עברית

Fund recovery scam email: a fake offer to get back money you lost to a scam

Reported as phishing

This email was reported as phishing in October 2026. It pretends to be a service that gets back money lost to scams. It was aimed at International and written in English.

This email was reported as phishing. It uses a made-up or generic sender to win your trust.

This email is aimed at people who already lost money to a scam. A "client relations" contact says they are writing about "your inquiry" about your scammed funds, and that they will call you within 72 hours to review your case and the steps to get your money back. The subject line includes your name so it looks like a real follow-up. A "Website" button leads to a page on a free hosting subdomain.

When you have lost money, any promise to get it back gives hope, and that hope lowers your guard. The best tell: you never made an inquiry, yet they write as if you did. Recovery scams like this usually ask for an upfront fee, so it becomes a second loss.

What the email looks like

Sender namesupport

Hi [first name],

My name is [first name], and I am contacting you on behalf of [company name] regarding your inquiry about your scammed funds.

I would like to introduce myself as your point of contact and let you know that I will be calling you within the next 72 hours to discuss your situation, answer any initial questions you may have, and explain how we can begin reviewing your case and the possible steps toward recovering your funds.

During our conversation, we can go over the relevant details and discuss how to proceed.

My aim is to make the process as clear and straightforward as possible.

If there is a particular time that works best for you, please feel free to reply to this email and let me know.

--

[first name]

Client Relations | [company name]

[phone removed]

Website

Re-typed from the original with personal details removed. This is not the original email. This was a button in the original email. Here it is only a picture of the text and does nothing.

Subject line

Red flags

Links in the email (shown as plain text)

Links are defanged: "hxxp" and "[.]" stop them from working. Never retype them or copy them into your browser.

hxxps://[random-name][.]netlify[.]app/ (free hosting subdomain)

What to do

  1. Do not reply, do not click the website button, and do not share a phone number or a good time to call.
  2. Do not open attachments. Never type a password, card number or code on a page you reached from this email.
  3. If you want help with an earlier loss, contact your bank or a service you find yourself, never one that contacted you first.
  4. Recovery offers that ask for an upfront fee are a common second scam aimed at earlier victims. Report fraud to your local police or national fraud reporting service instead.
  5. Mark the email as phishing or spam in your mail app, then delete it. If they call, hang up.
  6. If you already paid or shared card or bank details, contact your bank now. If you entered a password, change it and turn on two-step sign-in.

How to report it

In your mail app, use "Report phishing" or "Report junk" so the app learns to block similar emails. You can also forward the email to the real company's abuse or security team, using an address from its official website. If you lost money, report it to your bank and to your local police.

More scam email examples

These emails did not come from the companies or services they name. Brand names belong to their owners and are shown only to help you recognise the scam.

How we collect these examples

Each example is an email that was reported as phishing to the Mailbux security team. We publish it only after private details are removed: addresses are masked, names, tracking numbers and tokens are taken out, and links are shown as plain text that can't be clicked. We show the month an example was reported, not the exact date.

Last updated 10.11.2026 19:01 IL (10.11.2026 17:01 UTC)