When the “Recovery Expert” DMs You After a Scam: The Second-Stage Playbook

After an online scam, the next stranger may not threaten you. They may sound like the first person who finally understands, know the right details, and promise to get your money back. That is the setup behind recovery and refund scams—an exploitation of the moment when a victim is searching for help.

Bottom line: An unsolicited “recovery agent,” investigator, lawyer, or government helper who guarantees results, asks for an upfront fee, or wants your bank details is not a safe next step. Stop the private conversation and contact your bank, platform, or government agency through a channel you find independently.

The warning has become unusually visible in scam communities. Reddit’s r/Scams automatically cautions new posters that they may receive private messages from people claiming to know a professional hacker or recovery lawyer. That community warning is not a measurement of how often it happens, but it reflects a predictable vulnerability: once someone has shared that they were defrauded, strangers can approach with exactly the answer they are hoping to hear.

The official warnings are more consequential than the forum anecdotes. In August 2026, the U.S. Federal Trade Commission said refund and recovery scammers target people who have already lost money, sometimes by buying lists of prior victims. In July 2026, the FBI’s Internet Crime Complaint Center updated its alert about people impersonating IC3 and FBI staff to “help” recover losses. The agency says these schemes can use fake profiles, spoofed websites, and fabricated proof to make the offer feel official. This article looks at the human sequence behind that second approach—and how to regain control without needing to decide whether the person is convincing.

Why a second approach can feel more credible than the first

After a loss, people often move quickly between fear, embarrassment, anger and a practical need to limit damage. They may search for answers late at night, post details in a forum, contact an exchange, or tell friends. Each step can leave a trail: the type of scam, platform, approximate amount, username, public transaction ID, email address, or simply the fact that money was lost.

A recovery scammer turns that trail into “proof” of special access. A message that names the right platform or repeats a detail from a public post can seem like evidence that the sender has investigated the case. It may be nothing more than information the victim posted or shared elsewhere. The sender then borrows authority—“I work with the agency handling your case,” “our tracing team found your wallet,” “I’m a lawyer connected to the exchange”—and adds a next step that must be done privately and quickly.

Four common disguises for “help”

Who they claim to be	How the approach may sound	What to do instead
Platform or exchange support	“We found the compromised transaction; sign in through this recovery portal.”	Open the platform’s app or type its known address yourself. Use support links from its official help center.
Law enforcement or a government agency	“Your complaint is eligible for reimbursement, but we need a processing payment or updated form.”	Find the agency contact information independently. A social-media DM is not proof that an agency has a case or can recover funds.
Private investigator, lawyer, or “blockchain analyst”	“We can trace the money and guarantee a return if you pay a retainer today.”	Do not pay an unsolicited advance fee. If you choose to seek professional advice, select the provider independently and verify credentials.
Another victim or a person with an inside contact	“I got my money back with this specialist. Message them privately.”	Treat referrals in public comments and private messages as unverified. Ask your bank, platform, regulator, or local consumer authority what legitimate options exist.

The social-engineering sequence: from disclosure to dependency

1. Learn that help is wanted

The scammer may find someone through a public post, a comment, a compromised contact list, an advertisement, or a purchased data set. The first message may reference only details visible in the post. A private message can also arrive from an account pretending to be a moderator or support worker. None of these routes proves the sender has access to the original case.

2. Establish a special relationship

They may sound patient and unusually attentive, or claim to be an “assigned case officer.” They invite the person to move to a private messaging app, where there is less public context and fewer people who can challenge the story. The move itself matters: it reduces the victim’s chance to pause and check with a trusted person.

3. Borrow institutional trust

Scammers copy logos, employee names, case numbers, agency terminology, and official-looking forms. The FBI’s July 2026 alert describes impersonators posing as IC3 or FBI personnel, including fake profiles and spoofed websites. A caller ID, profile badge, screenshot, or video is not reliable proof of identity. Verification means independently contacting the organization using a known official site or number—not asking the claimant to prove themselves with another link they supplied.

4. Turn hope into a transaction

Common requests include “tax,” “release,” “processing,” or “tracing” fees; payment to a new wallet; a bank transfer to “secure” funds; remote access to a computer; recovery phrases; or a one-time code. Some ask a victim to receive or forward money, which can create additional financial and legal risk. A refund does not require you to give a stranger your password, seed phrase, full card credentials, or remote access to your device.

What to do if a recovery helper contacts you

Pause the conversation. Do not reply just to test them, click a link, scan a QR code, download a tool, or switch to an encrypted chat on their request.
Do not share more case details. Avoid sending statements, identity documents, wallet recovery words, account emails, verification codes, or screenshots that show other personal information.
Save evidence safely. Keep the sender’s username, profile URL, message, phone number, email headers, payment request, and any transaction details. Do not forward harmful links to friends or publish your sensitive records.
Verify through a route you choose. Open the official app or type the official address yourself. Contact the bank or platform using the number on your card, statement, or verified help center. If they claim to represent law enforcement, use the agency’s independently located public contact page.
Tell one trusted person. A friend can read the offer without the emotional pressure of the loss. Ask them to help verify who contacted you, not to make a rushed decision or send money on your behalf.
Block and report the account. Use the platform’s own reporting tools. If you already lost money, report the original fraud and the recovery attempt separately to relevant official channels.

A short boundary script: “I will not pay or share information through a private message. If your organization is involved, I will contact it using the details on its official website. Do not contact me again.” You do not owe the sender a debate or a chance to respond.

If you already paid or shared information

Paid by card, bank transfer, payment app, or wire: call the financial institution immediately using a trusted number. Ask whether the payment can be stopped, recalled, disputed, or monitored. Explain that the recipient claimed to recover a previous scam loss. Speed matters, but an attempted reversal is not a guarantee that funds can be recovered.

Paid in cryptocurrency: contact the exchange or wallet provider used to send the transaction and ask what account-security or fraud-reporting steps are available. Preserve transaction IDs and destination addresses, but do not expect a blockchain transaction to be reversible. Do not pay a second “tracer” who says they can retrieve it.

Shared a password, one-time code, or recovery phrase: use the official account recovery page from a device you trust. Change the affected password and any reused passwords, revoke active sessions and connected apps where possible, and enable strong multi-factor authentication or a passkey. A crypto seed phrase exposes the wallet: do not type it into any site or share it with “support.”

Installed remote-access software: disconnect the device from the internet if you suspect the stranger is still connected, then use a separate trusted device to contact the affected bank and change important credentials. Ask a reputable local technician or your organization’s IT team to check the device. Do not let the caller who installed the tool become the person who “cleans” it.

Shared identity documents or account numbers: contact the relevant bank, issuer, or government identity-theft resource to ask which safeguards apply where you live. Monitor account activity and keep a written log of who you contacted and when. The right actions depend on what was shared, so avoid paying for a blanket “identity restoration package” from an unsolicited helper.

Reporting without exposing yourself further

Use the official reporting channel for the platform where the account contacted you. In the United States, the FTC directs people to ReportFraud.ftc.gov for scams and to state attorneys general for additional consumer complaints. The FBI’s IC3 accepts internet-crime complaints at ic3.gov; type that address yourself and check that you are on the official domain before entering information. Reporting helps agencies identify patterns, but it does not promise an investigation or repayment.

When writing a report, include dates, amounts, payment methods, account names, domains, phone numbers, and message copies where safe. Do not include passwords, full card numbers, seed phrases, or one-time codes. A government form that appears after a private message is not automatically official. Start from the agency’s home page and navigate to the complaint page yourself.

If you posted publicly, consider editing out details that could help a new contact impersonate the original platform: email addresses, transaction screenshots with QR codes, phone numbers, account IDs, and exact amounts. You can still ask for advice in public communities while protecting identifying information. Be wary of users who insist that the only useful answer is a private message.

Why shame is part of the attacker’s toolkit

Embarrassment can make a person keep the loss private, which gives a second approach more time and less scrutiny. Naming the pattern plainly helps: the attacker is exploiting a normal wish to recover, not proving that the victim should have known better. Tell someone you trust before making another payment or account change.

Our related guide on the utility-bill doorstep pitch explains another version of the same principle: when someone presents a high-pressure problem, you can stop and verify the channel before giving them access or information.

The bottom line

A recovery offer may arrive when a person is most eager for a clear answer. That timing is the point. FTC and FBI warnings describe a pattern of scammers targeting people already harmed, borrowing institutional authority and requesting money or sensitive information. A public Reddit warning about private “helpers” is an anecdotal signal, not proof that every new message is fraudulent—but an unsolicited guarantee, advance fee, secret channel, or credential request is enough reason not to proceed.

Keep the next step boring: save the evidence, stop the private exchange, and contact the relevant bank, platform, or agency using an address you find independently. Report what happened. Share only what is necessary. You can seek support without letting a stranger take control of the recovery process.

Sources

Found a factual error or a source that has changed?

Send a correction →