Skip to content
FIN-CSIRT
RS

FIN-CSIRT / Search

What are you looking for?

Start typing to see results.
    Report an incident

    FIN-CSIRT / Practical lesson

    Do not pay upfront for a promised recovery

    Criminals contact people who have already lost money and impersonate authorities, lawyers or recovery specialists.

    People who have lost money to a scam and their familiesAbout 5 minutes of reading + 3 questions
    Go to response steps Already paid a fee or shared information?

    What you will learn

    • Recognise a recovery offer as a possible second scam.
    • Verify an organisation through contact details you find yourself.
    • Preserve evidence and stop further loss.

    Why do criminals come back?

    After a scam, contact details, the amount lost and the platform used may remain with the criminals or be passed to others. A new caller can therefore sound convincing and know facts you never made public.

    They may impersonate police, a regulator, a law firm, a bank, a blockchain investigator or a consumer organisation. A job title and case number do not prove identity.

    Signs of a second scam

    Be especially cautious when an unexpected contact:

    • guarantees that all your money will be returned;
    • requests an advance administration, tax or legal fee;
    • insists on cryptocurrency, a wire transfer or another hard-to-reverse method;
    • asks for banking access, a confirmation code, card details or an identity document;
    • says the offer is secret or time-limited;
    • provides contact details for an organisation that you cannot independently verify.

    Check the offer independently

    1. End the call or conversation without announcing what you will do next.
    2. Find the supposed organisation’s official website and contact details yourself.
    3. Check whether the case and person exist, but do not use the number or link in the message.
    4. Do not install “asset-tracing” software or allow remote access.
    5. Speak to your bank and report the original scam through the appropriate local channels.

    If you paid again or shared information

    1. Contact your bank or payment provider immediately and say the transaction is connected to a scam.
    2. Preserve messages, wallet addresses, receipts, phone numbers, account names and times.
    3. If you shared a password or code, secure the account through the official service and end unknown sessions.
    4. If you installed software, stop using that device for financial services and follow the device recovery guide.
    5. Report both events and explain that they are connected.

    Practice example

    A supposed asset-recovery service calls

    Unknown number

    Unexpected call

    We found the money you lost on the investment platform. Pay an administration fee today so we can release it.
    Fictional example for practice.
    Show the example explanation
    They know about the earlier scam
    Lists and details about victims can be traded or shared between criminals.
    A fee comes before the refund
    Another payment does not establish that the funds exist or will be returned.
    You are pressed to act now
    The deadline discourages an independent check of the caller and organisation.

    Check your knowledge · 3

    Your turn to choose the next step.

    Choose one answer for each question shown. More complex lessons select three questions from a wider question bank when the lesson loads.

    Questions and explanations are also available without JavaScript.

    A supposed recovery expert knows how much you lost and asks for an advance fee. What do you do?

    Why does this matter? Accurate details may come from information criminals shared with one another.

    1. Pay because knowing the amount proves they have access to the case.

      Knowing details does not prove identity or that recoverable funds exist.

    2. Do not pay; verify the organisation through official contact details I find independently.Correct answer

      An independent check prevents the message sender from controlling the entire process.

    3. Send an identity document but no money.

      An identity document can enable further identity theft.

    Which is a particularly strong sign of a recovery scam?

    Why does this matter? The criminal is trying to collect another payment before any verifiable process occurs.

    1. They demand a cryptocurrency fee before releasing funds.Correct answer

      An upfront payment by a hard-to-reverse method is a strong warning sign.

    2. Your bank directs you to the number printed on your card.

      A known official channel is a safer way to verify a contact.

    3. You receive a case number that you verify on an official website.

      A case number has value only after independent verification.

    You already sent the new payment. What is the first financial step?

    Why does this matter? Prompt contact with the payment provider may improve the chance of stopping or tracing the transaction.

    1. Contact the bank or payment provider immediately through an official channel.Correct answer

      The provider can explain available measures and record the fraud.

    2. Pay one more fee so the previous payment is not wasted.

      Another payment increases the loss without evidence of recovery.

    3. Delete the conversation so the criminal cannot contact me.

      The conversation may be important evidence; preserve it first.

    No registration. Your answers are not sent; the result is just for you.

    A second offer may be a second stage of the scam

    Do not pay or share financial information with an unexpected caller promising to recover money.

    See what to do if money has already been sent

    References

    Sources and further reading

    The repeat-victimisation pattern and advance-fee warning are based on the US Federal Trade Commission guide to refund and recovery scams (United States). US reporting routes have not been carried over because they are not the correct authority for users in Serbia.

    Content last reviewed