Home › Knowledge Hub › Why victims are targeted again
Why crypto scam victims are often contacted again
If you have been scammed and are now getting messages offering help, investigations, or recovery, you are experiencing secondary targeting, and it is deliberate. After a loss your details often end up on a list, held by the original scammers or sold between fraud crews, because someone who has just lost money is the most receptive target for a second scam. The single most important thing to know: being contacted is itself the warning sign, because genuine help does not arrive unsolicited.
The uncomfortable truth
Many people assume that if someone contacts them about their lost funds, it means their case has been noticed, an investigation has begun, or help has found them. The opposite is usually true. A second approach after a scam is not a sign your case is progressing; it is a sign you have been identified as a repeat target.
Understanding why this happens makes the second scam far easier to resist, because once you see the mechanism, the "how did you know about my case?" that makes these approaches feel legitimate stops working.
Why you are on a list
Your details can reach a second scammer through a few routes. The original scammers keep records of who paid and may return themselves, or sell your information on. Lists of victims are traded between fraud operations precisely because recent victims convert well. And details you shared publicly, a complaint on a forum, a post in a support group, a review, can be scraped by people watching for exactly that.
The result is that the second scammer often knows real things about you: which platform you used, roughly how much you lost, sometimes your name or wallet address. That knowledge is not proof they are legitimate. It is the product they bought.
Why knowing details does not prove legitimacy
This is the lever the whole second scam pulls. When a caller knows your case, your instinct is to trust them, because how else would they know? But the details came from the same ecosystem that scammed you. A real investigator or agency contacting you would be the exception; a scammer who bought your information is the rule. Treat specific knowledge of your case as neutral at best, and as a red flag when it arrives unsolicited.
The disguises the second approach wears
The second scam dresses up in whatever role sounds most credible for your situation. The thread connecting all of them is that each ends with money or access flowing from you.
Common disguises include a recovery agent or investigator who can get your funds back for a fee; a lawyer or compliance officer citing a credential that turns out to be a free registration; an exchange "support" or "fraud" team that contacts you first; a regulator or tax office saying a payment is needed to release recovered funds; a hacker offering to retrieve your crypto; and even a victim-support group that is a funnel for the same fraud. Our guide on what to do after a recovery firm contacts you covers the response, and how to spot a recovery scam covers the detection checklist.
The "new fee" ladder
However the approach begins, it tends to converge on the same structure: a sequence of fees. First a small retainer or "verification" fee. Then a "tax", a "release fee", an "insurance deposit", an "unlock" payment. Each is framed as the last one, and each exists only to extract the next. No legitimate recovery works by asking a victim for an escalating series of upfront payments. The moment a fee appears before anything is recovered, the approach has told you what it is.
Digital hygiene after a scam
You cannot remove yourself from every list, but you can reduce your exposure and harden your accounts.
Lock down your accounts. Change passwords and turn on app-based two-factor authentication, starting with your email, in case the first scam exposed credentials.
Be careful what you post publicly. Detailed public accounts of your loss, especially with contact details or amounts, are harvested by second scammers. Share what helps others in a way that does not hand a scammer a script about you.
Tighten your privacy settings on social media, and be cautious about new connection requests and direct messages in the weeks after a loss.
Consider changing a number or email only if it is being heavily targeted; this is a bigger step and not always necessary.
Expect the approach, and pre-decide your response: you will not engage, you will not pay, and you will verify anything independently.
How to respond without escalating
When a second approach arrives, the safest handling is also the simplest.
Do not engage. Replying, even to argue or ask questions, confirms you are a live, responsive target and invites more.
Do not pay anything, and do not share credentials or grant remote access.
Preserve it. Screenshot the message, the account, and any details, using our evidence checklist, in case it supports a report.
Report and block. Report the approach through official channels and block the account. Then carry on expecting that others may follow.
Red flags
- Any unsolicited offer of help, recovery, or investigation after a loss
- A contact who knows details of your case and uses that to build trust
- A fee of any kind requested before anything is recovered
- A role chosen to sound authoritative: investigator, lawyer, regulator, exchange support
- Pressure to act quickly or keep it confidential
- A request for passwords, recovery phrases, codes, or remote access
What this guide cannot do
It cannot take your details off the lists they are already on, and it cannot stop the approaches from coming. What it can do is explain why they come, so the "but they knew about my case" that makes them convincing loses its power, and give you a settled response, do not engage, do not pay, verify independently, that holds no matter how the next one is dressed.
This is general information, not legal or financial advice.
Use Chain Pursuit's free tools to weigh an approach and to identify possible recovery scams. Do not share your seed phrase or private keys with anyone.
Sources
Federal Trade Commission, Told You Can Recover Your Lost Money? It's a Scam. https://consumer.ftc.gov/consumer-alerts, on recovery scams that deliberately target people who have already lost money, and the upfront-fee warning.
Federal Bureau of Investigation, Internet Crime Complaint Center, Public Service Announcements on Recovery / Refund Fraud. https://www.ic3.gov/Media, on fraudsters re-victimising prior victims and impersonating investigators and agencies.
The trade and reuse of victim contact lists is widely documented by consumer-protection and law-enforcement agencies; the direction-of-contact principle follows from it. Reviewed quarterly.
Frequently asked questions
How did a recovery scammer get my number or email?
Usually from a list. The original scammers keep records of who paid and may sell them, lists of victims are traded between fraud crews, and details posted publicly in complaints or support groups get scraped. The contact is targeted because recent victims are receptive, not because your case was noticed.
The person who contacted me knows my wallet address and how much I lost. Doesn't that prove they're real?
No. That information came from the same ecosystem that scammed you, bought or scraped, so knowing it is not proof of legitimacy. Treat specific knowledge of your case as neutral at best, and as a warning sign when it arrives in an unsolicited offer of help.
Should I reply to someone who says they found my funds?
No. Do not engage at all. Replying, even to ask questions, confirms you are a live, responsive target and invites more approaches. Preserve the message as evidence, report it, and block the account instead.
Why does the fee keep changing or increasing?
Because the fee is the scam. These approaches run a ladder: a retainer, then a tax, then a release or unlock fee, each framed as the last. No legitimate recovery asks a victim for an escalating series of upfront payments. The appearance of any fee before recovery is the signal to stop.
Can I remove my details from scam lists?
Not reliably; once information is traded it is effectively out there. What you can do is reduce further exposure, lock down your accounts with app-based two-factor, tighten privacy settings, avoid posting detailed public accounts of your loss, and pre-decide that you will not engage with unsolicited approaches.
What's the safest way to handle the second approach?
Do not engage, do not pay, and do not share credentials or grant access. Preserve the message and account as evidence, report it through official channels, and block it. Then expect that others may follow and handle them the same way.
Been contacted after a loss?
Eleven questions to help you weigh an approach before you respond to it.
Check my case