Recovery Room Scams: The Second Theft Begins When the Victim Starts Looking for Help

Recovery room scams are the fraud economy's aftermarket. Once a person has lost money to an investment scam, a romance fraud or an authorised push payment scam, their details begin to circulate as a commodity, and a second set of criminals arrives promising to get the money back for an upfront fee. The FCA's consumer guidance on recovery room scams, updated as recently as January 2026, is blunt about the mechanics: the people behind the original scam may run the recovery room themselves, or they sell the victim's details on to others who will.

TrustSphere's house view is that the industry has this problem categorised wrongly. Most banks treat a scam as an event: it is reported, investigated, reimbursed or declined, and then closed. The evidence says a scam is a state. A customer who has been defrauded once is the most predictable target on the book for the following twelve months, because their name now sits on a list that is traded precisely because it converts. Yet very few institutions run any post-fraud control regime that treats the victim as a live risk rather than a closed case.

That gap matters commercially as well as morally. The second loss is frequently larger than the first, it often lands on a customer the institution has already made whole once, and it moves through payment rails the institution controls and can see. In our view the recovery room is the most preventable scam typology in circulation, because the population at risk is small, already known to the institution, and identifiable in advance. The rest of this piece explains why we hold that view and what both sides of the payment should do about it.

A market built on victim lists

The scale of the impersonation layer alone is documented by the regulator being impersonated. In August 2025 the FCA reported 4,465 reports of fake FCA scams in the first half of 2025, with 480 people handing over money; across the whole of 2024 there were 10,379 reports and 991 people who paid. Almost two thirds of the 2025 reports came from people aged 56 or over. The methods the FCA describes are recovery room methods: claims that the regulator has recovered funds from a crypto wallet opened in the victim's name, offers to help loan scam victims get their money back, and fraudsters posing as the FCA to revictimise people already groomed through long-term investment scams.

Nor is this a British peculiarity. In July 2026 the FBI's Internet Crime Complaint Center published an updated public service announcement on criminals impersonating the IC3 itself: fake FBI agent personas contacting complainants through Facebook Messenger and Telegram, links to supposedly update a filed complaint, and AI-generated video of a senior FBI leader directing victims to a spoofed complaint website built to harvest personal information. The IC3 states plainly that it never charges to recover lost funds. When criminals are impersonating the very channel victims use to report fraud, the recovery room has become a fully industrialised second-wave business, not an opportunistic afterthought.

The typology, step by step

Step one: list acquisition. The recovery room starts with data, not deception. Victim details come from the original scam operation, from resale between crews, or from scraping public complaint forums where victims describe their losses. The FCA notes that a fraud report can only be shared between law enforcement agencies, so any cold caller who already knows the details of a loss has obtained them illegitimately. That single fact is the cleanest tell in the whole typology.

Step two: credibility construction. The approach arrives dressed as authority: a fund recovery firm, a law firm, a claims specialist, or the regulator itself. Clone firms are the workhorse here. The FCA warns that fraudsters reuse the name, firm reference number and address of genuinely authorised firms, with professional websites altered only in the contact details. Webmail sender addresses are a recurring giveaway; the FCA, government bodies and law firms do not contact consumers from them.

Step three: the hook. The caller claims the money has been located: frozen in a wallet, held by a court, recovered in a raid. Specific, checkable-sounding detail is the point, because it explains why only this firm can release the funds.

Step four: the fee ladder. Release requires an upfront payment, described as a tax, a solicitor's fee or an administration charge. Each payment surfaces a further obstacle and a further fee. The FCA warns that cumulative losses at this stage can exceed the original loss.

Step five: harvest and resale. Alongside the fees, the victim supplies identity documents, account details and card data, which feed account takeover and the next resale of the list. The cycle then restarts with a new firm name.

What our engagement data shows

TrustSphere's own engagement data, from fraud operations reviews we conducted across client institutions in the first three quarters of 2026, puts rough numbers on the exposure. Roughly one in six reimbursed APP scam victims in the case files we sampled attempted an outbound payment within six months that matched a recovery-fee pattern: a new payee, a round amount, and a claims, legal or recovery narrative in the payment reference or the subsequent dispute. Fewer than one in ten of the send-side institutions we assessed carried any post-fraud flag that influenced payment screening at all. These are our figures from our engagements, directional rather than a population estimate, but the direction is not ambiguous.

The TrustSphere RiskTech Index tells the same story from the vendor side. Across the scam-control vendors we scored in the April 2026 cycle, overall scores sat between 5.8 and 7.2 against an index mean of 6.06, yet capability scores for post-victimisation monitoring specifically clustered between 3 and 4 out of 9. The market builds tools to stop the first scam. Almost nobody builds for the second.

The send side and the receive side

Send-side banks hold the decisive advantage: they know who their victims are. A post-fraud marker should persist on the customer record for at least twelve months and should change the payment journey, not just sit in a case system. A flagged customer paying a new payee with a recovery, legal or tax narrative warrants targeted friction and a scripted human conversation, not a generic warning screen. The cheapest intervention of all is at reimbursement: tell the customer, explicitly, that they will be contacted by people offering to recover the money, that the FCA never asks for payment, and that any caller who knows about the loss has bought that knowledge.

Receive-side institutions see the other half of the pattern. A recovery room's collection account looks distinctive: a new or recently dormant account suddenly receiving low-value credits from unrelated consumers across the country, followed by rapid onward dispersal. Inbound monitoring tuned for mule typologies should treat that shape as presumptively suspicious rather than waiting for the first repatriation request, and when such a request arrives, speed of response determines whether anything is left to return.

What this means around the table

Tier 1 banks carry the data and the obligation. Having reimbursed the first loss, they are economically exposed to the second, and they are the only party holding both the victim flag and the outbound payment in one place. Treating revictimisation as a managed customer state is an efficiency argument, not only a Consumer Duty one.

Challengers and fintechs sit disproportionately on the receive side. Fast remote onboarding makes them the natural home for fee-collection accounts, and inbound detection maturity, not outbound, is where their recovery room exposure concentrates.

Payment service providers and acquirers touch the typology where fake recovery and law firms take card payments for fees. Merchant onboarding for claims and recovery propositions deserves the same scepticism as high-risk investment merchants, including verification against the FCA register, since these services require authorisation to be offered in the UK.

Regulators are now impersonated infrastructure. The FCA's decision to publish report volumes is the right instinct: the scale data makes warnings concrete, and the Firm Checker gives consumers a verification path that costs nothing.

Consumers and victims need one message repeated at every contact point: no legitimate body charges upfront to recover scam losses, and anyone who already knows about your loss did not learn of it lawfully.

The conclusion we keep reaching

Recovery rooms thrive in the space between a closed fraud case and an open customer relationship. Closing that space requires no new technology, no regulatory change and no industry utility: a persistent victim marker, a handful of payment-journey rules, an inbound mule typology, and a sixty-second conversation at reimbursement. The institutions that do this will cut a category of loss that is otherwise growing on the back of every successful scam that precedes it. The second theft is the one the industry can actually see coming.

Suggested Next Steps

• Introduce a twelve-month post-fraud customer marker that actively conditions outbound payment screening, friction and staff scripts, and test it against historic revictimisation cases.

• Add a scripted warning about recovery approaches to every scam reimbursement and case-closure contact, including the specific fact that the FCA never requests payment to recover funds.

• Build an inbound detection rule for fee-collection typologies: new or dormant accounts receiving dispersed low-value consumer credits with recovery, legal or tax references, followed by rapid outflows.

• Verify any claims management or fund recovery merchant or payee against the FCA register and Warning List before onboarding or first payment, and exit relationships that fail the check.

Sources: FCA consumer guidance on recovery room scams; FCA press release on fake FCA scam reports, August 2025; FBI IC3 public service announcement I-072026-PSA, July 2026; TrustSphere Risk Index, April 2026.

Companion vendor assessment: today's TrustSphere Risk Index post assesses Allure Security against this problem. Read it at www.trustsphere.ai

TrustSphere helps financial institutions design and deploy intelligent fraud and financial crime detection solutions. Visit www.trustsphere.ai