Government Imposter Scams Are Targeting Prior Crypto Fraud Victims

A surge in government imposter scams targeting prior cryptocurrency fraud victims prompted the Commodity Futures Trading Commission (CFTC, the U.S. derivatives and digital commodity markets regulator) to issue a consumer alert in May 2025. The pitch follows the same script each time: a caller impersonating a federal inspector claims the victim’s missing funds have been located in a foreign bank account, then requests a processing fee, payable in digital assets, to release them. Neither exists.

Five federal agencies are now running a coordinated public education campaign to disrupt it, and the numbers explain why the response spans more than one regulator. In 2025, these scams generated more than 1 million complaints and $3.5 billion in reported losses, a 40% jump in complaint volume from the year before.

A Warning Built for People Already Burned

The CFTC’s official consumer alert, issued May 14, 2025 as Release 9075-25, identified the specific impersonation pattern: scammers were contacting financial fraud victims and falsely claiming to represent the CFTC Office of Inspector General (OIG). The OIG, they told victims, had already located missing funds sitting in foreign bank accounts. A fee was required to release them. The actual OIG will never make such contact.

According to the agency’s Beware Imposters advisory, the commission does not maintain cryptocurrency wallets, does not collect fees from consumers, does not issue cryptocurrency trading licenses, does not audit digital asset wallets or request private key access, and does not contact victims directly to offer fund recovery. Enforcement communications are issued only in writing, following completed investigations, never by an unsolicited call or email to a fraud victim.

Fraudsters gain their short-term credibility through document forgery. They copy logos, seals, and signature images from official government websites to produce fake letterhead and spoofed email headers, then look up real employee names to forge on fraudulent correspondence. One reliable technical checkpoint the commission has stated explicitly: all legitimate CFTC correspondence arrives from a @cftc.gov email address. Contact from any other domain, including look-alike addresses mimicking the official one, is fraud on its face.

How Crypto’s Prior Victims Became a Scammer’s Best Asset

The Losses Behind the Target Pool

The scale of the underlying investment fraud problem explains why recovery scammers have such a large population to work from. In 2025, the FTC received 3 million fraud reports and consumers reported $15.9 billion in total losses, up from $12 billion the prior year, according to FTC testimony before the Joint Economic Committee in March 2026. Investment scams were the single largest category by aggregate dollars lost.

• $15.9 billion in total reported consumer fraud losses in 2025, up from $12 billion in 2024
• $7.9 billion from investment scams specifically, the top category by aggregate loss, with an average individual loss exceeding $10,000
• $3.5 billion from imposter scams, crossing 1 million complaints for the year
• 40% increase in government imposter scam reports compared with 2024

Desperation as the Targeting Signal

Someone who lost a significant sum in a pig butchering scam (cryptocurrency investment fraud where criminals build a fake online relationship before steering the victim toward a fraudulent trading platform) carries a specific profile that recovery scammers have learned to exploit deliberately. That person is financially damaged, searching for any credible path back, and already conditioned to trust an authority figure promising results. Recovery pitches are engineered from the ground up to look like the answer to exactly that desperation, which is what separates this fraud category from ordinary phishing: the scammer is not casting a wide net. They are going to a known address.

Where the Target Lists Come From

The CFTC warning raises a question the advisory does not fully answer: if scammers specifically seek prior fraud victims, how do they find them? According to NASAA’s crypto recovery room scams advisory (NASAA, the North American Securities Administrators Association, is the network of state-level securities regulators across the United States and Canada), several overlapping sourcing channels operate at the same time.

• Darknet marketplaces trade victim lists containing contact information, loss amounts, and scam type. A crypto fraud victim’s data can be available for purchase within days of the original fraud concluding.
• Complaint board monitoring: scammers scan consumer complaint forums and social media platforms for users posting about recent financial losses, then approach them directly via private message.
• Fake recovery websites with fabricated five-star reviews and testimonials are seeded into search results via press release syndication, harvesting contact details from visitors who believe they are reaching a legitimate service.
• Some fake portals masquerade as government fraud-reporting pages, collecting personal information from victims who believe they are filing a real complaint with an agency.
• In documented cases, the second-wave recovery operation is run by the same operators behind the original scheme, recycling victim contact data months after the first extraction concluded.

NASAA’s advisory also notes that AI (artificial intelligence, software capable of generating text, video, and audio at scale) is now being used to produce multilingual caller scripts, fabricated client video testimonials, and spoofed email signatures designed to make the offer look credible for longer than a basic template would. The CFTC’s own guidance on recovery fraud notes that some fraudulent recovery sites embed links to real agency advisory pages, borrowing the CFTC’s own branding to lend false legitimacy to a con built around impersonating it.

The FBI’s Operation Level Up program, which proactively identifies and notifies cryptocurrency investment fraud victims before further losses occur, has contacted more than 8,100 people and estimates it helped prevent roughly $511 million in additional losses. Among those contacted, 77% were still unaware they were being scammed at the time of the FBI’s outreach, which means the window between the original fraud concluding and a recovery scam making contact is often very short.

Five Agencies, One Coordinated Push

The CFTC joined four other federal bodies in a public education initiative, with awareness campaigns launched on social media in early March 2026 and scheduled to continue through the end of the year. The table below maps each agency’s jurisdiction and role in the joint effort.

The FTC’s Government and Business Impersonation Rule, which took effect in April 2024, provides the enforcement layer behind the education messaging. The rule gives the commission authority to seek civil penalties and consumer redress directly from violators. Since it went into effect, the FTC has brought five enforcement cases involving alleged violations and shut down 13 websites that were illegally using the commission’s own branding to deceive consumers. “The billions of dollars American consumers lose at the hands of impersonators is staggering,” said Chris Mufarrige, director of the FTC’s Bureau of Consumer Protection, in a statement accompanying the April 2025 enforcement update.

The coordinated messaging across all five agencies carries a consistent core: no government agency will contact you unsolicited to offer fund recovery services, demand cryptocurrency payments, or pressure you to act on a deadline. Any contact claiming otherwise, regardless of how official the branding appears, is fraud.

Fraudsters are using sophisticated techniques to steal Americans’ hard-earned money. When investment scams conclude, victims are left bankrupt. The CFTC is working to change this by warning Americans about scams and teaching them tools to protect themselves.

Jorge Herrada, acting director of the CFTC’s Office of Consumer Education and Outreach, made those remarks at the agency’s World Investor Week participation announcement in September 2025, one of several public education events the commission runs to reach retail investors before they encounter a scam rather than after.

Spotting the Script Before It Costs You

Recovery scam scripts follow a narrow set of identifiable patterns. Recognizing any single one of them is sufficient reason to end the interaction before any money or personal information changes hands.

1. Unsolicited contact citing prior loss details. If someone contacts you with accurate information about a previous scam, that does not confirm access to official case files. It likely means they purchased a victim list, monitored a public complaint forum, or ran the original fraud themselves.
2. A claim that your funds have already been located or seized. No legitimate government agency holds recovered funds pending a fee payment from the victim. Any recovery pitch built around an existing frozen balance is scripted fiction.
3. Any payment request in cryptocurrency, gift cards, or wire transfer. The CFTC, FTC, IRS, US Postal Inspection Service, and SSA do not accept cryptocurrency from consumers under any circumstances. A crypto payment request is a categorical disqualifier, no matter how official the surrounding paperwork looks.
4. Urgency and pressure to act before you can verify anything. Legitimate agencies do not enforce deadline-based compliance over the phone or through unsolicited email. Manufactured deadlines are a tell.
5. Contact from a non-governmental email domain. CFTC correspondence comes exclusively from @cftc.gov addresses. IRS correspondence comes from @irs.gov. Any message arriving from a web-based service or a variation of an official domain name is fraudulent.

If any of these elements appear, write down as much identifying information as possible, end the interaction without sharing any personal details, account numbers, Social Security numbers, or digital wallet information, then call the agency directly using a phone number from its official website. The CFTC accepts fraud reports through its Beware Imposters guidance and complaint submissions page. The FTC takes reports at ReportFraud.ftc.gov. The FBI accepts reports through its Internet Crime Complaint Center at ic3.gov.

When the joint campaign converts even a fraction of those million-plus annual imposter complaints into timely reports before a second payment clears, it will do something enforcement actions alone cannot: shrink the gap between a victim’s first loss and the moment they stop being a viable target for the follow-on. If it does not, the secondary market that formed around crypto’s first-wave losses will keep running for as long as new victims keep entering the pipeline on the front end.

Disclaimer: This article is for informational purposes only and does not constitute financial, legal, or investment advice. Readers who believe they have been targeted by a government imposter scam should contact the relevant federal agency directly through its official website and consider consulting a qualified legal professional. Statistics and agency guidance cited are accurate as of the date of publication.