„We will recover your money from the broker" — the recovery scam

Krzysztof lost 14,000 zloty to a broker that appeared on no regulator's register. Six months later the phone rang: a polite voice introduced itself as a lawyer from a „fund recovery agency", quoted the exact size of his loss, and promised to retrieve the money within four weeks — he only had to pay an upfront „court deposit" of 2,800 zloty first. It was not a rescue. It was a second fraud, aimed at the same victim, most likely run by the same network. In this article I explain how the fund recovery scam works and how to tell it apart from the real, limited routes to getting money back.

What a fund recovery scam actually is

A fund recovery scam, also called a recovery room scam, is a fraud aimed at people who have already lost money — usually to an illegal or offshore broker. The pattern is brutally simple. A stranger contacts the victim out of the blue, posing as a law firm, a „fund return agency", and sometimes even as a representative of a regulator or law enforcement. They claim to have traced the lost money and to be able to recover it — on one condition: you have to pay first. The fee is dressed up as a commission, a case cost, a refund tax, or a charge to „release" the blocked money. Once the victim transfers it, the funds vanish and contact goes dead, or another demand for payment appears.

The most cynical part of the mechanism is that the target is someone already harmed and desperate. The UK regulator, the FCA, describes it plainly: a recovery room scam usually follows on from an earlier boiler room scam in which someone has already lost money. The second-wave salesperson does not need to sell anyone on an investment — they only have to promise to undo the previous harm. That is why the scheme is so effective and so cruel at once.

Why it is often the same network that scammed you the first time

Against intuition, the „recovery firm" is rarely a random new player. Very often it is run by the same people who operated the first scam, or who bought the data from them. Illegal brokers keep detailed client records: phone number, deposit amount, call transcripts, even notes on which arguments a given person reacts to emotionally. Such a list — known in the scam trade as a „sucker list" — is a valuable commodity. It can be resold to another group, or reused in-house for a second approach under an entirely new name and a new phone number.

That explains the thing victims describe as especially unnerving: the caller knows the exact loss and the date of the deposit. It looks like proof that they really have „reached" the money. In reality it only proves they hold the file from the first fraud. The accurate, surprisingly precise detail is a social-engineering tool — it is meant to lower your guard, not to justify the claim. The more the caller seems to „know everything", the more cautious you should be, not the more trusting.

„Recovery rooms insist on being paid a fee or transaction charge before carrying out any services to recover any consumer's losses." — Financial Conduct Authority, *Recovery room scams*, 2023.

Red flags — how to recognise the second scam

A recovery scam has a recognisable set of signals. Each one alone should raise a flag, and the combination is all but certain.

• Unsolicited contact. You did not find this firm and write to it — it called or messaged you first, often months after the loss. Regulators, the FCA among them, list unexpected contact as one of the basic signals of an investment scam.
• An upfront fee under any name. A commission, a deposit, a „refund tax", a cost to „release" the funds, a payment for a „court" or a „foreign bailiff" — if you must pay in order to recover your own money, that is the hallmark of the scam.
• A guarantee of recovery. No honest law firm guarantees an outcome, because recovering money from an offshore network is inherently uncertain. A promise of a „one hundred per cent refund" is the marketing of a fraud, not a real service.
• Impersonating institutions. The caller claims to act on behalf of a regulator, the police, a „compensation fund" or an international agency. ESMA separately warns that fraudsters misuse its identity and logo in emails to investors.
• A request for remote access or further payments. A demand to install remote-desktop software („to help you fill in the form"), to share your bank codes, or to top up because the „refund transaction is stuck", is an escalation of the same scheme.

An illustrative scenario — the anatomy of one call

The story below is an illustration assembled from typical elements, not a description of a specific person. Anna deposited 9,000 zloty with a platform that promised returns of well over ten per cent a month, then stopped processing withdrawals after a few weeks. Four months later she took a call. The caller introduced himself as a consultant for a „European asset recovery office", knew her name, the amount and the name of the first platform. He said her funds had been „frozen on a technical account" and could be released, but it required a handling fee of 1,900 zloty and the installation of an app through which the „legal department would complete the procedure".

Every one of those elements is a red flag: unsolicited contact, knowledge of details from the first scam, an upfront fee, a fictitious „technical account" and a request for remote access. A real recovery scenario never begins with a call demanding a transfer „today". Instead of paying, Anna hung up, reported the matter to her bank and checked the firm's name against the warning lists. That is the only correct response to such a call.

What recovery really looks like, and where its limits are

Real routes do exist, but they are limited, slow and offer no guarantee. If you paid by card, the fastest option is a chargeback — a dispute raised with the bank that issued the card. Card schemes typically allow up to 120 days from the transaction to file, and the US FCBA gives 60 days from the statement for billing errors; the exact rules depend on the scheme and the bank, so speed matters. If you paid by bank transfer, report it to your bank and ask for a recall — when the funds have not yet been moved on, they can sometimes be held.

The second layer is the formal route. A report to the regulator can land the entity on a public warning list, and a notification to the prosecutor or police opens a criminal case. It helps to understand the difference between spotting a scam at the door and trying to recover money after the fact — I devoted a separate piece to the first stage, on how to spot a scam broker in five minutes. If the broker was actually licensed and went insolvent, the situation is different, and I covered it in the article on what happens to your money if a broker fails.

You can also use a law firm — but one you find and vet yourself, working on a written engagement, with an invoice and a defined scope, never one that calls first and promises a guarantee. And finally the hard truth every honest writer owes you: money sent to a deliberately organised network abroad is very often unrecoverable. Better protection starts before the deposit — with choosing a supervised broker, which I break down in the forex broker selection checklist and in the discussion of MiFID II regulation. The wider regulatory picture sits in the regulations section on forexmechanics.com.

What to do tomorrow

1. Write down one iron rule and pin it above your desk. It reads: „nobody who calls me first and demands an upfront fee will recover my money". That single rule cuts out almost the entire recovery scam, because an upfront fee and unsolicited contact are its two pillars. Repeat it to relatives who may also have lost money.
2. If you paid by card, call your bank today and ask about a chargeback. Give the date and amount of the transaction and explain that the service was not delivered or was a fraud. Do it as quickly as you can, because card schemes usually count the window up to 120 days from the transaction, and every day of delay works against you.
3. Check the firm's name against the regulator's warning list and the IOSCO alerts portal. Enter the exact name of both the first broker and the „recovery firm" that contacted you. If either already appears there, you have confirmation and a strong argument in your conversation with the bank and in your report.
4. File a report with the prosecutor or police and a notification to the regulator. Prepare screenshots, the transfer history, and the phone numbers and email addresses of the callers. Even if recovery is uncertain, your report feeds the body of evidence and may protect the next people on the same victim list.
5. Do not install any remote-desktop software and do not share your bank codes. If someone asks for remote access to your computer or for an authorisation code „to complete the refund", end the call at once. This is not a step in recovering money — it is an attempt to take control of your account.