The short answer
A message offering to recover money you already lost is not good news. It is a common follow-up move: the same kind of criminal operation, or someone who bought a victim list, contacts you again while you are still shaken.
The FTC warns that refund and recovery scammers contact previous scam victims, promise to recover money, and demand upfront fees or financial information. Source
So the working assumption is: an unsolicited recovery message is unverified until you confirm it through a channel you found yourself. That is not paranoia; it is the check the FTC itself recommends.
Stop first: what not to do in the first hour
- Do not reply to the message, even to say “stop” or to ask questions.
- Do not click links, open attachments, scan QR codes or install anything the sender provides.
- Do not send another payment, gift card code, bank transfer or crypto transfer to “unlock” or “release” your money.
- Do not share ID documents, bank logins, card numbers, one-time codes or recovery phrases.
- Do not let the sender remote-control your device or “walk you through” your bank app.
- Do not use the phone number, email address, website or account handle printed in the message to check whether the sender is real.
If you have already sent something to the recovery contact, stop the next payment and contact your bank or payment provider using the number or app you already use, not a number the sender gave you.
Check: verify the contact, not the story
The message will probably sound specific and urgent. Specificity is not proof. Anyone who knows you lost money can repeat the amount and the platform name.
The FTC recommends independently finding an organization’s contact information to verify an unsolicited recovery claim rather than using contact details supplied by the caller. Source
Use this worksheet. Write the answers down before you decide anything.
| Question | What a safe answer looks like | Red flag |
|---|---|---|
| How did this person first reach me? | You contacted them first, through a route you found independently | They messaged you out of the blue after your loss |
| How did I get their contact details? | From an official source you looked up yourself | From the message, a DM, an ad, a search-result sponsored link or a “referral” |
| What are they asking for before doing anything? | Nothing | An upfront fee, “case file” charge, tax, insurance, deposit, gift card or crypto |
| What information do they want? | Nothing sensitive at this stage | Bank details, card numbers, ID scans, passwords, one-time codes, remote access |
| What exactly do they promise? | Nothing guaranteed | A full refund, a fixed timeline, “100% recovery” or a named suspect already caught |
| Can I confirm the organization exists outside this conversation? | Yes, via an independent lookup | Only through the sender’s own website, profile or references |
| Does the organization claim to be a government body, bank, platform or payment provider? | You can reach that body through its own published channel | The message supplies the “official” contact route |
If any red-flag column entry is true, stop. Do not send money or information to resolve it.
Separate the official route from the stranger
There is a real difference between the company that handled your original payment and a person who says they can get your money back.
- Your payment provider or bank is the institution that processed the original transaction. Contact it through the app, the card’s customer service number or the official website you already know. Ask what dispute or reporting options exist for your situation. Do not assume a particular outcome or deadline; rules differ by provider and country.
- A stranger offering recovery is an unverified third party. They are not your bank, not the platform, and not a government agency just because they say so. Paying them is a new transaction with a new counterparty, not a step in getting the old one reversed.
A message that claims to be from your bank, the platform or a payment provider should still be checked through a channel you find yourself. Real institutions do not need you to use the contact details in an unexpected message.
Report: where a report can go
Reporting does not guarantee recovery. It does create a record and can help the authorities warn others.
- United States: the FTC is one reporting route for fraud, including recovery scams. Use the FTC’s own website to find its current reporting page rather than a link from the message.
- Your bank or payment provider: report the original loss and any follow-up contact through its official channel. Ask what it needs from you and keep copies of what you send.
- The platform where the original contact happened: use its in-app reporting tools for the account that contacted you.
- Local police or a national consumer-protection body: options and thresholds vary by country. Look up the correct route for where you live.
Keep the original messages, transaction references, screenshots and dates. Do not delete them, even if they are upsetting.
If the sender uses a public username
A public profile with a matching name, photo or handle is not proof that the person behind it is who they claim to be. Photos and biographies can be copied, and usernames can be reused.
If you want to see where a known public username appears, a username lookup such as TraceSeek can show public matches across 3,000+ platforms, with a free first scan that takes about 20–30 seconds and does not require registration or login. Treat the results as leads only: a match does not confirm identity, ownership or intent, and the tool does not recover money, provide recovery codes, change account settings or verify who a person really is. It is not a substitute for the independent contact check above.
When the next task is a payment pattern, not a recovery offer
If your concern has moved from a recovery message to understanding how the original payment was requested, the payment method itself can be a signal. Gift-card codes and “customs fee” demands are patterns worth recognising before the next request arrives.
See Gift-card requests and customs fees: the payment tells of dating fraud for that separate check.
A short recap
- An unsolicited recovery offer is unverified by default.
- Stop contact, payments and information sharing first.
- Verify the organization through contact details you find independently, not the ones in the message.
- Contact your bank or payment provider through its official channel about the original loss.
- Report to the FTC if you are in the United States, and to the appropriate local route elsewhere. Reporting is not a recovery guarantee.