Already Been Scammed? Here's What to Do, and the Recovery Scam Coming Next.
TL;DR
- The FBI’s 2025 IC3 report shows government impersonation complaints almost doubled year over year, from about 17,300 to 32,500, with losses jumping from roughly $405 million to $797 million.
- Recovery scams target people who already lost money once. Someone claims to be from the FBI, FTC, or a “recovery firm,” says your money has been found, and asks for a fee or your information to release it.
- The real reporting channels are free: ReportFraud.ftc.gov, IC3.gov, IdentityTheft.gov, and your bank’s fraud line. No legitimate agency will ever ask you to pay to get stolen money back.
- Today’s action: call your bank’s fraud line on the number printed on your card, change passwords on every account you used during the scam, then file an IC3 complaint with as much detail as you can pull together.
Getting scammed once is bad enough. The part most people don’t see coming is the second wave. Within days or weeks of the first hit, a “recovery agent” or “FBI investigator” calls or texts. They say they’ve already located your funds and just need a small fee, or your bank info, or a few more pieces of identity to release the money. That is almost always the same crew that scammed you the first time, or another crew that bought the list from them.
Federal agencies have flagged this pattern repeatedly in the last few weeks. If you’ve already lost money, this guide is for you.
Why scammers come back for round two
Once your number is on the list of “people who paid,” it gets sold. Scam rings keep databases of victims, the methods that worked, and how much each person handed over. Then they either re-target you themselves or sell the list to another crew. The CFTC has been warning about this on its Recovery Frauds advisory page, and the FTC has updated its refund and recovery scam guidance specifically because revictimization keeps climbing.
The IC3 numbers tell the same story. Between December 2023 and February 2025, the FBI logged more than 100 reports of scammers impersonating IC3 employees. Almost every complainant said the scammers offered to help recover their lost funds. AARP Fraud Watch is predicting recovery scams will be one of the top frauds of 2026.
Why does the second hit work? Because by the time the call comes in, you already know you’ve been had. You’re stressed. You want the money back. The person on the line knows specifics about your original scam, sometimes including the exact amount lost and the company name the original scammer used. Sometimes they spoof a real federal agency number on caller ID. Sometimes they cite a fake case number tied to your loss. It sounds plausible because they engineered it to.
What to do in the first 48 hours
Cut off contact with the scammer first. No more clicked links, no more replies, no more payments, even if the messages threaten you with arrest, account closure, or court action. Engaging keeps you on the active list.
Then call your bank using the number printed on the back of your card or on the official site, not any number a caller gave you. If money was sent by wire, ACH, Zelle, or credit card, ask about a recall and a “hold harmless” letter. Speed is everything here. Wire transfers can sometimes be clawed back inside the first 24 to 72 hours, and almost never after that, per FTC guidance on what to do if you were scammed.
Change passwords on every account you touched during the scam. If you reused that password anywhere else, change it there too. Turn on two-factor authentication using an authenticator app like Authy or Google Authenticator, not SMS. SMS codes can be intercepted by the same crews running phone scams, especially through SIM-swap attacks.
If you handed over a Social Security number, driver’s license, or other identity data, file a report at IdentityTheft.gov. You’ll get an official FTC Identity Theft Report. That document gives you legal rights under federal law, including the ability to place fraud alerts and security freezes with Equifax, Experian, and TransUnion at no cost.
File a complaint at IC3.gov even if the dollar amount feels small or you feel embarrassed. Investigators link complaints across geography to build cases. Include phone numbers, email addresses, social media handles, exact dates and times, payment method, transaction IDs, and any screenshots you have. The more detail, the more useful your report.
Report the scam at ReportFraud.ftc.gov. The FTC shares these reports with more than 2,000 law enforcement agencies and runs pattern detection across them to spot active campaigns.
If the victim is 60 or older, the DOJ runs a dedicated Elder Justice Hotline at 1-833-FRAUD-11 (833-372-8311). The staff there can walk a caller through the IC3 filing in real time. Per the FBI’s IC3 site, that hotline exists specifically because filing a complaint can feel overwhelming after a fraud.
How to spot the recovery scam coming next
The pitch comes in a few flavors. The bones are always the same. Someone calls or texts and claims to be from the FBI, the FTC, IC3, a state attorney general, an SEC investigator, an “asset recovery firm,” a crypto recovery service, or a private “fund recovery specialist.” They tell you they’ve already identified or partially recovered your funds. They just need to verify your identity, collect a processing fee, settle some “back taxes,” or wire a small “release fee” before the money can come back to you.
Real agencies do not work this way. The FBI, FTC, and IRS will never call or text demanding payment to release recovered funds. They do not accept gift cards, wire transfers, or cryptocurrency. They do not ask for your bank login or your seed phrase. Anyone who does is a scammer, full stop.
A few specific tells from the FBI Philadelphia and FBI Atlanta advisories: the “agent” gives you a real-looking badge number and a callback number that matches a real field office, then warns you to keep the conversation secret because of an “active investigation.” The secrecy line is the giveaway. Real investigators want you talking to your bank and your family.
The FBI Jacksonville office issued a fresh warning on April 20, 2026 specifically about scammers texting people across North Florida pretending to be FBI Special Agents. Their advice was three words: hang up, do not respond, report it.
According to the FBI’s 2025 Internet Crime Report released in April 2026, government impersonation complaints rose from roughly 17,300 in 2024 to 32,500 in 2025. Losses climbed from about $405 million to $797 million. That is the doubling that’s driving every fresh advisory you’re seeing right now.
How to lock down your phone going forward
The recovery crew gets to you because they have your number and a script. Cutting off the inbound channel is what stops them.
Turn on Apple’s Silence Unknown Callers under Settings, then Phone, then Silence Unknown Callers. Calls from numbers not in your contacts go to voicemail. They still appear in recents, so legitimate callers like a doctor’s office can leave a message and you can call back, but the live ring is gone.
Enable your carrier’s free spam filter. AT&T ActiveArmor, Verizon Call Filter, and T-Mobile Scam Shield each label suspected fraud calls and can block confirmed bad numbers. We covered the layered setup in detail in How to Stop Spam Calls on iPhone in 2026.
For texts, iOS has Filter Unknown Senders under Settings, then Apps, then Messages. It splits unknown senders into a separate tab. It will not block the messages, but at least they stop landing in your main thread. The reasons that’s not enough on its own are in Why Filter Unknown Senders Isn’t Enough.
Add a third-party SMS filter that blocks by message content, not just by phone number. Recovery scammers rotate through new numbers every few days, but the wording stays consistent. Words like “recovery,” “released funds,” “case number,” “settlement,” “compensation,” and “asset forfeiture” repeat across nearly every variant. That’s the gap Not Today fills: keyword filtering, a community database of 85,000+ reported numbers that updates as new spam comes in, and optional AI detection for new wordings the keyword list hasn’t caught yet. Keyword setup is walked through in How to Block Spam Texts by Keyword on iPhone.
One more thing worth doing today. Call your bank and ask them to flag your accounts. Many banks will add a manual review on outbound transfers above a threshold you set. It’s friction. It’s also the kind of friction that catches a recovery-scam wire before the money leaves the building.
If you’re helping a parent or grandparent who got scammed
If your mom or dad just got hit, lead with what to do now. Don’t lead with how it happened. The shame spiral is what the second-round crew counts on. People who feel embarrassed isolate, stop talking to family, and answer the phone when the “FBI” calls.
Sit with them and file the IC3 report together. Call the bank fraud line on speaker. Turn on Silence Unknown Callers, the carrier filter, and a content-based text filter on their phone in the same sitting. Add yourself as a contact they can vet incoming calls through, so a “case number” call gets a sanity check before any money moves.
The AARP Fraud Watch Helpline at 877-908-3360 takes calls from family members too. The volunteers won’t recover money, but they’ll talk through what’s normal, what’s a follow-on scam, and what to expect from the IC3 process. The DOJ Elder Justice Hotline at 833-FRAUD-11 is the other one to keep in your phone.
A note on “fund recovery” companies and crypto
If you lost money in a crypto scam or a pig-butchering scheme, the inbox flood is going to be intense. “Recovery firms” advertise heavily on Telegram, Reddit, X, and even paid Google search. Some of them buy ads against the names of the original scams to catch victims looking for help.
Almost none of them recover anything. The CFTC and AARP have both said in plain language that real recovery is rare, and the firms that promise otherwise are either part of the original scam or a parallel rip-off. Legitimate help comes from law enforcement, court-appointed receivers in actual asset-forfeiture cases (the DOJ posts those publicly), and your own bank or card issuer’s chargeback process. Anyone outside that list charging an upfront fee should be assumed to be a scam.
If a “recovery service” finds you first instead of the other way around, that’s the loudest possible red flag.
Not Today is a free spam-blocking app for iPhone. We built it to catch spam before it reaches you, using keyword rules, a community database of 85,000+ reported numbers, and optional AI detection. No account required. Download on the App Store.