In June 2024 the FBI's Internet Crime Complaint Center warned that people posing as lawyers were contacting cryptocurrency scam victims through social media and messaging platforms. They claimed to be authorized to investigate the recovery of the victim's funds and to be working with the FBI, the Consumer Financial Protection Bureau or other agencies.
They asked for personal and banking details, for the amount the victim hoped to get back, for an upfront fee with the balance due on recovery, and later for back taxes and other charges.
Between February 2023 and February 2024, victims exploited this second time reported losses of more than $9.9 million.
An update in August 2025 listed the current tactics: impersonating real lawyers and real firms with forged documents, citing agencies that do not exist, telling victims they are on a government list of scam victims, moving the conversation into group chats with supposed attorneys and case processors, directing victims to open accounts at fraudulent foreign banks, refusing to appear on camera or show a license, and demanding payment in cryptocurrency or gift cards, sometimes to third parties in the name of secrecy.
The second scam is built entirely out of the first. The contact knows your loss because its details were shared, sold or scraped. The offer is exactly what you most want to hear. The timing is the moment of least judgment.
The FBI's own sentence is the decision rule, and it needs no detail checked: law enforcement does not charge victims a fee for investigating crimes. Anyone who has already located your funds and needs money to release them is the second wave. The offer itself is the tell.
You have done the first hour, set the expectation, filed the report. This lesson is about the next contact, which will come, and about what to do with the loss after that.
The offer is the tell
Every recovery scam has the same skeleton, and you can recognize it before checking a single detail.
They contact you. A message, a call, a comment under something you posted. Real recovery, on the rare occasions it happens, comes through the report you filed and through channels you can verify. It never begins with an inbound message.
They know your loss. The amount, the date, the platform, sometimes the addresses. That knowledge feels like proof. It is the opposite: the details of your loss were shared when you posted about it, sold on when the original crew moved on, or handed over to a fake service you contacted. Familiarity is the opening move.
The funds have already been found. Located, frozen, recovered by a court, held by an agency. Nobody who has actually recovered funds needs anything from you to release them.
There is a fee. Processing, taxes, verification, a percentage, a bond. In cryptocurrency or gift cards, or to a third party. This is the theft. Everything before it was staging.
If the offer has that shape, it is the second wave, whatever name is on it.
The red flags, and why each one works
The FBI's 2025 announcement lists the current tactics. Each is designed for someone in your exact position.
- Impersonating real lawyers and firms, with forged documents. You can search the lawyer and find them. The person messaging you is not them.
- Citing agencies that do not exist, with official-sounding names. You will not check, because the name sounds right and you want it to be.
- Telling you that you are on a government list of scam victims. True, in a sense: you are on a list, and they bought it.
- Group chats with supposed attorneys, case managers and other victims who were paid last week. A cast is cheap.
- Fraudulent foreign banks where you open an account to receive the recovery, and into which you deposit the fees.
- Refusing to appear on camera or produce a license. A real lawyer's registration is public and checkable in minutes.
- Payment in cryptocurrency or gift cards, sometimes to a third party for secrecy. The fee has to be irreversible for the second theft to work.
The 2024 announcement adds the older, simpler version: vague language, a thin online presence, unsupported promises, and the invocation of real institutions to borrow their credibility.
Suppose you want to be sure. A real lawyer, in any jurisdiction, has a public registration with the body that licenses them: a state bar in the United States, the Solicitors Regulation Authority or the Bar Standards Board in England and Wales, and their equivalents elsewhere.
Search the register, not the firm's website. Find the name, the firm and a phone number from the register. Call that number, not the one in the message, and ask whether the person is handling your matter.
A real lawyer will confirm. The second wave will either not be on the register, or be on it under a name whose office has never heard of you.
Then apply the rule anyway: even a real lawyer does not have your funds located and waiting on a fee. If the answer to "who has the power to release the funds" is not a court or an agency you can call, per O101-02 there is no recovery to pay for.
What a real recovery looks like
So that you recognize it if it ever happens.
It starts from the report you filed. A law enforcement contact reaches you, and you verify them by calling the agency's published number, not the one they give you. Or a court-administered claims process writes to victims on file, with a claim form and a deadline, and the funds are distributed through the court. It is slow, it is documented, and nobody in it asks you for money.
Per O101-03, the report number is the tell in the other direction: a real contact will have it. A fake one will ask you for money before it asks you for that.
I have already lost so much that I cannot afford not to try.
That sentence is the mechanism. The second wave works because the first loss makes a small fee against a large recovery look rational, and because a person who has just been robbed is exhausted, ashamed and hopeful, which is the state the offer is written for.
The arithmetic is not close. The base rate for recovery, per O101-02, is low enough that the FBI does not print it. The base rate for a fee paid to an inbound recovery service being stolen is, on the FBI's description of the scheme, approximately certain. You are not weighing a small cost against a large gain. You are weighing a certain second loss against a recovery that is not on offer.
Write the sentence from O101-02 again if you need to: "I am treating this as gone." It is the only thing they cannot work with.
What to do with the loss now
The evidence file is written and closed. The report is filed. The next contact is recognized on sight. That is the whole of what this course can do for the loss itself.
What it can do for the next one is the rest of the site. The placement diagnostic at O100-01 will tell you where you actually stand, and it is allowed to say lower than you hoped. Year One is open to read without an account: F103 on what a key is, F104 on how to hold one, F105 on what you are signing, F106 on how people are separated from their money, F111 on verifying a person when the face and the voice cannot be trusted. F105-06 is the full incident response lesson this course is the short version of.
Most people who arrive here after a loss should read Year One and stop. That is not a small outcome. It is the one that means this course was the last time you needed it.
The second wave is built out of the first: an inbound contact who knows your loss, has already found your funds, and needs a fee to release them, in crypto or gift cards, to someone you cannot verify. The FBI's rule needs no detail checked, since law enforcement does not charge victims a fee for investigating crimes, and its published red flags, forged lawyers, invented agencies, a government list, staged group chats, foreign banks and irreversible payment, each work on a victim's exhaustion and hope. A real recovery starts from the report you filed, runs through channels you verify by calling the agency's own number, and never asks you for money. Treat the loss as gone, recognize the offer on sight, and spend what comes next on Year One, which is where this stops happening.