23.09.2025 - Last week, the NCSC received a higher than usual number of reports about recovery scams. With this type of scam, people who have already fallen victim to investment fraud are targeted a second time. The scammers claim to have recovered the missing money and offer to return it – for a fee. To lend credibility, they often invoke public institutions, for example by posing as an NCSC employee.
Not only do victims of investment fraud suffer financial loss, they are also often targeted a second time. In such cases, scammers get back in touch some time after the initial fraud, promising to recover the lost money. Instead, the victims are deceived again and lose even more money. This scheme is known as a recovery scam or refund scam. Interestingly, in the cases reported to the NCSC last week, scammers targeted not only genuine victims, but also emailed random people in the hope of striking lucky. To make their messages appear legitimate, scammers often use the names of security providers or law enforcement agencies. They may even use the names of employees – sometimes real people, sometimes entirely made up. Last week, one name cropped up repeatedly: the fictitious NCSC employee Daniel Bruno. In the emails, the supposed NCSC inspector claimed that he had been tasked with recovering stolen funds.
The bait: An official-looking email or phone call
Scammers try to make themselves look legitimate with professional-looking forgeries designed to deceive their targets. The scam usually begins with a phone call or an email. In the most recent cases, a forged employee ID card played a central role. This identified Daniel Bruno as a Senior Asset Investigator at the National Cyber Security Centre and featured the logos of various organisations, a fake ID number and an expiry date, all in an attempt to appear genuine. Contact was usually made via email or telephone, with Daniel Bruno claiming to be working with foreign authorities, such as the UK's Financial Conduct Authority (FCA), to create the impression of a large-scale international operation.
However, one tell-tale detail was that the email address was a Gmail account. Government agencies do not use generic webmail providers. The scam message informed the victims that their name had been found in the client records of a dubious broker during an investigation, and that a large sum (for example, USDT 220,600, a cryptocurrency equal in value to the US dollar) was available for recovery.
The growing sophistication of such forgeries is a direct response to the public becoming more aware of simple scams. As people have become more alert to basic phishing emails, scammers have had to refine their methods to overcome greater scepticism. Elaborate documents and references to real authorities are designed to convince even the most cautious individuals.
Posing as an NCSC employere is particularly devious. The scammers deliberately exploit trust in the very institution that victims of cybercrime would normally turn to for help, intercepting them on their way to seeking legitimate assistance.
Daniel Bruno does not exist and no such person works for the NCSC or for any associated authority in Switzerland or the UK. Any documents mentioning him are forgeries. The NCSC would never contact members of the public out of the blue to demand advance payments in exchange for recovering lost funds.
The anatomy of a recovery scam: When scammers come knocking twice
The Daniel Bruno case is one example of such a scam. Others have been described in previous Weekly Reviews (e.g. in Weekly Review 38/2024 ).
There are usually two stages:
- The initial scam: The victim loses money through some form of online fraud, such as an investment scam involving cryptocurrencies, an advance-fee scam relating to a supposed lottery win or a phishing attack.
- The follow-up scam (i.e. the actual recovery scam): Some time after the initial scam, the victim is contacted again by different scammers. They pretend to represent an official body, such as the police, a financial regulator or a law firm – or even the NCSC itself. They claim to have tracked down the original perpetrators and secured the victim’s funds.
At the heart of the scam is a demand for advance payment. The victim is told that they must pay a fee if they want the supposedly recovered money to be released. This is justified with various pretexts, such as a there being a processing fee, legal costs, administrative fee or taxes. Once the victim has paid, the scammers either cut off contact altogether or invent further urgent fees to extort even more money. Ultimately, the victim loses out twice and gets nothing back.
Recommendations
- Be extremely cautious of unsolicited emails promising to recover lost money.
- Never make advance payments to get supposedly lost funds back. Reputable organisations will never ask for advance payments.
- Never give callers remote access to your computer.
- Always check the sender’s email address. The NCSC and similar authorities do not use free webmail providers.
- Never reply to these types of emails, or click on links or attachments.
- If you have suffered financial loss, we recommend filing a criminal complaint with your local police station.
Current statistics
Last week's reports by category:
Last modification 23.09.2025
