"We will recover your money from the broker" — the recovery scam

Consider a hypothetical victim who lost $14,000 and receives an unsolicited recovery call six months later. The caller promises repayment within four weeks for an upfront $2,800 payment. These are invented amounts and dates illustrating recovery-scam warnings; accurate knowledge of a loss does not authenticate the caller or prove that the same network made both approaches.

What a fund recovery scam actually is

A recovery scam targets someone already harmed by fraud or a failed investment. The caller may impersonate a law firm, investigator or public body and demand a purported tax or release fee before returning funds. This is a warning pattern, not evidence that every failed broker or paid legal service is fraudulent.

The most cynical part of the mechanism is that the target is someone already harmed and desperate. The UK regulator, the FCA, describes it plainly: a recovery room scam usually follows on from an earlier boiler room scam in which someone has already lost money. The second-wave salesperson does not need to sell anyone on an investment — they only have to promise to undo the previous harm. That is why the scheme is so effective and so cruel at once.

How information about an earlier loss can be reused

FTC and CFTC describe victim lists containing contact and payment details that can be sold or reused. This explains how a new caller might know the earlier platform or amount. It does not identify who collected the details in an individual case or prove that the same people control both approaches.

A caller’s knowledge of the exact loss does not authenticate the recovery offer. The details might have been reused, sold or obtained elsewhere; they do not prove that the caller controls the lost funds or holds one specific original file. Verify the claimed organization through independently found contact.

Red flags — how to recognise the second scam

Treat the following signs as reasons to stop and verify independently. A professional-looking site or accurate personal details do not authenticate the offer. Preserve the contact rather than supplying more sensitive information.

• Unsolicited contact. You did not find this firm and write to it — it called or messaged you first, often months after the loss. Regulators, the FCA among them, list unexpected contact as one of the basic signals of an investment scam.
• A payment required to release a refund. Be wary of a claimed tax, deposit or administrative charge demanded by an unsolicited caller. Legitimate legal work can have fees; independently verify the professional, contract and scope rather than treating payment alone as proof of legitimacy or fraud.
• A guaranteed outcome. A promise of a full refund regardless of the facts is a warning sign. A caller’s assurance does not establish that funds exist, can be traced or will be returned.
• Impersonating institutions. The caller claims to act on behalf of a regulator, the police, a "compensation fund" or an international agency. ESMA separately warns that fraudsters misuse its identity and logo in emails to investors.
• A request for remote access or further payments. A demand to install remote-desktop software ("to help you fill in the form"), to share your bank codes, or to top up because the "refund transaction is stuck", is an escalation of the same scheme.

An illustrative scenario — the anatomy of one call

The story below is an illustration assembled from typical elements, not a description of a specific person. The victim of the first scam had deposited $9,000 with a platform that promised returns of well over ten per cent a month, and after a few weeks it stopped processing withdrawals. Four months later she took a call. The caller introduced himself as a consultant for a "European asset recovery office", knew her name, the amount and the name of the first platform. He said her funds had been "frozen on a technical account" and could be released, but it required a handling fee of $1,900 and the installation of an app through which the "legal department would complete the procedure".

In this invented scenario, the unsolicited request for money and remote access calls for independent verification rather than payment. The victim ends the call, retains its details, contacts her bank through an official channel and checks the claimed organisation. A warning-list search is useful, but absence from a list does not prove legitimacy.

What recovery really looks like, and where its limits are

Contact the payment provider promptly about options for the particular payment, including a card dispute or transfer recall where available. Eligibility, deadlines, evidence and start dates vary. For covered US billing errors, Regulation Z generally requires written notice received within 60 days after the creditor transmitted the first periodic statement reflecting the alleged error. This is a scoped billing-error procedure, not a worldwide deadline or a guaranteed refund of an investment loss.

Report suspected fraud through the applicable law-enforcement and regulator channels, keeping messages and payment records. A report can support investigation; it does not automatically open a criminal case, put a firm on a warning list or recover funds. The article how to spot a scam broker in five minutes discusses recognising a suspicious provider, while what happens to your money if a broker fails addresses the different case of insolvency.

If seeking legal help, find and verify the provider independently and obtain clear written scope and fees. Professional registration and available remedies depend on the jurisdiction. Recovery is uncertain; do not finance an unverified guarantee. Before future deposits, consult the forex broker selection checklist, the MiFID II regulation and the wider regulations section.

What to do tomorrow

1. Pause an unsolicited refund demand. Do not pay a purported release fee or disclose account access on the caller’s instructions. Find the claimed organisation’s official contact yourself and verify the approach. Share the warning pattern with someone who may be facing a similar approach.
2. Ask the payment provider promptly about a dispute. Give the payment date, amount, method and facts. Ask which deadline, start date and evidence apply to this case rather than assuming every scheme gives 120 days from the transaction.
3. Read the actual warning. Search the relevant regulator and IOSCO alerts using exact names, addresses and domains. A warning may concern an unauthorised or impersonating entity; preserve its scope for the bank or authorities. Neither a bare name match nor an absent alert settles the identity of the caller.
4. File a report with the prosecutor or police and a notification to the regulator. Prepare screenshots, the transfer history, and the phone numbers and email addresses of the callers. Even if recovery is uncertain, your report feeds the body of evidence and may protect the next people on the same victim list.
5. Do not install any remote-desktop software and do not share your bank codes. If someone asks for remote access to your computer or for an authorisation code "to complete the refund", end the call at once. This is not a step in recovering money — it is an attempt to take control of your account.