A Refund Recovery Offer Can Be the Second Scam
Matthew Leo · Published September 13, 2026 · Guides
Someone contacts you after a fraud loss and says they can recover the money. They know the amount, name the original scheme and offer an explanation that finally sounds hopeful. Then they ask for a fee, a transfer or access to your computer.
That is a reason to stop, not evidence that recovery has begun. Information about the first loss can make the second approach persuasive without making it legitimate.
The Canadian Anti-Fraud Centre's recovery-pitch warning describes repeat targeting, advance-fee refunds, remote-access requests and fake law-enforcement operations. It also documents criminals impersonating the CAFC with official-looking letterhead. The warning dates to December 2023; it is not a new September 2026 incident.
Keep the recovery claim separate from the evidence
A useful first test is whether the person is asking you to create a new loss before the old one is resolved. Label each request before considering it:
- Advance payment: A fee supposedly needed to unlock a refund or release recovered funds.
- Account access: A request to install remote-control software or open online banking while another person watches.
- Investigation transfer: Money supposedly required to assist police, test a payment route or participate in an undercover operation.
- Identity material: Documents requested before you have independently established who is receiving them and why.
The CAFC says it and police will never ask you to transfer funds or make a payment of any kind. A badge image or a case number does not cancel that warning.
This is not a claim that every paid legal or investigative service is fraudulent. It is a practical boundary for unsolicited offers that promise recovered money and require you to pay first. Professional services should be independently verifiable, with clear scope and costs, rather than a surprise demand to unlock funds.
Verify outside the conversation
Do not use the caller's transfer to a supposed supervisor as your check. End the conversation. Obtain the organisation's contact details independently and ask whether it made the approach. Describe the request without providing passwords or one-time codes.
If the sender claims to represent your bank, use the bank's app or a number from your card. If it claims to be police, contact the relevant service independently. You are checking the claim through a channel the sender does not control.
Keep a simple note containing the claimed organisation, date, contact address, requested payment destination and deadline. This makes the verification call easier and prevents an urgent conversation from changing the story each time you ask a question.
Do not log in to banking to “prove” your loss during a remote session. A screen-sharing request should not become a substitute for a formal fraud report. A convincing link is not an independent contact channel.
If you have already engaged
Stop additional transfers and contact the payment provider promptly. Ask what protective action is available for the specific payment; do not assume a reversal is possible. Record the reference numbers and instructions you receive.
If you installed remote-access software, end the session and get help securing the device. Use a trusted device to contact financial institutions and change affected credentials. Explain exactly what the other person could see or control rather than saying only that you clicked a link.
Preserve messages, receipts and account details before deleting the conversation. Keep originals where possible, and do not edit the only copy of a transaction record. Share evidence through the reporting organisation's approved route.
The CAFC reporting page directs victims to local police and accepts online reports from victims or witnesses. Police investigate; the CAFC gathers information to support investigations. A report is useful even when it cannot promise your money back.
Make it easier to refuse the next approach
Choose a trusted person you can consult before acting on another recovery offer. Agree that a short pause is normal, even if the caller insists a deadline is about to expire. The purpose is not to judge the original loss; it is to create space for an independent check.
Keep legitimate bank and police reference numbers in one place. If a new caller claims to know your case, compare that claim through the organisation's real contact channel rather than reading your entire case history aloud. Knowing a reference does not establish authority to request money.
For anyone helping a relative, focus on the requested action: “They want a new transfer before returning the old one.” That concrete description is often easier to evaluate than an argument over whether the caller sounded professional.
You do not owe an unsolicited caller continued attention because you have already lost money. Pausing the recovery pitch protects the options you still have.
Tags: Guide