A consumer survey found that scam victims often face shame, financial loss, and difficulty getting help after an attack. The report also describes recovery scams, in which third parties charge victims while promising to recover stolen money, repair credit, or catch the scammer.
Survey data described in this report shows a pattern where identity theft and scam victims are targeted a second time. After an initial scam, some victims are approached by third parties who promise to recover stolen money, repair damaged credit, or identify the original scammer. These services typically charge a fee upfront, and the report identifies them as recovery scams because the promised outcomes are not delivered. Among the consumer group studied, 78.9% paid a fee to a third party promising to recover stolen money, fix their credit, or catch the scammer.
The report points to shame and self-blame as major factors in why victims struggle after a scam. More than half of surveyed victims who contacted the ITRC reported feeling ashamed or embarrassed, and many said organizations they reached out to made them feel the incident was their fault. This emotional burden, combined with the financial pressure of unrecovered losses, some reported at $100,000 or more, can make a recovery offer feel like a lifeline even when it carries risk. The report also found that 87.9% of scam victims in the general consumer group said they sought help from an organization but received no response, which may push some toward paid third parties instead.
The awareness takeaways in this report emphasize treating unsolicited recovery offers with caution, especially when a fee is requested upfront. They also stress that shame should not prevent someone from reporting a suspected scam to a trusted bank, payment provider, or verified support organization. Respondents who avoided scams often cited sensing something was wrong, recognizing a tactic from consumer education, or receiving a warning from a bank or payment app. Nearly half of respondents said they had nearly shared information or sent money in a scam but stopped before doing so, which suggests that a pause to verify a request, paired with awareness training and trusted financial-provider warnings, can be an effective way to interrupt both the original scam and any follow-on recovery scam attempt. Organizations supporting employees who handle personal or financial information, including finance, HR, and customer support staff, can reinforce these habits through ongoing awareness efforts.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
A recovery scam is when a third party charges a fee and promises to recover stolen money, repair a victim's credit, or catch the original scammer, without delivering those results.
Many victims feel shame and self-blame, struggle to get help from the organizations they contact, and are motivated to try anything that offers a chance of recovering their losses or fixing their credit.
Be cautious of any unsolicited offer that asks for payment before delivering results, especially when it promises to recover stolen money, repair credit, or identify a scammer.
Pause before sending money or sharing information, trust warnings from banks or payment apps, and report the suspected scam to a trusted organization rather than staying silent out of shame.
Lost money to a scam? The next offer could be another scam. It's called a recovery scam. Someone offers to get your money back, fix your credit, or catch the scammer. Then they ask for a fee. Here's the tell: you're being asked to pay before anything is recovered. In one survey group, 78.9% paid a third party making these promises. Feeling embarrassed is common. Don't pay the recovery fee. Contact your bank using the number on your card.
ESET reports that North Korea-aligned Lazarus actors resumed using recruitment-themed social engineering to target the drone sector. A related North Korea-aligned operation, DeceptiveDevelopment, shifted from fake job interviews to compromising software supply chains by stealing developer…
Retailers face a peak-season gift-card fraud campaign in which attackers use phishing emails and text messages to trick employees into giving up credentials. After gaining access, the attackers use cloud systems and sensitive data to issue unauthorized gift cards at scale and convert them into…
INTERPOL’s Operation Serengeti III led to 1,462 arrests across 21 countries and disrupted fraud, ransomware, business email compromise and other cybercrime operations. One major case involved rotating call centers that used scripted investment pitches, fake trading platforms and fraudulent websites…
Threat actors are hijacking existing email conversations, or patiently starting new ones, to build trust before sending a malicious reply. The final message commonly poses as a meeting invitation, secure message, shared file, or important document and leads to credential theft or remote-access…
Proofpoint described real campaigns where attackers used highly tailored, AI-style messages to make phishing and payment fraud requests appear routine. Examples included property enquiries that led to malicious meeting invitations, device-code phishing pages disguised as business services, and fake…
A scammer allegedly used Amanda Smith’s personal information to open a Cash App account and receive $1,000 from a buyer tricked by a fraudulent Facebook Marketplace listing. The case shows how an account takeover, fake sale, and identity theft can leave both the buyer and the person whose identity…
