Recovery scams: the secondary fraud targeting cryptocurrency scam victims
The second scam is the one that comes for people who have already been robbed.
The letter carried the seal of the European Central Bank and an address in Frankfurt am Main. It announced the award of a compensation contract in the amount of €404,800.00, approved, reserved, and waiting, and it asked for one thing before release: a refundable anti money laundering fee of two per cent, described, in the document’s own dialect, as a “Mobilization interest rate.” Two signatures shared the bottom of the page. One belonged to Christine Lagarde, President of the European Central Bank. The other identified a Deputy Chief Constable, Executive Director for European Local Policing, a rank borrowed from British policing and attached to an agency that has never existed. Between the seal and the signatures, where a real institution might have put a case number, someone had typed a single cheerful word: “Congratulations.”
The man who received it, a businessman in Scandinavia, was not a fool, and it matters to this story that he was not. He ran a company, read contracts for a living, negotiated for sport. A month earlier, he had lost money to an investment platform of the familiar species: a courteous adviser, a dashboard where the balance climbed like weather, and then, on the day he asked for a withdrawal, silence. Law enforcement agencies across Europe log tens of thousands of these losses a year. What happened next is the part they log less often, because the victims are ashamed to report it, and it is the part this essay is about. Someone called to help.
The helpers introduced themselves as a recovery firm. They carried the name and the registry number of a real debt collection agency, a small company on the coast of north Wales that has existed for a decade and whose only offense is existing. His case, they told him, had already been processed, successfully. The proceeds were waiting. To vouch for himself, the case manager, who signed his messages Nathaniel, sent along his passport, or a passport: nine digits, an issue date, a bearded portrait. Real compliance officers do not send strangers their identity documents; the gesture is the point, not the paper. The birthplace on the document was Wednesbury, a town in the West Midlands that lawyers know mostly as shorthand, from an old English case, for decisions no reasonable authority could reach. In a forgery, that reads less like coincidence than like a signature.
Then there was the money itself, which the man could see. In his own browser, in a wallet application he had installed himself, sat 404,800 units of a token called BUSD, matched to the promised compensation to the euro. Beside the balance, in smaller type, the app noted what the tokens were worth: $0.00. BUSD was a stablecoin whose regulator ordered the issuer to halt new minting in February 2023 and whose home exchange dropped support that December; what remains is a wind down asset. The tokens persist the way a cancelled banknote persists: printable, transferable, and worth nothing, and sending 404,800 of them costs roughly what it costs to send one. The entire architecture of the scheme fits in the space between those two figures, the large number you are meant to read and the small one you are meant to skip.
All that remained was the fee, about eight thousand euros, payable in advance and, the letter promised, refundable. It is worth pausing on that word, because no such thing exists in any legal order on earth. When a bank or an exchange genuinely blocks funds for compliance reasons, the block is lifted with documents, never with a payment; anti money laundering law is a regime of paperwork, not a tollbooth. And the arithmetic argued with itself. Two per cent of 404,800 is 8,096. The letter said 8,000. The messages asked for 8,100. Real institutions do not disagree among themselves about the size of their own fee. But the deepest objection is the simplest one. Whoever truly held €404,800 on this man’s behalf could have deducted eight thousand and wired him the rest. The fee had to travel inward for one reason only: nothing in that wallet could travel out.
The client hesitated, and the tone changed. The E.C.B. letter had carried a deadline, July 31st, and a footnote calling itself the last warning. The deadline passed. What followed, two days later, was another last warning: a Final Notice of Intended Legal Proceedings, five days to comply, the courts of England and Wales, outstanding contractual sums, interest, legal costs, plus five per cent for something the letter called an after service fee. One sentence deserves quotation in full, because it is the sentence that kept the man awake: assets held by dependents, “including real estate and financial assets,” may be subject to confiscation. It is written to reach past the victim and into his house, toward his family. It is also gibberish. Confiscation is a power of the state, not of a company; no court in Europe takes a family’s property over someone else’s alleged contract; and there was no contract, no sum, no claim, only a letter. People who run these schemes do not sue their victims, for the excellent reason that a courtroom is the one venue they cannot afford to enter. Their entire arsenal is the recipient’s imagination.
What our client had wandered into has a name. Investigators call it a recovery scam, and it is less a crime than an industry, with its own supply chain, of which the raw material is grief. The contact details of fraud victims circulate among criminal groups the way subscriber lists once circulated among magazines; the trade term, with the bluntness of any trade, is sucker lists. The F.B.I.’s Internet Crime Complaint Center describes the sequence dryly: people who lose money to investment fraud are then approached by fictitious law firms and government officials offering to get it back, and sometimes the second approach is simply the next act of the first. In 2025, the bureau counted more than 10,500 complaints about recovery schemes, with reported losses of about $1.4 billion, inside a year in which internet crime as a whole cost Americans some $21 billion, and complaints involving cryptocurrency alone exceeded $11 billion. By last July, the F.B.I. was warning that scammers had begun impersonating the complaint center itself, with the help of artificially generated video. The fraud now imitates the desk where you report the fraud.
Europe supplies the industry’s advertising. According to an analysis published in February, in the span of about a year more than 52 million Europeans were reached on Facebook and Instagram by upward of 50,000 advertisements impersonating Interpol, Europol, and assorted E.U. bodies, all promising refunds to fraud victims; one Polish language variant borrowed the face of the Prime Minister. The institutions being impersonated have been reduced to publishing standing disclaimers. The European Central Bank maintains a page patiently listing the plots run in its name, including, verbatim as a category, the recovery of money previously lost in scams, and reminding the public that it holds no accounts for private citizens and writes only from its own domain. Europol issued a notice in 2024 whose title says everything about the era: Europol will not call you. Germany’s federal police have traced millions of euros in losses to phone calls from fake Europol officers. A civilization can be read in its warning labels, and ours now include central banks explaining, in effect, that this is not how we speak.
The Welsh detail belongs to a subgenre the British regulator calls the clone firm. Rather than invent a company, the fraudster borrows one: name, address, registration number, all real, all checkable. In 2020, the year the technique flourished under lockdown, U.K. victims reported more than £78 million in losses to clone investment scams, about £45,000 per person on average, and 77 per cent of investors surveyed could not say what a clone firm was. The lesson is uncomfortable for anyone who prides himself on due diligence. A registry can confirm that a company exists. It cannot confirm that the person quoting it belongs to it. The clone is engineered precisely for the careful victim, the one who looks things up.
Which brings us to the question people ask quietly, usually about someone else: how does anyone fall for this? The honest answer is that the scheme is built by professionals and aimed, with some precision, at intelligent adults. Its first engine is the sunk cost effect, mapped four decades ago by the psychologists Hal Arkes and Catherine Blumer and studied ever since as escalation of commitment: the pull to keep feeding a losing course because of what has already been fed into it. A person who has lost fifty thousand will pay eight more, because the eight is not an expense, it is a rescue mission for the fifty, and the effect replicates even in people trained to know better. The trap deepens when the next step is framed as an action rather than a continuation: pay to release your funds. Scammers do not ask for patience. They offer agency, because agency escalates.
Its second engine is borrowed authority, deployed in parts. Each prop survives inspection on its own. The company is in the registry; the passport has the right number of digits; the rank of Deputy Chief Constable exists; Christine Lagarde exists. What no one inspects is the joints, and the fraud lives at the joints, in the question of what a British police rank is doing on the stationery of a central bank that congratulates people. In studies of scam compliance, authority and the hunger to stay consistent with one’s earlier choices predict who complies, across years, independent of intelligence or education, and time pressure operates as a channel of its own. That is what the deadlines are for: not to lend the letter weight but to foreclose the one act that reliably kills the scheme, which is consultation.
And beneath all of it runs shame. A systematic review published this year found that fraud victims carry shame, self blame, anxiety, and a corrosion of trust often out of proportion to the money lost, rising with the degree of emotional manipulation involved. The surrounding culture does the predators a favor: researchers have documented a durable habit of blaming the victim, among strangers and family alike, and criminologists find that online fraud victims are routinely judged partially responsible for their own robbery. Small wonder that only about a third of targets ever report. The rest go quiet, and the only person on earth who wants to discuss the loss, warmly, patiently, at any hour, is Nathaniel. The mark is not stupidity. The mark is solitude.
From where I sit, in a Warsaw law practice, the legal picture is almost the least interesting part, though it rewards a closer look. Under Article 286 of the Polish penal code, fraud means leading another person to an unfavorable disposition of property by deception, and it carries six months to eight years; where the sum at stake crosses the statute’s threshold of significant value, the range climbs to a decade. The crime does not wait for the money: a demand for a fee, grounded in forged instruments, is punishable as an attempt the moment it is made. The forgeries are a separate count, three months to five years, and the code defines a document broadly enough to cover the counterfeit central bank letter and the passport alike. The threats have their own architecture: the statutory definition of an unlawful threat expressly includes threatening to set prosecutions in motion, and where the letters cross into promising harm to a person or his family, a further provision adds up to three years. Organized structure and a steady income from the trade aggravate everything; laundering the proceeds is an offense of its own. Jurisdiction follows the harm, so a victim reports at home no matter which continent the sender works from. This is why we tell people to file even when they paid nothing, and to file the whole construction, the forged letters, the addresses, the wallets, so that prosecutors can treat the scheme as the compound offense it is. Every complaint maps a little more of the infrastructure, and the map serves the next victim, the one who paid.
The practical counsel is short. Do not answer, not even to refuse; every reply certifies that the address is alive and raises its price on the list, and the customary next act is a telephone call from a police officer who is not one. Keep everything: message headers, wallet addresses, transaction identifiers. If remote access software was ever installed on your machine, do not delete it; its logs can reconstruct, to the second, who did what, and have won arguments with banks. Call your bank the same day, because recall and chargeback windows close quietly. Judge a token by its contract address, never by a screenshot. And verify your rescuers with the same suspicion you have learned to aim at everyone else, a rule we hold no grudge against, since last year someone began offering fraud victims the services of our own firm. The name was ours. The offer was not. Distrust that includes us is distrust we can work with.
In twenty years of practice I have handled exactly one document in which the head of Europe’s central bank personally congratulates a private citizen on his good fortune. She never saw it, of course. Somewhere tonight a man with a borrowed passport is signing her name again, and somewhere else an inbox is lighting up with excellent news. There is a one line test that survives every change of costume, every new logo, every future improvement in the printing: money that must be paid for before it becomes yours is not money. It is bait. The industry that mails it has patience, craft, and your file. What it cannot survive is a reader who waits a day and shows the letter to somebody else.
Robert Nogacki – licensed legal counsel (radca prawny, WA-9026), Founder of Kancelaria Prawna Skarbiec.
There are lawyers who practice law. And there are those who deal with problems for which the law has no ready answer. For over twenty years, Kancelaria Skarbiec has worked at the intersection of tax law, corporate structures, and the deeply human reluctance to give the state more than the state is owed. We advise entrepreneurs from over a dozen countries – from those on the Forbes list to those whose bank account was just seized by the tax authority and who do not know what to do tomorrow morning.
One of the most frequently cited experts on tax law in Polish media – he writes for Rzeczpospolita, Dziennik Gazeta Prawna, and Parkiet not because it looks good on a résumé, but because certain things cannot be explained in a court filing and someone needs to say them out loud. Author of AI Decoding Satoshi Nakamoto: Artificial Intelligence on the Trail of Bitcoin’s Creator. Co-author of the award-winning book Bezpieczeństwo współczesnej firmy (Security of a Modern Company).
Kancelaria Skarbiec holds top positions in the tax law firm rankings of Dziennik Gazeta Prawna. Four-time winner of the European Medal, recipient of the title International Tax Planning Law Firm of the Year in Poland.
He specializes in tax disputes with fiscal authorities, international tax planning, crypto-asset regulation, and asset protection. Since 2006, he has led the WGI case – one of the longest-running criminal proceedings in the history of the Polish financial market – because there are things you do not leave half-done, even if they take two decades. He believes the law is too serious to be treated only seriously – and that the best legal advice is the kind that ensures the client never has to stand before a court.
