Scammers are increasingly targeting identity theft victims with fake recovery offers, exploiting their previous losses to extract more money, according to a warning from the Federal Trade Commission.
The Federal Trade Commission (FTC) has issued a warning about a disturbing trend in identity theft scams that specifically target individuals who have previously fallen victim to fraud. Scammers are reaching out to these individuals through phone calls and text messages, posing as FTC agents who claim they can help recover lost funds. To lend credibility to their claims, they often send photos of fake agency badges.
The common thread among these targets is that they have already lost money to a scam. Research from the Identity Theft Resource Center (ITRC) reveals that 25.6% of identity crime victims are managing two or more incidents simultaneously. Furthermore, the report indicates that 62.1% of attempted identity misuse cases involve new account applications.
Scammers maintain detailed records of their victims, including who has previously paid, what methods were effective, and the amounts lost. This information allows them to turn a single incident of fraud into a prolonged cycle of repeat identity theft.
According to the FTC, this repeat targeting often manifests as fake recovery offers. The scammers already possess knowledge about the victim’s previous losses and claim they can assist in recovering the funds. However, they typically request a retainer, processing fee, or sensitive personal information, which can lead to further financial loss.
The FBI’s Internet Crime Complaint Center has also highlighted that fictitious law firms are preying on cryptocurrency scam victims, offering fake recovery services that exploit the emotional and financial distress experienced after a loss.
Scammers use what the FTC refers to as “sucker lists,” which contain a victim’s name, address, phone number, type of scam, and the amount paid. These lists are bought and sold among criminals who believe that someone who has already paid once may be willing to pay again. The same group may reach out with a new story, or they may sell the information to another scammer who employs a different tactic.
This familiarity with the victim’s situation makes recovery scams particularly convincing. A caller who knows the specifics of your loss may seem legitimate, but that information is often sourced from a list, designed to build trust.
Unlike credit cards, which can be replaced quickly, a stolen Social Security number (SSN) poses a more significant challenge. When a thief opens an account using your SSN, birthdate, and address, simply canceling the account does not resolve the issue. The stolen information can still be exploited in various ways, such as drawing a paycheck under your name, filing a tax return before you do, or opening a loan at an unfamiliar bank.
Ongoing monitoring of your personal information is crucial. Services like Aura scan the dark web and over 200 data broker and people search sites for exposed SSNs, driver’s license numbers, and email addresses, alerting you when your information appears.
Most identity fraud cases involve new accounts, such as credit cards, loans, or financial accounts opened in your name at unfamiliar companies. The ITRC’s 2026 report indicates a rise in layered identity crimes, with more than a quarter of victims managing multiple incidents simultaneously, up from 23.5% the previous year.
Regular credit checks may not be sufficient, as a report pulled every few months might miss an account opened shortly after your last check. Aura monitors all three major credit bureaus and can alert you within minutes of new accounts or hard inquiries reported to your file, even if a freeze is in place.
To protect yourself from being scammed again, it is essential to recognize warning signs and take proactive steps. The FTC advises against paying anyone upfront to recover lost money, as legitimate government agencies and organizations do not charge fees for recovery services. They also do not request sensitive information like bank account numbers or Social Security numbers.
Scammers often instruct victims to pay via gift cards, cryptocurrency, wire transfers, or payment apps—methods that legitimate refund processes do not use. Be wary of callers who seem to know specific details about your losses, as they may have acquired that information from a list.
Fake recovery firms may direct you to messaging platforms like Telegram or WhatsApp, requesting your email and phone number before explaining any services. They may also ask you to install remote access software or share verification codes, which should be avoided.
Additionally, bogus recovery firms often create fake testimonials, websites, and press releases that rank high in search results. Always verify a company’s legitimacy through official channels before engaging with them.
If you receive a suspicious recovery offer, report it to the FTC at ReportFraud.ftc.gov. For scams involving cryptocurrency, fake law firms, or online fraud, report them to the FBI’s Internet Crime Complaint Center at IC3.gov.
While credit monitoring services are often offered for free after a data breach, stolen records can remain valuable to criminals long after the initial alerts expire. A leaked SSN does not have an expiration date.
No service can guarantee complete prevention of identity theft, but ongoing credit monitoring can alert you to new accounts as they are reported, rather than weeks later when you are denied credit or receive a collections notice.
Identity theft protection services can also assist you in responding quickly, guiding you through fraud reports, credit bureau disputes, account recovery steps, and the necessary documentation to repair any damage.
Being scammed once can place you on a list that follows you long after the initial fraud ends. The next scam may come with details that sound personal and convincing, but that does not make the caller, texter, or recovery firm legitimate. The best course of action is to remain vigilant, never pay upfront for recovery services, and always verify contact information independently.
For more information on identity theft protection, visit CyberGuy.com.