Someone Says They Can Get Your Money Back? That's the Second Scam

There is a particular phone call we hear about after we have cleaned up someone's computer following a fake pop-up or a fake renewal invoice. It comes a few weeks later. The person on the line is calm, professional, sympathetic — and they already know what happened. They know roughly how much was lost. Sometimes they know the name of the outfit that took it. They explain that your case has been flagged, that funds have been traced and frozen, and that they can get the money returned. There is just a retainer, or a processing fee, or a filing charge to release it.

It is a scam, essentially every time, and it is aimed squarely at people who have already been hurt once. The U.S. Federal Trade Commission published a fresh warning about it in August 2026 and did not hedge: these are scams that target people who have already lost money to a scam. The reason it works is not that the victims are careless. It is that this second call arrives at the exact moment somebody is desperate for it to be true, and it comes from someone who appears to know things a stranger should not know. Here is where that knowledge actually comes from, how to end the call in one sentence, and what genuinely does recover money — all of which is free.

Why the person calling knows what happened to you

This is the part that makes the second call convincing, and it has a boring explanation. Details about scam victims get compiled and sold. The FTC calls the result a sucker list: a record of a person's name, address and phone number, along with which scam caught them and how much they paid. Criminals buy and sell these lists on the straightforward theory that someone who paid once can be made to pay again. Refund and recovery scammers buy those lists on purpose and work through them.

So the caller who "already has your file" has not investigated anything. They bought a row in a spreadsheet. Once you know that, the single most persuasive feature of the call — how much they know — flips into the clearest warning sign, because a real bank fraud department, a real police detective and a real government agency all get to your case a completely different way, and none of those ways start with an unexpected phone call, text, or direct message offering to sell you a recovery.

The same logic explains the timing. If you have reported the original scam, mentioned it in an online complaint, or posted about it in a forum or a comment section looking for help, you have made yourself easy to find. That is not a reason to stay quiet — reporting matters, and we say so below — it is a reason to expect the follow-up approach and to recognize it when it lands.

Who they claim to be, and why it is always a lie

To sound legitimate, recovery scammers borrow authority. The FTC's own list of the disguises they use is short and worth memorizing: a government agency (including, with some nerve, the FTC itself), a consumer advocacy group, or a law firm. In practice we also see "the fraud recovery department" of a bank you do not use, and asset-recovery firms with polished websites and stock-photo staff.

The FBI has documented a more elaborate version aimed at people who lost cryptocurrency, and the details are useful even if crypto was never involved in your case, because the tactics are the same everywhere. In an alert dated August 13, 2025 (I-081325-PSA), the Bureau described operators impersonating real, named lawyers and real law firms, producing convincing letterhead and documents, and claiming to be authorized partners of U.S. and foreign government agencies — a claim the FBI flatly rejects, because no law firm holds any such official partnership. Some invent a regulator outright: the alert names a fictitious "International Financial Trading Commission." Victims get added to WhatsApp groups populated by supposed attorneys and bank processors, are shown fake bank portals where their recovered funds appear to be sitting, and are asked to pay in cryptocurrency or prepaid gift cards. When asked to prove who they are, they will not appear on camera and will not produce a license.

That last detail is the practical one. A genuine professional can be verified, and does not resist being verified. Anyone who deflects a video call, an on-camera face, a bar number, or a direct call back to an office switchboard has told you what you needed to know.

The 2026 version: a deepfake official and a fake government website

The FBI updated its guidance on July 20, 2026 (alert I-072026-PSA) to describe how far the impersonation has moved. Two patterns stand out. In the first, scammers run fake FBI profiles on social media and go after prior victims directly; when someone says they intend to file a complaint with the Internet Crime Complaint Center, an "agent" appears in their messages and steers them to a fake reporting link that harvests personal and financial details. In the second, criminals post AI-generated deepfake videos of FBI leadership promoting a spoofed version of the IC3 website — a counterfeit that collects your name, phone number, email, and the amount you lost, then promises somebody will be in touch.

Two facts from that alert are worth keeping permanently. The IC3 does not initiate contact with anyone through social media, phone, email, or chat. And the IC3 does not work with law firms, crypto-recovery services, or any other non-law-enforcement business to recover funds — so anyone who claims to be working your case in partnership with the FBI is not.

The defense against a spoofed site is unglamorous and effective: type the address yourself. Go to ic3.gov and reportfraud.ftc.gov by typing them into the address bar, not by tapping a link you were sent and not through a sponsored result at the top of a search page. Check that the address really ends in .gov. If a video seems to show an official telling you to visit somewhere else, treat the video as the thing being faked.

The one rule that ends every version of this

You do not have to out-argue any of it. There is a single rule that defeats the whole category: never pay up front for a refund, or for help getting one. No government agency and no legitimate organization will ever ask you for money or for your financial information in exchange for helping you get money back. Law enforcement does not charge victims a fee to investigate a crime. The FTC states it plainly — it will never threaten you, tell you that you must transfer money in order to receive a refund, or promise you a prize.

The same rule covers the softer ask. Some recovery scammers do not want a fee at all; they want your bank details "so the refund can be deposited," or a copy of your ID "to verify you as the account holder." Handing those over does not cost you anything on the day, which is exactly why people do it, and it is how the second loss turns into identity theft on top of the first. If a payment or your financial information has to move before the recovery happens, the recovery is the bait.

The tech-support version, which is the one we see most

When the original scam was a computer scam — a fake Microsoft security pop-up with a phone number, or one of those fake Geek Squad or Norton renewal invoices — the recovery approach has an extra hook, and it is the reason we are writing this rather than leaving it to the consumer sites. The "recovery agent" will want onto your computer again. The framing is that they need to check your bank's records, verify the original transaction, or watch the refund arrive. It is the same remote-access session that did the damage the first time, dressed up as the remedy.

Be especially careful if the second contact seems to pick up where the first one left off — if they reference the case number they gave you, the technician's name, or the software you installed. That is not proof they are the good guys who took over the case. It is the likeliest sign of all that you are talking to the same crew, working the same customer a second time. There is nothing stopping the people who ran the first call from running the second one, and it is cheaper for them than finding somebody new.

So before the money question, deal with the machine. Uninstall any remote-access or "support" software you did not choose yourself — AnyDesk, TeamViewer, UltraViewer, LogMeIn and their relatives — and check whether it was configured for unattended access, meaning it can be connected to without you approving anything. Look through installed programs for anything added on the day of the original call. Change your email and banking passwords from a different device, and turn on two-factor authentication. Then, if the number they called you on is the number they have, expect it to be used again and let unknown calls go to voicemail for a while. Our guides to the fake Microsoft pop-up and the fake renewal invoice cover that cleanup in more detail.

What actually gets money back, and it is all free

Real recovery is unglamorous, it is done by you or by institutions you already have a relationship with, and nobody charges you for the attempt. Start with how the money left. If it went by card or bank transfer, call your bank or card issuer using the number on the back of your card, say clearly that it was a scam, and ask them to stop, reverse, or dispute the transaction. If you sent a wire, contact the wire transfer company as well as your bank, tell them it was a fraudulent transfer, and ask them to reverse it. If you paid with gift cards, contact the company that issued the card — Apple, Google Play, Amazon, Target — give them the numbers from the card and the receipt, and ask for your money back; if the funds have not been drained yet, some issuers will return them. The FTC's advice on this is worth repeating exactly: report it no matter how long ago it happened, and whatever the payment method, it is always worth asking the company you used whether there is a way to get it back.

Then report it, by typing the addresses yourself: reportfraud.ftc.gov for the FTC, ic3.gov for the FBI, and your state attorney general (in California, oag.ca.gov). Reports are what build cases, and a report number is often the thing your bank asks for. What none of this involves is a retainer, a processing fee, or a stranger with remote access to your computer.

It is also worth being honest about the odds, because that honesty is precisely what the recovery scammer will not give you. Money moved by card is the most recoverable. Wires, gift cards and crypto are much harder and often gone. Anyone who guarantees a full recovery, especially of funds sent by crypto or gift card, is telling you the one thing a real professional cannot promise — and the confidence is the product they are selling.

How to check out anybody who contacts you about a refund

If you are not sure, you do not have to decide on the call. Say you will call back, and hang up — a legitimate caller will have no problem with that, and a scammer will fight it, which is itself the answer. Then look the organization up independently: search the name along with words like complaint, scam, or review, and find the phone number on the agency or company's own website rather than using the number you were given or the one that appeared on your caller ID. Caller ID and email addresses are trivially spoofed, often with a character or two changed in a way you would never notice.

Two more habits worth having. Do not act on a link in the message that prompted you, even if the site it opens looks perfect — go to the organization by typing its address. And give yourself permission to be slow. Every version of this runs on urgency: the window is closing, the funds will be released today, the case will be dropped. Real refunds and real investigations do not evaporate because you took an afternoon to check.

If you are the family member watching this happen

The second wave is harder on families than the first, because the reaction to being scammed once is usually silence. People are embarrassed, they blame themselves, and they stop mentioning phone calls — which leaves them alone with exactly the caller who is counting on that isolation. If somebody in your family lost money recently, the useful thing is not a lecture about the first scam. It is a standing, unconditional offer: if anyone contacts them about getting it back, they can tell you before doing anything, and nobody will say I told you so.

It is worth saying out loud that these scripts are written by professionals to override careful people's judgment, and that being targeted twice is a sign that your details were sold, not a sign that you are gullible. In our retirement communities across the Coachella Valley and the San Gabriel Valley, the second approach is common enough that it should be treated as expected rather than as bad luck.

How we can help

We do not recover money, and we would be lying if we said we could — that is the whole point of this article. What we can do is the technical half, which is real work that genuinely needs doing after a computer scam: go through the machine properly to make sure nothing was left behind, remove remote-access tools and any unattended-access setup, check what was signed in and get those accounts locked back down, and set the computer up so the next attempt does not get anywhere.

And if you have had that second call and you are not sure — if it sounded official, if they knew details, if you are half convinced it might be genuine — that uncertainty is the entire mechanism of the scam and it is a perfectly good reason to ask somebody. Call us before any money or remote access changes hands. We work with homes and small businesses across Southern California and the Coachella Valley, we do not sell antivirus subscriptions or protection plans, and there is no charge for telling you that a call was fake.