Losing years of savings and having your personal information exposed in a malicious scam can be painful enough. But becoming a victim twice when trying to recover what was lost could feel like adding insult to injury.
Recovery scams have been on the rise, according to the Canadian Anti-Fraud Centre and Canadian Investment Regulatory Organization. The scams, which target people who have already been defrauded, typically convince victims to pay a fee upfront under the guise of recovering the previously lost funds. The anti-fraud centre notes that recovery scams more than doubled in 2023, resulting in more than $1.6 million in losses, though it estimates only a small fraction of victims report instances of fraud.
"If you've recently lost a lot of money to a scammer, what they're going to do is play on your emotions, because of course, you want to get that money back," said Jane Arnett, cybersecurity evangelist for Check Point.
"This scammer might come to you and say 'We know you lost X dollars in Y fraud scam that was discovered. We can get that money back for you. All you need to do is pay us a fee upfront,'" she said. The fee is likely going to be less than the amount lost.
Arnett likened it to a burglary at her aunt's home. Three weeks after her aunt's home was broken into, she was robbed again. The police suspected it was the same robbers who cased out the home and came back for whatever they missed.
"This is basically the modern, virtual version of that," she said. "Sometimes, it's the same criminal who scammed you. Sometimes, it is not."
Generally, the conversation with recovery scammers isn't initiated by victims. Instead, someone impersonating a reputable agency contacts them. The scammers could be impersonating a worker at the Canadian Investment Regulatory Organization, the Canadian Anti-Fraud Centre or Canada Revenue Agency.
Scammers impersonating officials from watchdog agencies or government organizations often have a sense of urgency, ask for personal or sensitive information, or talk the victim into giving them remote access to their laptop, Arnett said.
If you receive a call like that, she said to just take a breath and tell the person on the other end of the line that you'll call them back.
Then, look up the employee and the organization online, find the correct information on the official website and call that number.
"It'll take two seconds," she said.
Jon Ferguson, vice-president of cyber and DNS services at the Canadian Internet Registration Authority, said the scammers often reach out via phone call, email and text message. CIRA is a non-profit that manages .ca domains.
"Those communications are becoming more and more believable, if you will, as being legitimate in large part because of AI and just a growing sophistication of the fraudsters," he said.
Ferguson cautioned to be wary of anyone asking for a fee upfront or guaranteeing recovery of lost funds or data.
"It's one of the key things we've learned about ransomware over the years," he said. "Even when someone pays a ransom, it doesn't necessarily guarantee that you're going to get your data back or that those bad actors are going to not release that data anyway.
"The same holds here," Ferguson said of recovery scams.
Government organizations typically don't reach out to people or offer recovery services for a fee upfront.
Last month, an investor alert from CIRO flagged several names being used by criminals 鈥� Cathy Malone, Aaron Fox, Dara Hogan, Dylan Oak, L鈥檈andre Sanders and Rosalie Austin 鈥� to misrepresent themselves as CIRO officials to carry out investment recovery scams.
"CIRO does not provide investor recovery services and will never request funds from investors," it said in the release. "Importantly, no CIRO employee will ever request payment from retail investors 鈥� this is an immediate warning sign of fraudulent activity.
"Please note that the list of names and emails being used by scammers continues to grow daily, making it impossible to list them all."
Google searches on ways to get back lost money are another way scammers could get tipped off, Arnett said. The first few results on the google search page are generally paid for, with "sponsored" written above them. It's likely those could be phishing sites.
Ferguson suggested reporting the incident to the Canadian Centre for Cyber Security or checking reputable resources such as the Canadian Anti-Fraud Centre to find out the next steps if you've been scammed.
After being defrauded, there's a risk your data could be leaked on the internet 鈥� giving scammers even wider access to your information.
"Once that information is out there, it's going to be out there and it's going to be used again and again to get more information," Arnett said.
Arnett suggested setting up credit monitoring to keep tabs on any further malicious activity.
Some data can be easily changed, such as bank and email passwords, but some information can't be changed or erased, like your social insurance number.
Passwords for even trivial accounts such as Netflix matter. Every little piece of information 鈥� your name, phone number, email can be used to gain access to other details.
The scam can't be undone but good online practices when it comes to things like passwords could help prevent future scams.
"Prevention is worth a ton of pain 鈥� rather than having to chase the problem after," Ferguson said.
This report by The Canadian Press was first published May 15, 2025.
Ritika Dubey, The Canadian Press
