The Fake ‘Asset Recovery Unit’ That Targeted a Victim Twice
A retiree on Long Island had already lost a six-figure sum to Ambitious Capital Limited when a second call came — a government “asset recovery unit” that had supposedly located his funds and could return them, once he covered the “release fees.” It was the same network, circling back. Fast action turned an $18,600 second hit into a mostly-recovered case.
First Transmission
The caller knew the details of the original loss — the platform name, the rough amount, the dates. He claimed to be from a “Digital Asset Recovery Unit” coordinating with the exchanges, and produced an official-looking case number, a badge photo, and a letter on letterhead. Victim lists are bought, sold, and re-worked; knowing the details of the first scam is the credential the second one uses.
Where the Signal Broke
The “unit” explained that the recovered funds were held in escrow and required a sequence of payments to release: a “court processing fee,” a “crypto conversion fee,” and a final “anti-fraud bond” — payable in USDT and prepaid cards. Real regulators and law-enforcement bodies never charge victims fees to return funds, and never take payment in gift cards or crypto. The client paid two of the three before a family member intervened and called us.
▶ Intercept — client statementThey knew exactly how much I’d lost the first time. That’s why I believed them. Who else would have those numbers?
The Trace Log
- freq 01 · triage
Stopped the bleed first
Our first call was prevention: we confirmed the ‘recovery unit’ was fraudulent, instructed the client to make no further payments, and preserved every message, number, and receipt before anything was deleted.
- freq 02 · trace
Traced the release-fee payments
The USDT payments were followed on-chain to a collection wallet; the prepaid-card numbers and activation data were documented for the issuers and law enforcement.
- freq 03 · cards
Filed with card issuers fast
Because the client acted within days, several prepaid-card loads had not been fully drained — we filed issuer fraud claims while balances remained recoverable.
- freq 04 · venue
Flagged the crypto off-ramp
The USDT collection wallet fed a single exchange deposit address, which we reported with a full trace so the receiving venue could freeze the proceeds.
- freq 05 · return
Recovered most of the second loss
A combination of card-issuer reversals and a frozen exchange balance returned the majority of the $18,600 — and we documented the network for the client’s ongoing report on the original fraud.
of the $18,600 second-stage loss recovered. The difference here was hours, not weeks: the family called before the final ‘bond’ was paid, and most release-fee funds were still in reach.
Noise Markers
- An unsolicited call or email claiming a government body has ‘recovered’ your funds.
- A caller who already knows the details of a scam you previously fell for.
- Any fee — ‘court,’ ‘conversion,’ ‘bond,’ ‘tax’ — required before funds are ‘released.’
- Requests for payment in crypto, prepaid cards, or gift cards from an ‘official’ body.
- Official-looking case numbers, badges, and letterhead used to manufacture authority.
Recognise one of these signals in your own story?
Bring us the details. A Cryptosenti analyst will review your case and tell you honestly what can be traced.
Open a Case →