crime, is a red flag.

The platform says I must pay tax before I can withdraw. Should I pay?

No. IC3's 2025 report describes fake investment platforms charging "taxes and fees" when victims try to withdraw, as a final attempt to take more money before disappearing. Real taxes are paid to the tax authority, not to a trading platform or a third party as a condition of releasing your balance.

Can blockchain tracing tell me who took my crypto?

Tracing can show where coins moved, because public blockchains record every transfer. It usually cannot identify a person on its own, and it cannot move funds back. That requires a regulated business holding the funds, plus action by law enforcement or a court, so a tracing report sold to you by a private firm is not a path to recovery.

Sources

FBI IC3: 2025 Internet Crime Report (PDF) - totals on page 4 (1,008,597 complaints, $20.877 billion), cryptocurrency complaints on page 52 (181,565, $11.366 billion), cryptocurrency investment on pages 12 and 53 (61,559 complaints, $7.228 billion; "$7.2 billion" on page 12), recovery scams on page 53 (10,516 complaints, $1.4 billion, footnote on prior-scam losses, 60+ age row), Recovery Asset Team on page 17. Checked October 22, 2026.

FBI IC3: FBI Warns of Scammers Impersonating the IC3, I-072026-PSA (July 20, 2026) - no social media presence, no direct contact, no fees, no paid-recovery referrals, spoofed IC3 site and deepfake tactics, reporting tips. Checked October 22, 2026.

FBI IC3: FBI Warns of Scammers Impersonating the IC3, I-041825-PSA (April 18, 2025) - fake fellow-victim personas, fake IC3 "Chief Director," DOJ Elder Justice Hotline. Checked October 22, 2026.

FBI IC3: Fictitious Law Firms Targeting Cryptocurrency Scam Victims, I-081325-PSA (August 13, 2025) - fake law firm tactics, "no law firms which are officially authorized partners," verification and record-keeping tips. Checked October 22, 2026.

FTC: Refund and Recovery Scams - traded victim lists, fee labels, payment methods, "anyone who asks for an upfront fee is a scammer," what agencies do not do, reporting. Checked October 22, 2026.

FTC: What To Know About Cryptocurrency and Scams - irreversibility of crypto payments and the five reporting destinations. Checked October 22, 2026.

CFTC Release 8936-24: CFTC Warns Customers to Watch for Follow-on Frauds (July 30, 2024) - three-act fraud pattern, recovery described as rare, money-mule warning, government never demands money by email, call or text. Checked October 22, 2026.

16 CFR 310.4 (Telemarketing Sales Rule), via Cornell LII - paragraph (a)(3) on recovery-service fees and the licensed-attorney exemption. Checked October 22, 2026.

US Department of Justice: Filing a Petition for Remission (forfeiture.gov) - "You do not need an attorney to file a petition." Checked October 22, 2026.

CryptosEyes publishes general educational information, not legal, tax or investment advice, and we do not recommend or work with any recovery company. If you have lost money, you are not alone and it is not your fault that criminals targeted you. Report through the free official channels above, talk to someone you trust, and take your time before responding to anyone who promises to get your money back.