Your weekly dose of scam-proofing in 3 minutes or less. No fluff, just the latest hacks, scams, phishing attacks, and cyber cons you actually need to know about.

You already got scammed once. They're counting on that.

You get a message out of nowhere. WhatsApp, Telegram, Instagram DM. Friendly. Professional. No pressure.

You lost money to a crypto scam. Maybe a fake investment platform. Maybe a task scam. Maybe a romance that turned out to be a fraudster in a compound in Cambodia.

You're devastated. You've told almost nobody. You're quietly searching online at midnight for any possible way to get it back.

And then you find them.

A law firm specialising in crypto fraud recovery. A blockchain analytics company with a professional website, real-sounding testimonials, and a logo you half-recognise. A government-affiliated recovery unit that says it has traced your funds and can return them, for an upfront fee to cover legal costs.

You pay the fee.

Nothing happens. You chase them. There are delays. More fees. More reasons. Then silence.

You have just been scammed twice. By the same industry. For the same money.

The FBI logged over 10,500 complaints about recovery scams in 2025, with an estimated $1.4 billion in losses - on top of whatever was stolen in the original scam. And that is only the people who reported it. Most victims are too ashamed to tell anyone they fell for it a second time.

1️⃣ They find you.

Recovery scammers do not wait for victims to come to them. They go looking.

They monitor crypto fraud forums, Reddit threads, and social media posts where victims discuss their losses. They scrape contact details from scam reporting databases. Some buy victim lists from other criminal networks, the same networks that ran the original scam.

The FBI has issued three successive public warnings specifically about fake crypto recovery services - in August 2023, June 2024, and August 2025. The fact that they keep updating the warning reflects a growing problem, not a stabilising one.

2️⃣ They look completely legitimate.

This is where crypto recovery scams are genuinely impressive in the worst possible way. These are not amateur operations.

Scammers copy the logos, domains, and documentation of real, well-known blockchain analytics firms. They register domains that differ from the real company by a single character, one letter, one punctuation mark - knowing that a desperate victim searching at midnight will not spot the difference.

Professional website. Fake case studies. Fabricated reviews. Staff profiles with LinkedIn pages. Some even impersonate actual lawyers, actual government agencies, and actual FBI employees.

3️⃣ They confirm your hope.

The hook is not "we might be able to help." The hook is "we have already found your funds."

They tell you your crypto has been traced to a specific wallet. Recovery is possible. The funds are essentially sitting there waiting. All that is needed is a processing fee, a legal retainer, or a tax payment to release them.

Some recovery firms advertise 94-98% success rates. These figures are entirely self-reported. In reality, only around 7% of stolen crypto funds are ever returned across all cases globally. The gap between what they promise and what is real is the entire business model.

4️⃣ The fees keep coming.

The first fee is small enough to feel reasonable given what you lost. Then there is a second fee. A tax liability. A compliance charge. A cross-border transfer cost. Each one presented as the final step before your money is returned.

Adults aged 60 and over accounted for $540.5 million in recovery scam losses in 2025 alone - specifically because they tend to have more savings, are more likely to have been targeted in the original scam, and are less likely to have someone in their life they can quickly consult before making a payment.

Every other scam in this newsletter targets people who are feeling normal. This one targets people who are already in pain.

You have lost money. You feel foolish. You are desperate. Your judgment is compromised by grief and by hope in equal measure. The idea that someone has found your funds and can return them is not just appealing, it is almost impossible to dismiss rationally when you want it to be true badly enough.

The scammer knows all of this. They are not selling a service. They are selling relief. And they are specifically selecting victims who are already emotionally vulnerable, financially damaged, and likely to pay almost anything to make the situation right.

73% of original scam victims reported feelings of humiliation that stopped them seeking help. Recovery scammers exploit that shame directly. Their pitch works because victims often haven't told their family or friends what happened, which means there is nobody to ask, nobody to pump the brakes, and nobody to say "this doesn't sound right."

Scale: Recovery scams generated $1.4 billion in losses in the US in 2025, separate from the $11.3 billion lost to the original crypto scams that created the victims in the first place. These are not opportunistic sideline operations. They are a structured second wave, deliberately built on top of the first.

🚩 Any service that contacts you first, claiming to have already traced your stolen funds. 

🚩 Upfront fees required before any recovery takes place - for legal costs, taxes, processing, or compliance. 

🚩 Websites, emails, or documents that look like a real company but have a slightly different domain or name. 

🚩 Guaranteed or near-guaranteed recovery rates - real recovery is difficult, uncertain, and rare. 

🚩 Anyone claiming to be from the FBI, IC3, or a government agency offering to recover funds for a fee. 

🚩 Pressure to act quickly before the "trace" expires or the funds are moved.

✔ Understand that legitimate recovery is rare and never requires upfront fees

Only around 7% of stolen crypto is ever recovered globally. Anyone guaranteeing otherwise is lying. Any service asking for an upfront fee before delivering results is almost certainly a scam. Legitimate legal professionals work on outcome-based arrangements or clearly documented retainers - they do not take your money and promise results they cannot verify.

✔ Report to the actual authorities - not companies you found on Google

If you have lost money to crypto fraud, report it to your national fraud reporting service and your country's financial regulator. In the US, that is the FBI's IC3 at ic3.gov. In the UK, Action Fraud. In Australia, ReportCyber. These are free. They do not charge fees. Any organisation asking you to pay to report a crime is not a legitimate authority.

✔ Search the company name independently before you engage

Do not click links in emails or messages. Independently search the recovery company's name along with the words "scam" or "review." Check whether the domain you are on matches exactly the domain of the real company. One character off is not a typo - it is the scam.

✔ Tell someone before you pay anything

The recovery scam works because victims are isolated by shame. Before transferring any money to a recovery service, tell a trusted person what you are doing and ask them to review it with you. A second pair of eyes on a desperate decision costs nothing and could save everything.

✔ If you have already paid a recovery scammer, contact your bank immediately

Some payments can be reversed. The sooner you act, the better the chance. Contact your bank, report it to the relevant fraud authority, and do not pay any further fees regardless of what the scammer promises will happen next.

If someone promises to recover your lost crypto for an upfront fee, you are not being helped. You are being scammed again.

That's it for this week.

Crypto recovery scams are the most cynical fraud on this list. Every other scam in this series creates a new victim. This one finds someone who is already broken and takes what is left.

The best defence is knowing it exists before it finds you. If you or someone you know has lost money to any kind of online fraud, the word to remember is this: anyone who contacts you first and asks for money to get your money back is lying.

Real recovery is rare. Free. And it starts with a report to the actual authorities, not a company with a professional website that appeared in your search results at the exact moment you needed it most.

Catch you next time,

Dan & the Goldphish Team