"We Can Recover Your Lost Money" — How Recovery Scams Target Victims a Second Time

Recovery scams promise to get your lost money back — but they're designed to steal from you a second time. Learn how to recognise this cruel tactic and protect yourself.

What Is a Recovery Scam?

Losing money to a scam is already devastating — financially, emotionally, and sometimes even physically. But there is a particularly cruel follow-up scheme that targets people who have already been defrauded: the recovery scam. In a recovery scam, a fraudster contacts a prior victim and claims to be a specialist, lawyer, government agent, or recovery firm that can retrieve the money that was lost. They charge upfront fees, collect personal information, and then disappear — leaving the victim worse off than before. This pattern of second-wave victimisation is well-documented in the recovery scam Philippines landscape, and it affects victims of investment fraud, online selling fraud, romance scams, and more. Understanding how this scheme works is the first and most powerful step toward not falling for it again.

How Scammers Find Their Victims a Second Time

You might wonder: how does a recovery scammer even know I lost money in the first place? The answer is more straightforward than it seems. Scam operators often sell or share lists of their previous victims — sometimes called "sucker lists" — with other criminal networks. If you posted about being scammed in a public Facebook group or forum, fraudsters monitor those conversations actively. Some recovery scammers pose as helpful community members before privately messaging victims. Others purchase data from breaches or scrape contact details from complaint pages and scam-reporting websites. The moment you become a known victim, you can become a target again. This is why protecting your personal details even after a scam — especially your mobile number, GCash or Maya account details, and your full name — remains critically important. You can always learn more about common scam types to understand the broader fraud ecosystem these operators work within.

The Classic Recovery Scam Script

Recovery scammers follow a surprisingly consistent script. They typically open with empathy — "We know you've been through a lot" — before pivoting quickly to a pitch. They may claim to represent the PNP-ACG (Philippine National Police Anti-Cybercrime Group), the NBI Cybercrime Division, the BSP, or an international recovery firm. Some even fabricate official-looking documents, case numbers, or email addresses that mimic government agencies. The scheme then follows a predictable path: they say they have already located your funds and just need a small fee to "release" them. That fee might be called a processing charge, a government tax, a transaction clearance fee, or a legal retainer. Once paid, they either vanish entirely or invent further fees to keep draining you. If any stranger contacts you claiming they can recover your funds, treat that contact as suspicious immediately. Running a free scam check on TsekMuna on the number, email, or account name they use can help you verify whether others have flagged the same contact.

Warning signs

• They contact you out of nowhere — you never approached them first.
• They claim to represent the PNP-ACG, NBI, BSP, or a foreign law enforcement body but cannot provide verifiable credentials.
• They produce official-looking documents with logos, stamps, or case numbers that feel rushed or slightly off.
• They ask for an upfront fee before any money is returned — described as a "processing fee," "release tax," "clearance charge," or "legal retainer."
• They insist on payment through GCash, Maya, cryptocurrency, or remittance services rather than official channels.
• They pressure you to act fast, saying your "window" to claim the funds is closing.
• They ask for your GCash or Maya account PIN, OTP, or full banking credentials.
• They promise a specific peso amount they claim is waiting for you.
• Communication happens exclusively on Viber, Telegram, or WhatsApp — never through a verifiable official address.
• Their social media accounts or websites were created very recently and have few followers or reviews.

Why Victims Fall for It — And Why That's Completely Understandable

It is important to say this clearly: falling for a recovery scam does not mean you are foolish or careless. These operations are professionally run, psychologically sophisticated, and deliberately designed to exploit the exact emotional state that follows a financial loss — desperation, shame, and a desperate hope that things can be made right. Scammers study human behaviour and they know that a grieving victim wants to believe help is possible. They use the right terminology, mimic the right institutions, and apply just enough pressure to push you toward a quick decision before your rational mind can catch up. The shame many victims feel also makes them reluctant to tell family members or friends, which isolates them further and makes them easier to manipulate. If you or someone you care about has been targeted twice, please know there is no judgment here — only practical guidance on what to do next.

Step-by-Step: What to Do If You're Contacted by a Recovery Scammer

Taking calm, deliberate steps right after contact is the best way to protect yourself and potentially help others avoid the same trap. Knowing how to report a scam properly ensures your information reaches the right authorities and may assist ongoing investigations.

1. Stop all communication immediately. Do not pay any fee, share any account details, or send any OTP — even if they claim a deadline is approaching.
2. Screenshot everything. Save all messages, profile photos, account names, email addresses, and any documents they sent you before blocking them.
3. Verify independently. If they claim to represent PNP-ACG, NBI, or BSP, look up those agencies' official contact details yourself (via .gov.ph websites) and call directly to confirm whether any such case or agent exists.
4. Check the contact details. Run the phone number, email, GCash number, or account name through TsekMuna to see whether the community has already flagged it.
5. Report to PNP-ACG. File a complaint at the official PNP Anti-Cybercrime Group portal or visit their office. The more reports they receive on a particular scheme, the faster they can act.
6. Report to the NBI Cybercrime Division. You can submit a complaint online or in person. Bring your screenshots and any transaction records.
7. Notify your bank, GCash, or Maya. If you sent money or shared account details, contact your e-wallet provider's official fraud helpline immediately to freeze or flag the transaction.
8. Tell someone you trust. Breaking the isolation is crucial — a family member or friend can help you stay grounded and support you through next steps.
9. Join a community of awareness. Share your experience (without personally identifying anyone) in reputable consumer-protection or scam-awareness groups so others can be warned.

Real government agencies and legitimate financial recovery lawyers in the Philippines will never ask for payment via GCash, Maya, or cryptocurrency as a precondition for returning your funds. That payment method alone is a definitive red flag.

How Recovery Scammers Impersonate Legitimate Institutions

One reason recovery scams are so convincing is the level of impersonation involved. Fraudsters create Facebook pages that look like official PNP-ACG or NBI accounts, complete with copied logos and professional-sounding posts. They send emails from addresses like "pnp-acg-recovery@gmail.com" — which, of course, is just a free Gmail account with a convincing name. They may even share fabricated screenshots showing "your funds" sitting in a holding account, ready for release upon payment. In some cases, they conduct fake video calls using pre-recorded footage or AI-generated faces to simulate a government official verifying your case. The BSP and legitimate banks will always communicate through their registered channels and will never initiate contact asking you to pay a fee to receive money. If you are ever unsure about a message that appears to come from a financial institution, contact that institution directly through their verified hotline — never through contact details the stranger provided.

Protecting Yourself Going Forward

Recovering from a scam — emotionally and financially — takes time, and protecting yourself during that vulnerable period is essential. A few enduring habits can significantly reduce your risk of being targeted again. First, be very careful about what you share publicly: posting detailed accounts of your losses on open forums can attract recovery scammers who trawl those spaces. Second, be sceptical of any unsolicited contact that references your previous experience — legitimate agencies do not typically cold-call victims. Third, consult a real lawyer or a BSP-accredited financial adviser if you want to explore legitimate legal options for recovering funds; a genuine professional will meet you in person, have verifiable credentials, and will not demand payment through informal channels. This guidance is advisory only and not legal advice. Finally, building your general scam awareness is one of the best long-term defences — our scam education hub covers a wide range of fraud tactics to help you stay one step ahead.

What to do instead

• Keep a private, secure record of all scam-related documents for any future legitimate legal proceedings.
• Set your social media profiles to private or friends-only, especially posts discussing financial losses.
• Enable two-factor authentication on your GCash, Maya, email, and social media accounts.
• Register your number with the National Telecommunications Commission (NTC) SIM registration system to limit anonymous contact.
• Share awareness — not personal loss details — with your community so others stay alert without you having to expose your own information.
• Seek emotional support: the Philippine Mental Health Association and similar organisations offer resources for fraud-related trauma.

How TsekMuna Can Help

TsekMuna exists precisely because scammers rely on victims not being able to quickly verify who they are dealing with. If someone contacts you promising to recover your funds, copy their phone number, email address, or GCash account number and run a free check before you respond further. Community-sourced flags and reports can surface patterns that reveal a scammer's operation even when they are using a new identity. While no single tool can catch every fraud, combining community intelligence with your own careful judgement is a powerful combination.

Run a free scam check · More scam-safety guides