The FTC Will Not Text You a Badge: The Recovery-Scam Follow-Up to a Loss
A June 2026 FTC alert describes a second-stage scam: someone posing as an agency employee sends a badge photo and promises to recover money lost earlier. Here is how to verify the contact, protect accounts, and respond without blame.
When someone has already lost money to a scam, a second message can sound like the first real piece of help. The Federal Trade Commission’s June 2026 consumer alert describes impostors who claim to be FTC employees, send a photo of a badge or employee ID, and promise to recover money lost to an earlier fraud. The badge is theater: the new contact is another scammer, and the next request may put the victim at risk again.
- A photograph of an ID does not authenticate the sender; images and names can be copied or fabricated.
- The FTC does not contact people by text or WhatsApp to offer individual recovery and does not ask people to pay or move money to “unlock” a refund.
- Stop replying, preserve the message and payment details, contact the real financial provider through a known channel, and report the impersonation.
Why the follow-up is so convincing
Recovery scammers exploit a painful moment: the victim is angry, embarrassed, and actively looking for a way to undo the loss. The fraudster may know the victim’s name, approximate amount, bank, or the original company involved. That information can come from the victim’s own posts, a compromised account, a prior scammer, or ordinary data exposure. The caller then presents a tidy story: “We traced the funds,” “your case is approved,” or “a federal investigator has your file.”
A badge photo is meant to end the conversation before verification starts. It uses visual authority—an emblem, a headshot, a title, a case number—to make a stranger feel official. But a genuine-looking image proves only that the sender possesses an image. It does not prove who is operating the phone, whether the agency opened a case, or whether money can be recovered. Real agencies do not ask a citizen to trust a badge forwarded in an unsolicited message.
The second-stage pitch often changes after the victim shows interest. A “refundable processing fee,” tax, account-validation deposit, or cryptocurrency transfer is required first. Sometimes the person is told to move funds into a “safe wallet,” install remote-access software, or share a one-time code. Each request creates a new route to money or account access; none is a necessary step for reporting a crime.
What the FTC alert says—and what it does not mean
The FTC warns that scammers impersonate its staff, including by sending fake employee identification, and promise to recover money from a prior scam. The agency says it will not contact people by text or WhatsApp with such an offer, ask them to pay, or tell them to move money. The FTC also explains that it cannot resolve an individual consumer’s complaint or guarantee an individual refund. A complaint can help investigators identify patterns, but it is not a personal recovery service.
That distinction matters. A person may receive legitimate correspondence after contacting an agency or participating in a process, but an unsolicited message demanding secrecy, payment, or account access is a serious warning. Do not use the phone number, QR code, reply address, or link supplied by the person who contacted you. Look up the agency’s official site independently and use its published contact or reporting page.
Fast decision guide
| If the contact says… | Do this instead |
|---|---|
| “Here is my badge; I can recover your money.” | Do not treat the image as proof. End the conversation and verify through the agency’s official website. |
| “Pay a fee, tax, or deposit first.” | Do not pay. Contact your bank, card issuer, wire provider, or payment app using its official number. |
| “Move your money to a safe account or wallet.” | Do not move it on the caller’s instructions. Ask your financial institution’s fraud team for help independently. |
| “Share the code we just sent you.” | Never give away a one-time sign-in or password-reset code. Secure the account through its official app or site. |
| “Do not tell your bank or family.” | Tell a trusted person. Secrecy protects the operator, not the victim. |
If you already replied, paid, or shared access
Move quickly, but do not let the scammer direct the response. Call the payment provider using a number from a card, statement, or official app. Explain that you were deceived and ask whether the transfer can be stopped, recalled, disputed, or the card replaced. Recovery is not guaranteed, especially after an irreversible transfer, but prompt reporting gives the provider the best chance to act. If you shared a password, change it from a trusted device, change any reused passwords, sign out other sessions, and turn on multifactor authentication. If remote-access software was installed, disconnect the device from the internet and get help from a trusted technician before using it for banking again.
Keep copies of messages, email headers, payment receipts, wallet addresses, phone numbers, usernames, and the fake ID image. Record a short timeline while details are fresh. Do not delete the original conversation until you have saved evidence. Report the impersonation at the FTC’s official fraud-reporting page and, where money or accounts are involved, to the relevant financial provider and local law enforcement. The FBI’s IC3 may be appropriate for internet-enabled financial crime; use the official IC3 site typed into the browser rather than a link from a stranger.
Support without blame
Family members can make the next safe step easier. Avoid “How could you believe that?” The victim may already be ashamed, and shame can push them back toward the person promising recovery. Try: “This is a known follow-up tactic. Let’s call your bank using the number on the card, save the messages, and report it together.” Ask before taking control of devices or accounts, and never demand that someone send you their passwords. A calm, shared checklist reduces the chance of another rushed decision.
It is also sensible to reduce what a second scammer can exploit. Review public posts for details about the original loss, remove personal information from social profiles where practical, secure email first, and add a carrier account PIN if available. A scammer who can reset email or intercept a phone number may be able to impersonate the victim as well as an agency. Our recovery resources explain how to organize the first response, and the government-impersonation guide covers the broader pressure tactics used by fake officials.
The rule worth remembering
A real badge photo, case number, or confident explanation cannot turn an unsolicited recovery offer into a trusted channel. Verify the organization independently; never pay or move money because a stranger says it is necessary; and contact your bank or agency using contact details you found yourself. If the offer is real, it can withstand a pause and an independent check. If it cannot, that urgency is part of the trap.