FTC flags 5 payment methods in second-stage recovery scam attacks

For threat intelligence and cyber defense teams, recovery scams illustrate how compromised victim lists become repeat-targeting infrastructure. Attackers exploit prior fraud reports, impersonate trusted entities like IC3, and push victims toward hard-to-trace payment rails.

On August 18, 2026, the Federal Trade Commission and the Federal Bureau of Investigation issued renewed public warnings about a second-stage fraud tactic known as recovery scams. The scheme specifically targets people who have already lost money to fraud, with criminals claiming they can help victims get those funds back. The catch is always the same: before any recovery can occur, the target must pay an upfront processing fee, tax, or other charge, or hand over sensitive personal and financial information.

“

On August 18, 2026, the Federal Trade Commission and the Federal Bureau of Investigation issued renewed public warnings about a second-stage fraud tactic known as recovery scams.

The mechanics are straightforward but effective. A recovery scam can begin with an unexpected call, email, text, or social media message. According to the FTC, scammers may claim to represent a government agency, law firm, consumer advocacy group, or another seemingly legitimate organization. They tell victims that their lost money has been located or that they can recover it, but first require payment of a processing fee, tax, or other charge. They may also ask for bank account information, a Social Security number, or other sensitive data. The FBI has specifically warned about scammers impersonating its Internet Crime Complaint Center, known as IC3. The FBI states that IC3 will never ask for payment to recover lost funds or refer victims to a company that charges for recovery.

A central insight from the warning is the commodification of victim data. The FTC warns that scammers buy and sell information about people who have previously lost money to fraud, believing those victims may be more likely to fall for another scam. This turns prior victimization into a repeat-target list. For fraud prevention teams, this means that every victim report is not only a single loss incident but also a potential lead for future attackers. The implication is significant: organizations that serve consumers, including banks, payment providers, and legal services, need to treat prior fraud victims as a high-risk population for follow-on social engineering and identity-theft attempts.

The FTC identifies several red flags. First, any unexpected request for money to recover funds already lost is a major warning sign. The agency advises particular caution if someone demands payment using cryptocurrency, gift cards, cash, wire transfers, or a payment app. These five payment channels share common traits: they are difficult to reverse, hard to trace, and often outside traditional chargeback protections. This is operationally relevant because banks and payment platforms can build transaction-monitoring rules around these indicators, especially when combined with a customer history of fraud claims or recovery-related messages.

The FTC also stresses independent verification. If someone claims to represent a government agency, potential victims should look up the agency's contact information themselves rather than using a number provided by the caller or shown on caller ID. That guidance matters for legal and compliance teams because it highlights the risk of brand impersonation: legitimate law firms, advocacy groups, and agencies can be spoofed by criminals, creating potential reputational harm and client confusion.