Crypto recovery scams exposed by Ilia Nikolaevich Zavialov: who calls after the money is gone and why

The second fraud

English version for the United Kingdom.

There is a category of fraud that only targets people who have already been defrauded, and it is large enough to have its own line in the national statistics. The FBI centre recorded 10,516 complaints and 1.4 billion dollars of losses on recovery schemes in 2025. The centre adds an important caveat to that figure: the totals may also include the loss from the first fraud, the one that prompted the contact with the recovery company in the first place. The consumer protection agency described these operations in August 2026 as the worst of the worst, aimed at people who have already lost money, and said the lists of those people are bought. This piece takes the second fraud apart: where the list comes from, who the caller claims to be, what is genuinely possible and what costs nothing.

Reference / Blog

Published: 22 September 2026 · 10 min read · Ilia Nikolaevich Zavialov

01A fraud that needs a previous fraud

Every other scheme has to find its targets. This one inherits them. The qualifying event is that somebody already sent money to a stranger, which means they are reachable, emotionally invested and motivated to act quickly.

The losses concentrate in the older age groups, the same groups the original schemes concentrate in. People aged 60 and over filed 2,529 complaints with 540,505,980 dollars of losses on recovery schemes in 2025.

The next two groups are large as well. The 50 to 59 group filed 1,706 complaints with 298,233,813 dollars, and the 40 to 49 group 1,977 complaints with 194,670,794 dollars. This is not a fraud confined to the very old.

For context, crypto linked losses across all categories reached 11,366,669,732 dollars in 2025 across 181,565 complaints. The pool of people who qualify as targets for a recovery approach grows every year.

Reporting rates are the weak point in all of these numbers. Somebody who lost money twice has a strong reason to say nothing the second time, because the first loss can be described as bad luck and the second one feels like a verdict on their judgement. The real figure is therefore higher than the recorded one, and the gap is widest exactly where the shame is strongest.

02Where they got your number

The lists are bought, which the consumer protection agency states directly. They circulate as a commodity, and the same name appears on several of them.

The source is often the original operation. A scheme that collected a name, a phone number, a loss amount and a payment method is holding a dataset worth more after the fraud than during it, because it identifies people who demonstrably pay.

Other sources are ordinary. Breached records, public complaint databases, court filings in bankruptcies and class actions, and forums where people describe what happened to them in detail while asking for help.

The practical consequence is uncomfortable but useful. An unsolicited approach that already knows the platform name, the approximate amount and the date is not demonstrating investigative skill. It is reading a row from a file.

03Who the caller claims to be

The centre reports a rise in complaints where the contact impersonated government officials or recovery firms, including invented law firms and, in some cases, the reporting centre itself. The impersonation is the entire product.

A government official is the most effective costume, because it explains both the knowledge of your case and the urgency. Real agencies do not telephone people to offer paid recovery of stolen funds.

The invented law firm version is more elaborate. A website, a registration number, a photograph of an office, named partners and a retainer agreement. All of it is producible in an afternoon, and all of it is checkable against the bar register of the jurisdiction claimed.

The blockchain investigator version is the newest. It comes with a technical report full of real terminology, wallet addresses and diagrams, because the output of a genuine tracing tool is not hard to generate and impossible to distinguish from a real one without checking who produced it.

The hardest version to doubt impersonates the platform you lost the money on. It writes to say a compensation fund has been set up for affected users, and it knows your account details, your balance and your dates because the operation that took the money is the operation writing to you. Nothing it says about your case is wrong, which is exactly the problem.

04The promise and the arithmetic behind it

The offer is always framed as near certain. Funds have been located, a freeze is pending, a court order is being prepared, and only a procedural payment stands between you and the money.

Tracing where funds went is genuinely possible and often straightforward. A public blockchain records every movement. That is the part the pitch is built on, and it is true.

What does not follow from it is recovery. Knowing the address holding funds does not give anybody the power to take them back. That power belongs to a court, a regulated exchange acting under law, or law enforcement, and none of those three sells their services by unsolicited message.

So the arithmetic is simple. Any private operation that promises a result rather than a service is promising something it cannot deliver, regardless of how accurate the first half of its report is.

05How the payment is structured

The first payment is usually modest and framed procedurally. A case opening fee, a filing charge, a translation cost, a retainer. It is deliberately affordable, because the purpose is to establish a payment relationship.

After it, the structure matches the original fraud exactly. A tax on the recovered amount, an escrow deposit, a bond, a clearance fee, each presented as the last one.

The payment method is the clearest signal available. The consumer protection agency names a demand for cryptocurrency, gift cards, cash, wire transfer or a payment app as a direct indicator of the scheme. Legitimate professionals invoice and accept ordinary payment.

There is also a version that asks for no money at all at first. It asks for remote access to your device, to verify the wallet, and what it verifies is what else you still hold.

06What can honestly be done

Reporting to an exchange while funds are still in an identified account can result in a freeze. This is the mechanism that actually recovers money, and it belongs to the exchange and the legal process rather than to any consultant.

Criminal complaints matter cumulatively even when they feel useless individually. Cases against large operations are assembled from many small reports, and distributions in successful prosecutions go to people who filed.

A genuine investigator sells hours and produces a report. They do not promise an outcome, they do not contact you first, and they will explain that a trace is evidence rather than a remedy.

In the cases where money does come back, it comes back slowly, through a court or an exchange, and nobody had to be paid up front for it to happen.

It helps to be clear about the odds rather than hopeful about them. Most funds moved through a chain of addresses within minutes are not recovered, and a person who understands that from the first day is much harder to sell a guarantee to. The unrealistic expectation is the raw material the second fraud works with.

07What costs nothing

Reporting to the police and to the national cybercrime reporting centre is free. So is reporting to every exchange that appears anywhere in the transaction chain, and those reports are the ones that can produce a freeze.

Blockchain explorers are free and public. Anybody can follow the movement of funds from their own transaction, and doing so removes the mystique that the paid pitch depends on.

Consumer protection regulators publish warnings, complaint mechanisms and the names of operations already flagged, at no charge. A search combining the name of the firm that contacted you with the word complaint is often conclusive within a minute.

None of the free routes promises a result. That is the honest difference between them and the paid pitch, and it is the reason the paid pitch sounds better.

08The ten minute check before replying

Ask how they obtained your details, and expect the answer to be vague. A real referral has a name attached to it and a person who can confirm it.

Take the company name, the registration number and the address, and check each one independently. The register of companies, the bar register if they claim to be lawyers, and a map for the address. A rented mailbox presented as an office answers the question.

Search the exact wording of their message. Scripts are reused across many targets, and a phrase from a script frequently appears in warnings published by somebody who received the same message earlier.

Then apply the rule that removes the need for the other checks. Anybody who contacted you first, guaranteed a result and asked for payment in advance is running the second fraud, and nothing they say afterwards changes that.

09Questions and answers

How did they know I was defrauded?

They bought a list. The consumer protection agency states in its August 2026 warning that these operations purchase lists of people who already lost money, and the original scheme is frequently the seller.

Can stolen crypto actually be traced?

Yes, and that is why the pitch is persuasive. Movement on a public blockchain is visible to anybody. Tracing is not the same as recovery, and only a court, a regulated exchange or law enforcement can act on a trace.

They sent a detailed technical report. Does that prove anything?

It proves they can run a tool. Wallet addresses, diagrams and terminology are cheap to produce and are the standard opening of the approach. What matters is who they are and how they got your details.

Is it ever worth paying a recovery fee?

A fee paid in advance to somebody who contacted you first is the scheme. A genuine professional you approached yourself may bill for hours of work, and will be explicit that the result is not guaranteed.

What is the single clearest warning sign?

The payment method. The consumer protection agency names demands for cryptocurrency, gift cards, cash, wire transfer or a payment app as a direct indicator, because those routes are chosen for being irreversible.

Do the official figures already include this second loss?

Partly, and the centre says so. It notes that totals on recovery schemes may also include losses from the earlier fraud that led the person to contact the recovery company, which is why the 1.4 billion dollar figure should be read as a combined number.

Reference updated: 4 September 2026