Curriculum·G704 Community Moderation·about 32 min
The recovery scam inside your own community
By the end of this lesson you can
- →State what the FBI's 2024 announcement reported about fictitious law firms targeting cryptocurrency scam victims, including the loss figure and the window
- →Explain why a community that has just been attacked is the recovery scammer's best hunting ground, and how the scam uses the community's own channels
- →Compute the second-wave exposure of a community from its victim count and the reported loss per re-victimization, and read what a single moderator direct message is worth
- →Write the community's recovery rule: what the project will never offer, what a member should expect after a loss, and where the only real reporting routes are
Graduate · enrolled learners
This lesson opens with FBI Internet Crime Complaint Center, fictitious law firms targeting cryptocurrency scam victims, 24 June 2024.
- What happened
- The FBI's Internet Crime Complaint Center issued a public service announcement warning that fraudsters posing as lawyers from fictitious law firms were contacting cryptocurrency scam victims, claiming authorization to investigate fund recovery, and using the victims' emotional state and financial need to extract further payment. Between February 2023 and February 2024, victims who were further exploited by fictitious law firms reported losses totaling over $9.9 million. The announcement described the tactics: referencing fictitious government or regulatory entities, claiming to work with the FBI or other agencies, requesting upfront fees, back taxes or other payments to release funds, and asking for payment in cryptocurrency or gift cards. A follow-up in August 2025 reported the scheme combining multiple exploitation tactics and targeting the elderly, and the Center's broader figures for recovery scams reached more than 10,500 complaints and about $1.4 billion in reported losses in a single year.
- The decision point
- A person who has just lost money is the easiest person in the world to sell recovery to, and the scammers know where to find them: in the community where the loss happened, in the channel where the victims are asking what to do, replying to the posts where they said how much. A community leader who has not written what the project will never offer, and what a member should expect after a loss, has left the members to work it out from the direct messages that arrive within the hour. The rule has to exist before the incident, because after it the members are reading everything through the state the scam is built to exploit.
- Recorded loss
- $9,900,000
What you will be able to answer
- →What did the FBI report about fictitious law firms in June 2024?
- →Why is an attacked community the best ground for a recovery scam?
- →What is in the community's recovery rule?
- →What is the tell in a recovery offer?
Orientation and Year One are open: anyone can read them without an account. From Year Two onward the lessons are for enrolled learners, because progress through the later years only means anything if it is tracked against a record.
It is free. We do not sell the list and there is nothing to buy at the end of it.
Sources and review
- https://www.ic3.gov/PSA/2024/PSA240624
- https://www.fbi.gov/investigate/cyber/alerts/2025/fictitious-law-firms-targeting-cryptocurrency-scam-victims-combine-multiple-exploitation-tactics-while-offering-to-recover-funds
- https://www.ic3.gov/PSA/2025/PSA250813
Confidence high·Volatility medium·Reviewed 2026-09-14·Owner unassigned
Contested
The $9.9 million is reported losses to fictitious law firms specifically, in one year; the Center's figures for recovery scams as a whole are much larger and are cited in the mechanism from later reporting. Reported losses understate actual losses by an unknown factor, per the Center's own caveats.
F106-06 and O101-04 own the individual's response to a recovery scam. This lesson owns the community leader's: the rule, the channel, and the second-wave exposure. Keep the split.