Ilia Nikolaevich Zavialov answers why a paid promise to recover lost money is a second scheme

The approach arrives after the loss, sometimes within days and sometimes many months later. It comes as a telephone call, a private message on the platform where the loss was discussed, or an email carrying a reference number and a portal link. The person on the other end already knows roughly what happened, which is what makes the first minute feel safe. They describe a process: a traced wallet, a seized account, a compensation fund with a name on the list. Then they name a payment that has to be made before the money can be released.

The wording changes with the story behind the first loss. Some callers present themselves as investigators attached to a bank, others as a firm that specialises in tracing transfers across a blockchain, others as staff of a regulator distributing a pool of recovered funds. A few send documents with letterheads, reference numbers and a login page showing a balance waiting to be claimed. That balance is an image on a screen controlled by the people who built the page.

Underneath the variations sits one shared mechanic. Money has to leave the victim again before anything comes back. The payment is described as a fee, a tax, a bond, a retainer, a conversion charge or a verification deposit, and the label is chosen to fit whichever authority the caller claims. The direction of travel stays the same in every version.

The first approach had to invent a reason for contact and build trust from nothing. The second starts from an event both sides already know about, which removes the hardest part of the work. The victim has a loss they want undone, a story they have repeated several times and a state of mind that makes any offer of help land well. Someone who names the amount, the date and the platform sounds like a person holding an official file.

A first loss usually makes people less willing to talk about money with friends or family. That silence works in favour of the second caller, because the natural safeguard, saying the whole story out loud to somebody uninvolved, is exactly what the victim wants to avoid. The recovery offer also promises an escape from ever having to admit the loss, since the money will be back before anyone else needs to know.

There is arithmetic in the pitch that feels convincing under pressure. A payment that is small beside the sum already lost reads as a reasonable price for a chance at the rest. The framing survives several rounds, because each new charge stays small beside a total that keeps growing. By the time the two sums are compared honestly, the second loss can exceed the first.

Contact details of people who have paid once carry value, and they circulate. Some lists come from the original operation, which knows exactly who paid, how much and through which channel. Others are assembled from public complaints, forum threads, review sites and comments left under articles about the platform that failed. Anyone who described a loss in public has published most of the file the second caller needs.

In many cases the recovery approach comes from the same team that ran the first scheme, working under a new name with a different voice. That explains detail an outsider could not hold: exact deposit dates, the wallet address, the name used at registration, the hour of the last conversation. Detail of that kind persuades faster than any document, and it costs the caller nothing, because the information was theirs from the start.

The source of the knowledge is itself a test worth applying. Bodies that collect fraud reports do not hand contact details to private firms who then telephone with a commercial offer. When a caller recites the contents of a report filed with a police force or a regulator, the likely route for that knowledge runs through the criminal side of the transaction.

A plain request for money in exchange for recovering stolen money invites suspicion, so the charge is rebuilt as a procedure. It becomes a tax a treasury requires before release, a bond a court demands from a foreign claimant, an insurance premium on the transfer or a network charge for moving funds off a blocked wallet. Every version carries a short explanation for why the amount cannot simply be deducted from the recovered sum.

That last point is the weakest joint in the whole story, and it holds up under a single question. Anyone who genuinely controls recovered money can take their costs out of it before sending the remainder. An arrangement that insists the payment must arrive from outside, in advance, is describing a situation in which there is nothing to deduct from.

The first payment is rarely the last. Once it clears, a new obstacle appears: an unexpected liability, a second signature, a compliance hold, a correspondent bank in another country with its own charge. Each step is presented as the final one, and each is priced just low enough to make walking away feel wasteful. The design keeps the target paying for as long as the story holds.

Whatever story surrounds it, the payment route always narrows to a short list. The FBI Internet Crime Complaint Center reported that roughly half of all losses reported in the United States during 2025 involved cryptocurrency. These routes share one property that matters more than any other: once a transfer settles, no counterparty exists who can reverse it. A method chosen for that property says a great deal about what the recipient expects to happen next.

The Federal Trade Commission examined older adults who lost ten thousand dollars or more to someone impersonating a company or a government office. Thirty three per cent of them had paid in cryptocurrency, twenty per cent by bank transfer and sixteen per cent in cash. All three channels put the money beyond recall within hours, and cash adds a physical handover that leaves the thinnest record of all.

The request for a specific channel is a signal on its own. Banks, card schemes and insurers move refunds through their own systems and never ask a customer to buy digital assets in order to receive one. When a recovery conversation drifts towards an exchange, a machine in a shop or a person collecting an envelope, the process has stopped resembling anything official.

The scale of the first problem explains the supply of the second. The Federal Trade Commission logged three million reports during 2025 with 15.9 billion dollars of stated losses, against 2.6 million reports and more than 12 billion the year before. The Internet Crime Complaint Center recorded 1,008,597 complaints and almost 21 billion dollars of losses across the same period, twenty six per cent above the previous year. Both figures count people who filed a report, which is a fraction of everyone affected.

Impersonation is the largest single strand inside those totals. More than a million reports and 3.5 billion dollars of losses came from someone pretending to be a person or an organisation, close to one report in every three. A recovery offer belongs in that category with a friendlier face, because the identity being borrowed is a helper.

Every report in those totals represents a person who lost money and wants it back. That population is the market the second scheme sells into, and it expands every year the first schemes succeed. Growth in reported losses is also growth in the number of people who will answer a call about getting their money returned.

These conversations happen by voice because a voice does work that text cannot. It carries authority, urgency and reassurance in the same sentence, and it pushes for a decision while the listener is still forming an opinion. Synthetic speech has made that instrument cheap. A convincing clone can be produced from a recording of about three seconds and reaches roughly eighty five per cent accuracy.

The obvious defence, recognising that the voice sounds wrong, performs poorly. In one experiment listeners separated a genuine voice from a synthetic copy in 37.5 per cent of attempts, which is worse than a coin toss. Familiarity offers no protection, because a familiar voice is the easiest one to source from a recording that already exists in public.

The practical consequence is simple. A voice claiming to belong to a bank investigator, a lawyer or a relative vouching for a recovery firm carries no evidential weight at all. Verification has to run through a channel the listener chose independently, dialled from a number found on a card or inside a banking application.

Real recovery runs backwards along the path the money took. A claim starts with the bank, the card issuer or the platform that carried the payment, and it is worked between institutions using records that already exist. UK Finance recorded 248,070 cases of authorised payment fraud during 2025, with 576.4 million pounds taken, and cases of that kind are raised with the sending bank by the customer. The initiative belongs to the person who lost the money in every instance.

Reporting to a police force or a national fraud body costs nothing and asks for no deposit. Legal representation is a separate matter with its own costs, arranged by the client with a firm the client selected and checked. Money that comes back arrives in the account it left from. No legitimate process requires a new wallet, a fresh account opened for the purpose or a payment sent to an individual.

Timing matters more than anything a recovery firm can offer. A payment reported to the bank quickly still has a chance of being stopped or traced while it sits in the receiving account. Hours spent negotiating with someone who promises a full return are hours in which the real chance of recovery declines. That trade is the quiet cost of the second scheme, on top of the money it takes.

No decision has to be made during the call. Ending the conversation and calling back through a number obtained independently breaks every version of this approach, because the scripted party controls only the line it opened. A genuine institution accepts a call back without argument. Pressure applied against that step is the clearest signal available.

The deduction question settles most cases in one sentence. Asking for the charge to be taken out of the recovered money forces the other side either to agree, which costs them their income, or to produce a reason why the money they claim to hold cannot be touched. The reasons offered are always procedural and always unverifiable.

Writing the sequence down and reading it aloud to someone uninvolved restores the check the loss removed. A story that survives repetition to a stranger is worth continuing. A story that starts to sound thin when spoken has been carried by tone and urgency alone. The person listening needs no expertise, only distance.

Speed is the only lever left once a payment has been sent. The bank that sent it should hear about it the same day, with the amount, the time, the destination and the account details used. Card payments and transfers inside a banking system have recall procedures that depend on how recently they were made. Cryptocurrency transfers are harder, and the exchange that received them can still be told.

A report to the national fraud body serves a purpose beyond the individual case. The totals published by the Federal Trade Commission and the Internet Crime Complaint Center exist because people filed, and patterns become visible only when enough reports carry the same wallet address or the same script. A report also creates a record with a date, which matters for any later claim.

A third approach should be expected. People who paid twice appear on the most valuable lists, and the next caller may present themselves as an investigator looking into the recovery firm that took the second payment. Keeping every message, number and receipt in one place is worth the effort, and treating any inbound contact about the case as unverified is the safest default.

Can anyone really get my money back after a scam?

Recovery happens through the bank, the card issuer or the platform that moved the payment, and the claim is started by the person who lost the money. A private firm that telephones with an offer and asks for payment first has no part in that process.

Is it normal to pay a fee before money is recovered?

Anyone who genuinely holds recovered funds can take their costs from the sum before sending the rest. A demand for money in advance describes a situation where no recovered funds exist. The request itself answers the question.

How did they know I lost money and how much?

Lists of people who paid once circulate, and many recovery calls come from the same team that ran the first scheme. Public complaints, forum posts and reviews supply the remaining detail. Precise knowledge of the loss points back towards its source.

Why do recovery firms ask for payment in cryptocurrency?

Around half of all losses reported in the United States during 2025 involved cryptocurrency, because those transfers settle without a counterparty who can reverse them. A method chosen for irreversibility answers the question of what happens after payment.

I already paid a recovery fee, what should I do now?

Tell the bank that sent the payment the same day, with the amount, the time and the destination details, since recall depends on how recently the money moved. File a report with the national fraud body and keep every message. Expect a further approach about the same case.

How do I check whether a recovery service is genuine?

End the call and dial back through a number taken from a bank card or a banking application, since a scripted caller controls only the line they opened. Ask for the charge to be deducted from the recovered money and weigh the reason given for refusing.