Recovery (refund) scam
Scammers targeting people who've already been scammed once.
How it works
After losing money, you're contacted by a 'lawyer', 'crypto recovery expert' or 'government investigator' who promises to recover your funds — for an upfront fee. They take the fee and disappear.
Common scenarios to watch for
This scam shows up in several different shapes. Recognise the pattern, not just one message.
Crypto 'recovery expert' on Telegram
Cold-messages people who posted in scam-recovery threads. Claims to use 'blockchain forensics' and asks for an upfront retainer in ETH.
"I tracked your stolen USDT to a wallet on Binance. 0.5 ETH retainer and I'll initiate freeze within 24h."
Red flags to spot
- Did someone cold-message you offering to recover lost crypto?
- Are they asking for an upfront fee or retainer in crypto?
- Do they claim to have 'connections' at exchanges or law enforcement?
- Can they provide verifiable proof they tracked your funds?
Fake law-firm letter
A polished email from 'Smith & Associates Recovery' references your actual scam loss (bought from leaked lists) and asks for filing fees.
"Our class action against XYZ Investments is filing this week. Court fees $1,200 per claimant — pay by Friday."
Red flags to spot
- Does the law firm have a verifiable registration and physical address?
- Are they asking for court fees before any legal action has started?
- Do they reference your exact loss amount (suggesting they bought leaked data)?
- Can you find the class action listed on a real court registry?
Government 'compensation fund'
Claims AUSTRAC, ASIC or the AFP has set aside a compensation fund. You must pay 'release tax' to receive your share.
"AUSTRAC compensation: $48,200 allocated to you. Pay $720 release fee to your nominated account."
Red flags to spot
- Is a government agency offering compensation you never applied for?
- Are you being asked to pay a 'release fee' or 'tax' to receive it?
- Does the email or SMS not come from a .gov.au domain?
- Can you verify the fund directly by calling the agency's public number?
Red flags
- 🚩Contacted out of the blue about your previous scam
- 🚩Upfront fee to 'release' funds
- 🚩Knows specific details (because they bought the scam list)
- 🚩Claims links to ASIC, AFP or IRS
What to do
- 1No legitimate recovery service charges upfront.
- 2Report directly to your bank, Scamwatch and the AFP.
- 3Block the new contact — being scammed once puts you on lists.
Who's targeted
- Previous scam victims — names sold and resold on scammer lists.
- Crypto-investment victims especially.
Why it works
- Victims desperately want their money back and will believe a lifeline.
- Scammers cite real case details they bought from the original scammer.
Common variations
Different shapes of the same scam — recognise the pattern.
- 1'Crypto recovery expert' charging in ETH upfront.
- 2Fake AFP, ASIC or IRS 'investigator' offering refunds for a fee.
- 3'Law firm' that's holding seized funds awaiting your tax payment.
If you've already been scammed
- 1Block the new contact and stop all payments.
- 2Report to Scamwatch and the AFP — they track recovery scammers.
- 3Speak only to your bank and official agencies you contact directly.
Frequently asked
Are any recovery services real?▾
Some lawyers help, but they bill normal legal fees — never crypto upfront.
How did they know about my loss?▾
Scammers buy and trade victim lists. Being targeted twice is common.
Can I claim through my bank?▾
Yes for some bank transfers under the new scam-prevention rules — ask your bank.
Related scams
Connected patterns you should also learn — ranked by how much they overlap with this one.
Bank SMS scam
Fake bank text telling you to 'verify' a payment via a link.
Read guideCrypto investment scam
Fake trading platforms or 'mentors' promising big returns.
Read guideRomance scam
An online relationship that turns into requests for money.
Read guideParcel delivery scam
Fake AusPost or courier SMS asking for a small 'redelivery fee'.
Read guideFake government messages
myGov, Medicare, Centrelink lookalikes asking you to 'verify'.
Read guideTech support scam
Pop-ups or calls claiming your computer is infected, asking for remote access.
Read guide