Scammers posing as law enforcement, banks or cybersecurity firmsmedium
The second scam: whoever promises to recover the money you already lost
In the FBI Internet Crime Complaint Center's 2025 annual report, "recovery scams" get a section of their own: 10,516 complaints and USD 1.4 billion in losses, with over half the damage concentrated among people aged fifty and above. It is the scam that comes after the scam: somebody contacts a person who already lost money and promises to recover it, asking for a fee up front. On 20 July 2026 the FBI published an alert about scammers impersonating IC3 itself, including AI-generated videos imitating a senior agency leader. The FBI's own footnote warns that the USD 1.4 billion may include losses from the original scam: the number must be read with its caveat.
Why they come back to the people who already lost
There is an unpleasant but perfectly rational logic behind this scam, and it is worth stating up front because it is the key to everything else.
Someone who has already been defrauded online is, from the organisers' point of view, the best contact that exists. They have proved they respond. They have proved they are willing to transfer money to a stranger. And they now carry a motive they did not have before: they want their money back, and with it the feeling of not having been foolish.
The FBI has an official definition for this, in the public alert of 20 July 2026: re-targeting scams, often called "recovery" or "double-dip" scams, are manipulative schemes where scammers target individuals who have already been defrauded — posing as law enforcement, banks or cybersecurity firms, promising to recover the victim's lost money or track down the original thieves, only to steal more funds.
The numbers, with their caveat
In the 2025 annual report of the Internet Crime Complaint Center — the FBI office that collects cybercrime complaints — recovery scams have a section of their own, with 10,516 complaints and around USD 1.4 billion in losses.
A clarification belongs here immediately, because the FBI itself makes it in the table's footnote: the losses shown may also include losses experienced from previous scams which prompted the contact with the recovery company. Put differently: USD 1.4 billion is not the amount taken by the second scam. Anyone quoting it without the caveat is inflating the figure, and doing so against the source's explicit instruction.
The age distribution says more than the total. The bands from fifty upwards concentrate most of the damage: 2,529 complaints and roughly USD 540 million for the over-60s, 1,706 complaints and roughly USD 298 million for the 50-59 band. Under thirty the complaints exist but the losses collapse.
General context helps with scale: in 2025 IC3 recorded 1,008,597 complaints and USD 20.877 billion in total losses, with an average loss of USD 20,699. Among the over-60s there were 201,266 complaints for USD 7.748 billion, an average loss of USD 38,500, and 12,444 people who each lost more than one hundred thousand dollars.
The 20 July alert: they impersonate the FBI
The most recent part of the story is also the most brazen. On 20 July 2026 IC3 published an alert about scammers posing as IC3 itself, running two distinct schemes.
In the first, fake FBI agents contact people on Facebook Messenger or Telegram and send a link to "update" a complaint filed with IC3.
In the second — and this is where it becomes instructive — AI-generated videos are circulating that imitate a senior agency leader and invite viewers to file a complaint on a cloned IC3 site. The fake site has a single-step form asking for name, phone, email, scam type and estimated loss: which is to say, exactly the profile of a victim willing to talk, handed over voluntarily.
- 01First scamthe person loses money
- 02Contactsomebody presents as police, a bank or a security firm
- 03Promisewe will recover your money, we will track down those responsible
- 04Requesta fee, a commission, a tax is needed up front
The rules the FBI puts in writing
The alert contains several categorical statements, and their usefulness lies precisely in being categorical: they remove the margin of doubt at the moment doubt is the vulnerability.
IC3 will never communicate directly with individuals via phone, email, social media, phone apps, online chat or public forums. If further information is needed, FBI employees from local field offices or other law enforcement officers make contact.
IC3 will never ask for payment to recover lost funds, nor will it refer someone to a company requesting payment for doing so.
IC3 does not maintain a social media presence. Any profile or page claiming to represent it, or offering to recover lost money, is fraudulent.
On reaching the site, the guidance is operational: type the address directly into the address bar rather than going through a search engine; and if using a search engine, avoid any "sponsored" results, which are usually paid imitators looking to divert traffic.
The last recommendation is the most transferable, and reaches beyond scams: be wary of online content that elicits strong emotion — anger, fear, disbelief. Take a moment to verify that what you are seeing or hearing is true before responding.
What applies outside the United States, and what does not
It should be said plainly: these numbers are American. IC3 collects self-reported, unverified complaints, overwhelmingly from US residents. There is no equivalent Italian dataset on recovery scams, and transplanting the percentages would be wrong.
What does transfer is not the figures: it is the mechanism. The psychological structure of the recovery scam has nothing culturally specific about it. It rests on three universal levers — the shame of having lost, the hope of putting it right, and the simulated authority of whoever claims they can help — and works identically in any language.
The channel transfers too: lists of previous scam victims circulate and get resold. Scammers do not need to guess who to contact.
What to say to someone you care about
This is the paragraph worth reading with a specific person in mind, because this is the kind of scam prevented by talking about it beforehand, not afterwards.
No authority asks you for money in order to give you money back. It is the single most useful rule: if recovering a sum requires paying another one first, it is a scam. Always, with no exceptions worth entertaining.
You choose the channel, not whoever contacts you. If somebody presents as your bank or the police, you hang up and call back on the number you already had — on the card, on the official site typed by hand, in your contacts.
Haste is the symptom. Real procedures do not expire in twenty minutes. Urgency exists to prevent verification, and serves no other function.
A video is not proof. The voice and face of a public figure can be replicated convincingly. Looking authoritative no longer says anything about a message being authentic.
Talking about it is not shameful, and it is the real countermeasure. The recovery scam feeds on silence about the first one: someone who never told anyone they were defrauded is also someone with nobody to check the second phone call against. Making it possible to admit a scam in a family without humiliation is, literally, a security control.
The point
Whoever found you the first time knows you answer. They know how much you lost. And they know you want that money back more than anything else.
It is not an attack on your naivety. It is an attack on your hope — which is a far harder thing to defend.
