Victims of fraud search, in their thousands, for the phrase "recover my money." Search engines and social platforms hand those queries to whoever is answering them. Some of the answerers are legitimate lawyers. Most are the same scammers — or their successors — in a new uniform.
The playbook
The contact arrives within hours of the loss — sometimes minutes, which means they are monitoring. The claim is a chain of false authority: "the federal complaint desk referred you here," "your report number is in our system," "we work with the blockchain analytics firms." Then the window: the freeze takes forty-eight hours, expedited service is available, the trace expires tonight.
The tell: payment before results
Every legitimate recovery path has one thing in common — you do not pay to start. The bank acts on the dispute you file. The police act on the report you file. A "recovery specialist" who asks for a fee before the freeze, a "software licence" before the trace, or — the loudest tell — crypto only, because "bank channels are monitored," is selling you the product you just lost money to: urgency.
Why it works
A person who has just lost everything is in exactly the state the original script built: trusting, urgent, isolated, and hungry for a story in which they were not foolish. The second hit does not build that state. It inherits it, fully furnished.
What to do instead
File with your bank and your national reporting centre — the one-step report portal builds the pack. Ask one person who wants nothing from you. And if a "recovery" contact appeared, run the conversation through the analyzer: the recovery-scam family exists in the taxonomy precisely because this script is documented, weighted and detectable.