A person who has been scammed once is often targeted again. This post covers how that happens and what to do about it.
The ways it happens are connected. The same scammer returns with new demands, the victim's name is sold to other criminals, stolen identity information produces new incidents over time, extortion demands repeat, and a recovery pitch arrives offering to get the money back. The step that matters most in responding runs through all of them: treating every incident as part of the same case.
The same scammer often returns first, because on a fake investment or task platform the theft does not end with the first payment. The dashboard shows profits that do not exist. When the victim tries to withdraw, a tax, fee, verification charge, or deposit is demanded first. Paying it produces another demand: a higher tier, a penalty for a flagged transfer, an anti-money-laundering deposit. The FBI's 2025 Internet Crime Report describes this pattern, in which victims trying to withdraw are charged taxes and fees as a final attempt to extract more money before the scammers disappear. A legitimate exchange ordinarily deducts its fees from the amount withdrawn. A platform that requires new money to be sent in before anything comes out is showing the warning sign, and each additional payment to such a platform is a loss rather than a step toward release.
A different scammer may be next, because the FTC calls these "sucker lists": names, phone numbers, the scam that worked, and how much was lost. Because someone who paid once is believed likely to pay again, the list has value to other criminals, so the second attempt may have nothing to do with the first. A romance scam victim may receive a tech support call, a crypto victim may receive a romance message, and a person who posts about a loss in an online group may receive private messages from someone claiming to have recovered their own money or from an "agent" offering help. When the new caller already knows the details of the loss, that alone does not prove the caller is official; it may mean the name and the details were sold. The second caller may also sound familiar with the victim's story because the group kept the chat logs, account numbers, and other details from the first scam, and that material passes along with the name.
Sometimes the second incident is not a call at all. It is an account the victim never opened, a tax return the victim never filed, or a job the victim never held. A stolen Social Security number or a compromised phone can be reused for years across new account fraud, account takeover, employment misuse, and tax fraud. The Identity Theft Resource Center's 2026 Trends in Identity Report found nearly 26 percent of identity crime victims managing two or more incidents at the same time, with account takeover and new account fraud the most common combination, and victims who lost money resolving their cases far less often than victims who did not. A credit freeze is stronger than a fraud alert, and an IRS Identity Protection PIN is worth obtaining after any exposure of a Social Security number, because the point is to guard against a series of incidents rather than a single one.
For sextortion and romance victims, the second demand often comes from the same criminal. A threat that was supposed to end with payment is renewed, or the images are used again against a new audience. Paying does not guarantee silence, and it can invite further demands by showing that threats produce payment.
Then comes the recovery pitch, which is only one part of the problem. Fake firms, fake law firm letters, and callers posing as the FBI or its Internet Crime Complaint Center offer to recover the money for an upfront fee. In July 2026 the FBI warned that criminals were running spoofed IC3 websites and AI-generated videos of senior FBI officials to support the pitch. According to the FBI, IC3 does not contact victims directly and does not request payment. A law firm that contacted the victim first is not a firm the victim verified, so it should be checked independently before any money or information is provided, and any demand for an upfront fee to recover funds should be treated as a warning sign.
The response starts with treating every new incident as part of the same case and saying so in every report, because banks, police, and regulators will generally handle each report separately unless the reports are linked. Keep one timeline with dates, amounts, phone numbers, wallet addresses, account numbers, and the exact wording used each time. The same wallet address or phone number across two incidents can be evidence of one operation, and stating that connection affects how the file is treated. Freeze credit at all three bureaus rather than relying on alerts, obtain an IRS Identity Protection PIN if a Social Security number was exposed, and change the passwords and recovery options on email and phone carrier accounts first, because a compromised device or email account allows criminals to intercept the codes meant to warn the victim. Businesses face the same pattern: a company hit once is likely to be hit again, including repeat business email compromise attempts aimed at the same employees, so a second contact about a past loss should go through the same verification as the first, regardless of how much it already knows. If a fee is being demanded right now to release funds, do not pay it, because nothing is being released. Save everything, then report to the bank, the FTC at ReportFraud.ftc.gov, and the FBI at ic3.gov, as one linked pattern rather than separate complaints. Victims often do not report a second incident out of embarrassment, and that silence keeps the lists valuable, while a report is what makes the pattern visible to anyone who can act on it.
That is the pattern this post set out to describe. The same scammer returns with new demands. The name is sold to other criminals. Stolen identity information produces new incidents over time. Extortion demands repeat. A recovery pitch follows. And the response is the same in each case: link the incidents into one case, freeze credit, protect the accounts that control the rest, and report it as one pattern.
The deeper point is fragmentation, and the scammer's business benefits from it. Each bank sees one dispute, each agency receives one complaint, and each report sits in a separate file, so none of them sees the whole operation. The victim is the only person who sees all of it. That is why linking the incidents matters more than any single report: a shared wallet address or phone number across two incidents can turn separate complaints into one connected case, and a connected case is easier for investigators and banks to act on than isolated reports. The lists stay valuable for the same reason. A name that paid once is not just a lead; it is a proven customer, and the cost of reaching that customer again is far lower than finding a new one. None of this means the victim did something stupid. It means the people running these operations keep records and reuse them, and the second attempt is harder to recognize when it looks nothing like the first.
Gabriel Vincent Tese is an attorney with Spector Gadon Rosen Vinci P.C. in Philadelphia focused on cyber litigation and technology law. He can be reached at gtese@sgrvlaw.com.
This post is general information, not legal advice. For advice about your specific situation, consult an attorney.