“We can recover your stolen crypto”: the second scam is the easier one

The conclusion first, because someone is probably still messaging you while you read this: whoever appears after a scam offering to get your money back is almost always round two. They are not there to help. They are there for whatever you have left.

Why they found you, and not someone at random

The first scam had some randomness in it — you happened to click that link, you happened to be in that group. The second one does not.

A notice on second-round fraud published by the Taipei District Prosecutors Office in Taiwan states it directly: this kind of approach works from data obtained earlier, used to contact victims again. Your amount, your dates, the conversation, the accounts — that was already in the first crew's hands. Reaching you a second time requires no skill at all.

So the very things that lower your guard — they know how much, they know which day, they know what name the other side used — are the cheapest part of the operation to obtain.

Four openings a prosecutors' office has catalogued

The same notice lists several recurring forms. Here they are with the tell that gives each one away:

• Fake police or prosecutors. They say the money mules have been arrested and the funds impounded, but a handling fee or deposit is needed before release. The tell is that last clause — criminal proceedings do not bill you in advance.
• Fake bank staff. They say the money has been recovered and is sitting in the system, but you need to go to a cash machine and perform a few steps to “close an account” or “clear a setting”. Those steps move what is left of your balance out. No bank completes a refund by sending you to an ATM.
• Fake lawyers. A formal-looking website or page, a guarantee of recovery, a retainer paid up front, and then silence. The tell is the guarantee — nobody can guarantee an outcome.
• Fake groups and “hackers”. A chat group claiming hacking capability or a special channel to retrieve the coins, followed by a fee — or, in a variant, a suggestion that you win the losses back through gambling. This is the version crypto victims meet most.

On that last one there is a technical fact that removes any need to deliberate: on-chain transfers have no undo. Coins that have moved cannot be pulled back into your wallet by anyone through technical means. The only party who can move those assets is whoever holds the private key — the scammer. So “our hackers will recover it” is not improbable, it is mechanically impossible. The prosecutors' notice gives the same advice in plainer terms: do not go looking for hackers or outfits of unknown origin.

There are only two legitimate routes

Recognising the fakes is not enough; you need to know what the real thing looks like, or the next unfamiliar script will still give you pause. The notice lists two routes:

1. Speed. Report through the official anti-fraud channel as early as you can, because the chance of freezing funds falls away as they are moved onward; then complete the police report. The operative word here is fast, not finding the right person.
2. The legal route. A criminal complaint, or a civil claim for damages. Slow, and the only path that actually results in money being awarded back.

Put those beside the scripts and the gap is obvious: neither route starts with someone messaging you, neither asks for money up front, and neither happens in a chat group. Which channel applies where you live, what to preserve before you contact anyone, and the order to do it in are in after a scam: the first four things to do.

The one-line test: pay first, and it’s fake

Four shapes are listed above, but you do not need to memorise four. One line is enough:

Any “recovery” that requires you to pay first in order to get money back is fake.

It does not matter whether the payment is called a handling fee, a deposit, tax, an unfreezing fee, legal fees, notarisation, or expenses. That single line covers the fake officer, the fake bank, the fake lawyer and the fake hacker — and it also covers the names nobody has invented yet.

You may notice the shape repeating across this site. A bait wallet wants a small fee before you can withdraw the USDT you can see. A fake giveaway wants a small payment before releasing the prize. A signal-group mentor produces a deposit requirement the moment you try to withdraw something large. Show a large sum, then ask for a small payment to unlock it — one machine, different shells. Recognising the shape beats memorising the shells.

Why the second time works better than the first

This section is not about method. It is about the state you are in, which decides more outcomes than the method does.

In the days after being scammed you are carrying three things at once: a loss that has left but has not been accepted; a shame you cannot say out loud; and a stubborn sense that there must be something that can be done. Together those make a person with almost no resistance to “I can get it back for you”.

• Sunk cost argues on their behalf. Paying a small amount to recover a large one looks so favourable on paper that you skip straight past the premise — whether the large amount still exists at all.
• Shame keeps you from asking anyone. You may have told a friend about the first loss. Most people do not tell anyone about the second. And being talked through by someone with no stake in it is precisely what this scam cannot survive.
• Their knowledge of the details reads as credentials. Said above, worth saying again here, because it is the last thing to give way.

If you are in one of these conversations right now, do one thing: put the phone down and describe the whole exchange, out loud, to someone uninvolved. Not an expert — just someone who will not feel sorry for you. Most people stop halfway through their own sentence about the deposit that releases the funds.

You already paid. What now

If you have already paid, set the self-blame aside; it does nothing, and it was priced into the plan. In order:

1. Stop the conversation and pay nothing further, including “just this last one” and “we are one step from release”.
2. Report both losses. Many people never mention the second out of embarrassment, but it is fraud in its own right and is often the same operation, so filing them together can help. Bring both sets of messages, transfer records and account details.
3. Move fast on the official channel first. Timing still matters; the order and what to prepare are in after a scam: the first four things to do.
4. Set your expectations. Someone who has paid once is a more clearly marked name, so a third approach is not less likely. Knowing another call is coming is what stops it from working.

Frequently asked questions

They knew the amount, the date, even the account I sent to. Can it still be fake?

Yes, and that is exactly why the second approach is harder to resist than the first. A Taipei prosecutors' office notice on second-round fraud puts it plainly: this kind of approach works from data obtained earlier. Your amount, the date, the conversation, the account — all of that was already in the first crew's hands. So knowing the details is not evidence that someone is on your side. It is evidence that they can reach that file. Those two feel identical and are nothing alike.

Someone says they have hackers who can pull the coins back from the scammer's wallet. Is that real?

No. On-chain transfers have no undo, and nobody can unilaterally pull moved coins back into your wallet by technical means. The only party who can move those assets is whoever holds the private key — that is, the scammer. So “our hackers can recover it” is not merely unlikely, it is mechanically impossible. The prosecutors' notice says the same thing in plainer language: do not go looking for hackers or outfits of unknown origin.

Then what are the legitimate routes?

The notice lists two. The first is speed: report as fast as you can through the official anti-fraud channel for your jurisdiction, because the chance of freezing funds falls away as they are moved onward, and then complete the police report. The second is the legal route: a criminal complaint, or a civil claim for damages. Neither route involves someone messaging you first, and neither asks you to pay a fee up front.

I already paid a “recovery fee” and lost that too. Should I still report it?

Yes, and report both. Plenty of people stay silent about the second loss out of embarrassment, but the second payment is fraud in its own right and is often run by the same operation, so filing them together can help the investigation rather than hurt it. Bring both sets of messages, transfer records and account details. And set your expectations: someone who has paid once is a more clearly marked name on the list, so a third approach is not less likely. Knowing that in advance is what stops the next call from working.

Is there one line I can judge by on the spot?

Yes. Any “recovery” that requires you to pay first in order to get money back is fake. It does not matter whether the payment is called a handling fee, a deposit, tax, an unfreezing fee, legal fees or expenses. Criminal proceedings do not bill you in advance, banks do not ask you to complete a refund at a cash machine, and no genuine authority negotiates recovery in a private chat. That single line covers every script above, including the ones nobody has seen yet.