$5.7B
FTC-reported investment scam losses in 2024
FTC says investment-related scams caused the biggest reported losses in 2024, creating a large pool of victims that recovery scammers target afterward.
Stolen phone data recovery scam
A victim of phone theft finds a service claiming it can recover iCloud, photo, or wallet access in exchange for credentials.
“refund scam”
↑ 57%Key indicators
Usually targetsPhone theft victims
Often hitsFreelancers and contractors
Common regionGlobal
Last updated2026-04-03
Estimated impact
$5.4K
median reported loss
Typical range$900 – $54K
Recovery rate~2%
Annual reports14,000
Scam breakdown
1
Attackers monitor public complaint channels, hacked-account posts, and victim communities.
2
They position themselves as the fast path to getting money, access, or accounts back.
3
The victim is charged again or loses remaining access while already emotionally vulnerable.
What to do first
Use official device recovery channels and rotate credentials instead.
Related terms
phone recovery data scamdevice restore fraudRecovery fraudTelegramRisingPhone theft victimsTravelersFreelancers and contractorsTech workers and developersNonprofit and charity workersGlobalphone recovery data scamdevice restore fraud
Real-world example
How this scam plays out in practice
Based on reported patterns. Names and details are illustrative.
The setup
James, 35, a phone theft victims, encountered what appeared to be a legitimate recovery fraud situation while using Telegram. Attackers monitor public complaint channels, hacked-account posts, and victim communities.
Step 2
What happened next was calculated: They position themselves as the fast path to getting money, access, or accounts back.
Step 3
The pressure escalated quickly: The victim is charged again or loses remaining access while already emotionally vulnerable.
The outcome
James realized something was wrong when the service requests account passwords or recovery codes.. By that point, significant damage had already been done — money sent, personal information shared, or trust exploited.
The lesson
Use official device recovery channels and rotate credentials instead. James's experience shows why the service requests account passwords or recovery codes. and the recovery expert or lawyer contacts the victim before being hired. are the clearest early warning signs.
How to identify it
- The service requests account passwords or recovery codes.
- The recovery expert or lawyer contacts the victim before being hired.
- Upfront fees, wallet access, passwords, or remote access are required.
- Assume any unsolicited recovery outreach is suspicious, especially if it mentions your earlier loss without you contacting them first.
- A legitimate recovery path does not require you to hand over a wallet seed phrase, remote access, or another upfront recovery fee.
- Treat fake investigators, fake lawyers, and blockchain tracing promises as part of the same scam chain unless you independently verify the firm or authority.
What to do now
- ✓Use official device recovery channels and rotate credentials instead.
- ✓Assume unsolicited recovery outreach is fraudulent until proven otherwise.
- ✓Use only official support, bank, exchange, or complaint channels for recovery steps.
What to save before reporting
- ✓Keep the original wallet addresses, transaction hashes, case numbers, screenshots, and complaint confirmations from the first scam.
- ✓Save the recovery pitch, expert name, domain, chat handle, and any fee quote or contract.
- ✓Do not move or consolidate remaining funds until you understand the real reporting or recovery path.
- ✓Save the full chat or call log before blocking the sender so the reporting path still has the original context.
- ✓Keep wallet addresses, transaction hashes, and exchange or payment-app identifiers before you move remaining funds.
How big is this problem
You are not alone — this scam affects millions of people.
These numbers come from government agencies and official reports. If you have been affected, know that this is a widespread problem — not something that only happens to careless people.
FTC 2024 fraud losses
$9.9M
Recovery room scam losses in Canada (2023)
The Canadian Anti-Fraud Centre says losses tied to recovery room scams reached $9.9 million in 2023.
118,960
Reported investment-related reports in 2024
FTC's Consumer Sentinel Data Book lists 118,960 investment-related reports in 2024.
History and evolution
- Recovery scams are a second-wave fraud. They target people after a first loss, often by watching public complaint posts or social media.
- This pattern has become more organized as crypto losses and online investment scams create a steady stream of emotionally vulnerable targets.
- Recovery scams cluster wherever victims publicly describe the first loss.
Recovery and follow-up
- ✓Save the messages, receipts, account alerts, and transaction details before you block or delete anything.
- ✓Report the scam through the official platform or government channel that best matches where it happened.
- ✓If crypto or online investments were involved, move any remaining funds only through the official wallet or exchange controls you already trust.
- ✓Use official device recovery channels and rotate credentials instead.
- ✓Assume unsolicited recovery outreach is fraudulent until proven otherwise.
Why this pattern keeps working
Recovery scams are second-order scams: they target people after a first loss, when urgency and hope are highest.
Scammers often scrape victim forums, social replies, or public complaint threads so the outreach feels specific and credible.
Recovery scams cluster wherever victims publicly describe the first loss.
Expanded launch family for secondary fraud after an initial loss.
Where to report it
If you have been targeted by this scam, reporting it helps authorities track the pattern and protect others. Global has dedicated agencies that handle fraud reports.
Report cross-border scams
econsumer.gov (ICPEN)
International Consumer Protection and Enforcement Network portal for reporting cross-border online scams. Reports are shared with consumer protection agencies in 40+ countries.
Interpol financial crime guidance
Interpol
International policing guidance on online financial fraud, romance scams, and investment fraud operating across borders.
Report phishing emails
Anti-Phishing Working Group
Global industry coalition for reporting phishing emails and URLs. Forward phishing to [email protected].
Explore further
Understand the bigger picture
Who is most at risk
Who this scam targets
Primary targets
Phone theft victims, Travelers
Geographic concentration
Global
Primary channel
Telegram — Recovery fraud
Why this group is vulnerable
Phone theft victims are particularly vulnerable because this scam exploits trust in familiar brands, authority figures, and time-sensitive decisions. The growing number of reports suggests that awareness among this demographic remains low.
Sources and methodology
How we verify this information
OpenScam tracks scam patterns using a combination of government consumer protection databases (FTC, IC3, Action Fraud), platform-specific fraud reports, and verified consumer complaint data. Each entry is cross-referenced against at least two independent sources before publication.
Severity ratings are based on financial impact potential, reversibility of damage, and volume of reports across multiple reporting channels. Trend velocity reflects the rate of change in report volume over the most recent 90-day window.
This page was last verified on 2026-04-03. Red flags, recovery steps, and reporting resources are reviewed quarterly against current agency guidance.
Evidence and indicators
- Recovery scams cluster wherever victims publicly describe the first loss.
Source notes
- Expanded launch family for secondary fraud after an initial loss.
Frequently asked questions
Common questions about stolen phone data recovery scam
How does the stolen phone data recovery scam work?+
Attackers monitor public complaint channels, hacked-account posts, and victim communities. They position themselves as the fast path to getting money, access, or accounts back. The victim is charged again or loses remaining access while already emotionally vulnerable.
What are the warning signs of stolen phone data recovery scam?+
The service requests account passwords or recovery codes. The recovery expert or lawyer contacts the victim before being hired. Upfront fees, wallet access, passwords, or remote access are required.
What should I do if I encounter stolen phone data recovery scam?+
Use official device recovery channels and rotate credentials instead. Assume unsolicited recovery outreach is fraudulent until proven otherwise. Use only official support, bank, exchange, or complaint channels for recovery steps.
Who is most at risk for stolen phone data recovery scam?+
This scam primarily targets Phone theft victims, Travelers. It is most commonly reported in Global and typically appears on Telegram.
Is stolen phone data recovery scam on the rise?+
Stolen phone data recovery scam is currently on the rise with growing reports. It has been reported across Global. Last updated 2026-04-03.
Related scams
Similar scams to watch out for
Recovery fraud
↑ 41%Crypto recovery agent scam
After a person loses money in crypto, a second scam appears claiming funds can be recovered for a fee or wallet access.
What to do first
Assume unsolicited recovery outreach is fraudulent.
Targets
Previous fraud victims
Seen in
Global
Travel fraud
↑ 54%Travel booking message hijack scam
A traveler receives a realistic property or booking message that requests off-platform payment, identity verification, or a new deposit.
What to do first
Keep all communication and payment inside the booking platform.
Targets
Travelers
Seen in
Europe
Employment fraud
↑ 80%Freelance project unlock fee scam
A freelancer wins a project but is told they must buy a platform license, ID badge, or portfolio review to start.
What to do first
Do not buy access tools or badges to start freelance work.
Targets
Freelancers
Seen in
Global
Help someone avoid this scam.
Scammers succeed because people do not talk about it. If you or someone you know has been affected, there is no shame in it — it happens to millions of people every year. Share this page with friends and family so they know what to look for.