Lesson 8 — The recovery-scam wave: the second tax

**The trigger.** The recovery-scam ecosystem activates when a victim becomes publicly identifiable as a victim. The triggers include: posting in a crypto subreddit about a loss, filing a public IC3 complaint where some fields are searchable, complaining on Twitter, leaving a review on a scam database, or being mentioned in a news article. Even the simple act of joining a victim-support Discord can be enough — the recovery-scam operations have plants in those communities specifically to identify fresh leads.

**The script.** A 'recovery specialist' contacts you within hours to days. They have several rotating cover identities: a private investigator who specialises in crypto recovery, a 'cyber-recovery firm' with a real-looking website, a 'reformed black-hat' who claims to know the attackers, a former FBI agent now in private practice, or — in the most sophisticated variants — a fake employee of a real exchange or analytics firm whose name is borrowed from LinkedIn. They will reference specific details of your case to demonstrate they know what happened (they read your IC3 filing, your Reddit post, or your tweet). They will offer to recover the funds for an upfront retainer — typical figures are $500 to $5,000, paid in crypto or wire — sometimes with a 'success fee' contingency that is theatrical because the recovery never materialises.

**The closure.** After you pay the retainer, one of three things happens. (a) They go silent within days, having pocketed the retainer. (b) They invent reasons to need more money: 'court fees,' 'investigator's bond,' 'cross-jurisdictional fees,' 'unlocking the recovered wallet.' This is structurally identical to stage 6 of pig-butchering — every additional fee is sold as the last one before recovery. (c) In the most painful variant, they 'recover' a small amount (using funds they bought separately) and use this as proof to extract further fees for 'releasing the rest.' Each variant ends with the recovery scammer disappearing with whatever was paid.

**Why this works on victims.** Primary scam victims are operating under a specific cocktail of emotions — shame, urgency, financial pressure, the cognitive dissonance of having already lost money to one scammer. They are inclined to trust the next contact who offers a path forward, particularly one that comes wrapped in plausible authority signalling. The recovery-scam ecosystem has been documented running operations specifically to mine this state. The Global Anti-Scam Organisation's case files include hundreds of victims who lost more to recovery scams than to the original primary scam.

**The absolute rule.** No legitimate recovery service operates by upfront payment from the victim. Not 'no reputable service,' not 'no service in your jurisdiction' — none. Real recovery, when it exists for individual victims, operates one of three ways: (1) Exchange-compliance freezes triggered by a fast first-day report (no payment to the victim); (2) Civil class actions where victims join as plaintiffs after a case is filed (payment to attorneys is by contingency, after recovery); (3) Federal seizure-and-restitution actions where victims are notified after a prosecution succeeds (no payment to the victim). All three are documented, all three sometimes work, and none involve a 'specialist' contacting the victim to offer recovery for an upfront fee.

**The legitimate alternatives.** If significant value was lost and the case has factors that justify professional help — high dollar value, cross-border complexity, ongoing physical safety threat — there are paths that exist but look completely different from the recovery scam. Cryptocurrency-experienced attorneys (find them through your jurisdiction's bar association, not via DMs) can pursue civil actions, particularly against exchanges that received the laundered funds. Chainalysis and TRM Labs work with law enforcement, not directly with individual victims; the path to using their services is via a police report that gets referred to them, not via you hiring them. The investigative work is months-long, paid by retainer (where it exists), and produces no immediate recovery — it builds the case that may eventually produce recovery years later.

**The communication script for support people.** If you are supporting a victim, the conversation around recovery scams is harder than the conversation around the primary scam. The victim is already destabilised, and 'no one can recover your funds quickly' lands as cruelty. The honest framing: 'recovery is possible in some cases — exchange freezes, civil action, federal seizures — but none of those operate via the contacts arriving in your inbox right now. Those are second-stage scammers. Block them, document them, and let the legitimate channels — IC3, your bank, the exchange compliance team — work the case on the timeline they actually work on.'

**Course closing.** The single most defensive habit you will leave this course with is the moment-zero recognition that follows from everything we've covered. When the next pig-butchering contact arrives, you will recognise family two and stage one. When the next drainer signature appears, you will recognise what the Permit fields mean. When the next 'support DM' arrives, you will recognise that legitimate support never DMs first. And when the next recovery-scam contact arrives after some other compromise, you will recognise the upfront-payment pattern as the second tax that you do not have to pay. None of this is a guarantee — sophisticated attackers eventually defeat sophisticated defenders. But the cost-effectiveness curve in scam defence is brutally steep, and the basics — pattern recognition plus procedural discipline plus delay — defeat approximately ninety percent of attempts. That ninety percent is the part this course was designed to deliver.