Skip to content

Cybersecurity

$160,000 gone. $15,000 about to follow. How the crypto recovery scam works.

A travel agent's phone call stopped a Perth woman flying to London to hand a scammer $15,000 in person. How the recovery scam works, and how to spot it.

5 min read
Jump to section
  1. 01 First scam: the fake crypto investment
  2. 02 Second scam: the fake recovery firm
  3. 03 The hardest part isn’t the technical detail
  4. 04 What to do if you think you’re being targeted
  5. 05 Video proof, if a relative won’t believe you

I spent the last hour on the phone with a retired woman in Perth, talking her down from sending $15,000 to scammers in the UK. She had already lost $160,000 to them. She was at a travel agency when I reached her, booking flights to London so she could hand the next $15,000 over in person.

The only reason that flight didn’t happen is that the travel agent thought the trip sounded off, called me, and asked for a sanity check. We got to the victim before the booking did.

This is one of the most damaging scam patterns running today, and it runs in two parts. If you have a parent, a grandparent, a client or a customer who could be a target, please pass it on.

First scam: the fake crypto investment

Most people who lose money to crypto recovery scams have already lost money to a crypto investment scam first. The pattern is consistent. It starts with one of three approaches:

  • A cold call from a “broker” with an opportunity that sounds too good to ignore.
  • An email or social-media message from someone with a track record they want to share.
  • Adverts generated by artificial intelligence, featuring a well-known face (Elon Musk is a favourite) endorsing a “guaranteed return” platform.

Once you’re hooked, you make a small investment, maybe $1,000 or $2,000 to “test the waters”. You’re directed to a website that looks like a real trading platform. The numbers tick upwards. Your $2,000 grows to $20,000, then $200,000.

The website is a fake. The numbers are a fake. The platform doesn’t exist. You’re looking at a number on a screen that the scammer can set to anything.

You realise it’s a fake the moment you try to withdraw. There’s always a new reason. The withdrawal window doesn’t open until next Tuesday. The trade failed, try again next month. There’s a tax to pay first. Pay the tax and you’ll get the funds the same day.

That tax is the hook. Your $2,000 is now “worth” $200,000. Pay 2% to release it, just $4,000, and the $196,000 net is yours. So you transfer $4,000. Then there’s another fee. Then a verification deposit. Then a regulatory hold that needs another $10,000 to clear.

Eventually you stop sending money. You write off the loss. You feel ashamed and you don’t tell anyone.

That’s the first scam. You’re now on a list.

Second scam: the fake recovery firm

Six to twelve months later, you get a different call. Different voice. Different organisation. They tell you they specialise in helping people recover money lost to crypto scams. They’ve got your file. They’ve found your funds. In fact, the original $200,000 has appreciated, and is now worth $650,000. They can return it to you.

They just need a transfer fee first. Or a “release tax” of about 3%.

This is the second scam. Same scammers, fresh costume. They know who fell for it the first time, and they know the round number that was lost. They also know exactly how badly you want to make it whole.

This is where I came in for the woman in Perth. She had lost $160,000 in the first scam, written it off, and now believed she was about to recover it. She was about to send $15,000 to a UK address to release the recovered funds. The flight to London was so she could collect the cheque in person, allegedly.

The hardest part isn’t the technical detail

It’s getting the victim to admit they’ve been tricked.

I almost lost her on that call. Not because she didn’t understand what I was saying. Because she didn’t want it to be true. Accepting that the recovery offer is a scam means accepting that the original $160,000 is genuinely gone. And that you fell for two cons in a row.

What worked was patience and proportion. Australia lost around $2.74 billion to scams in 2023, according to Scamwatch. She wasn’t an idiot. She was one of tens of thousands of Australians targeted by an industry. That industry has spent years refining these techniques on people exactly like her. Once she could place herself in that group, rather than as a sole failure, the conversation became possible.

By the end of the call she understood the scam. She didn’t book the flight. She didn’t send the $15,000.

What to do if you think you’re being targeted

Three practical checks are worth sharing with anyone you think might be vulnerable.

No legitimate broker cold-calls you about an investment. None. Not in 2025, not ever. If the contact came to you out of the blue, it’s a scam.

No legitimate withdrawal requires a tax to be paid up front. Tax obligations are owed to the Australian Taxation Office, by you, after you’ve received the money, on your tax return. They are never paid as a condition of release.

No legitimate fraud recovery firm reaches out to you. Recovery firms exist, but you find them, not the other way around. If they call you with news that they’ve located your stolen money, it’s the same scammers.

The “outside opinion” check works. The travel agent in this story was the only reason the call to me happened. If a relative is making a financial decision that feels off, ask them to talk it through with someone they trust. Someone who isn’t part of the deal. Scammers are very good at coaching victims to lie to their family. A neutral third party often breaks the spell.

Report it. Reporting will not recover the money. It does give the National Anti-Scam Centre the data it uses to track and disrupt these operations. Scamwatch is at scamwatch.gov.au. For cybercrime more broadly, ReportCyber is at cyber.gov.au/report.

Video proof, if a relative won’t believe you

The streamer Kitboga has built a public archive of these scams in operation, including extensive coverage of the crypto recovery cycle. Kitboga’s walkthrough of a recovery scam shows how the second call runs. Some people need to see this happening to somebody else before they accept it could happen to them. If that describes your relative, start there.

If you’ve got someone in your life you’re worried about, or if you suspect you’re being targeted yourself, please talk to someone. Family, a trusted friend, a financial adviser you already know, your IT provider. Anyone whose income doesn’t depend on the deal closing.

If you’d like to talk it through with us, get in touch. We won’t bill you for that conversation.

Tags scamscybersecuritycryptofraudawareness
Share LinkedIn Email
See if we're a fit