The IC3 advisory lays out a fairly consistent sequence. Criminals typically make first contact by text, claim they've kidnapped a relative, and demand ransom for the person's release, often threatening violence if payment doesn't arrive right away (FBI IC3, last December). The threat doesn't need to hold up to scrutiny. It needs to arrive fast enough that scrutiny never gets a chance to happen.

What makes the tactic work, as far as the advisory describes it, is the follow-up "proof." Scammers send what looks like a genuine photo or video of the victim's loved one, often altered, and the FBI notes that close inspection frequently turns up inconsistencies: a missing tattoo or scar, body proportions that don't quite match (FBI IC3, last December). Close inspection is exactly what victims rarely get. The advisory notes that scammers sometimes send the image through a timed or disappearing-message feature, limiting how long anyone has to study it before it vanishes. A blurry photo glimpsed for a few seconds under the belief that a relative is in danger reads very differently than the same photo examined calmly an hour later, which may be part of why the method keeps getting used.

It's worth being clear about what this scam is and isn't. A credible threat of violence against a family member deserves a call to emergency services whether or not the kidnapping turns out to be staged. The FBI's guidance is built around a simple point: verifying the claim and alerting authorities aren't competing priorities. They happen at the same time.

The FBI's recommendations amount to a short list of habits, and each one works because it slows the interaction down, which is the one thing the scam depends on preventing (FBI IC3, last December):

• Treat urgency itself as a warning sign. Stop and ask whether the kidnapper's claims actually make sense before reacting.
• Try to reach the supposedly kidnapped person directly, using a number already saved, not one the caller provides.
• Agree on a family code word in advance, something only relatives would know, so a real emergency can be confirmed quickly.
• Screenshot or record any proof-of-life photo or video before it disappears, so it can be examined closely rather than glanced at under pressure.
• Avoid handing out personal details, including travel plans and location, to strangers. A scammer who learns where someone is traveling can fold that detail into a later threat to make it sound more specific.

There's a second, less obvious risk the FBI flags for families already searching for someone: posting about a missing person online can draw scammers, who may contact the family with fake information about their loved one. A real search and a staged one can look alike to someone watching from the outside, which is one more reason to verify through channels a family controls rather than ones a stranger supplies.

If a virtual kidnapping scam does unfold, the FBI asks victims to hold onto everything before filing a report: phone numbers used for contact, payment information, text and audio communications, and any proof-of-life photos or videos, submitted through IC3.gov (FBI IC3, last December). That record matters even after the immediate crisis passes. Investigators rely on exactly the details a victim was too rattled to study in the moment.

Strip away the kidnapping premise and the underlying mechanics show up again in a completely unrelated scam. The FBI's recovery-firm advisory describes fictitious legal operations that contact people who already lost money in a cryptocurrency scam, offering to get it back (FBI IC3, last year). Some impersonate real attorneys or produce documents with a legitimate-looking law firm letterhead. Others claim an official partnership with government agencies, something no law firm actually has, or invent regulators that don't exist, such as a fictitious "International Financial Trading Commission" (FBI IC3, last year).

The detail that should raise the most suspicion, according to the advisory, is how much these fake firms already seem to know. Some cite the exact dates and dollar amounts of a victim's earlier wire transfers, along with the name of the third party who received the money (FBI IC3, last year). The advisory documents that detail without explaining how the scammers obtained it, whether the same criminal network runs both the original scam and the follow-up, or how often this second contact actually happens. What it establishes is narrower and still worth knowing: for cryptocurrency scam victims specifically, information from an earlier loss can resurface in a way that makes a second approach sound credible.

From there, the scheme tends to escalate in familiar ways. Some fake firms direct victims to register an account at a supposed foreign bank, a site built to look legitimate but designed only to pull in more money. Others add victims to a group chat on WhatsApp or similar apps, populated by fake "attorneys" and "bank processors" who eventually ask for a verification or processing fee before funds can supposedly be released (FBI IC3, last year). A request for payment in cryptocurrency or prepaid gift cards is itself a red flag. No government agency demands payment that way for law enforcement services (FBI IC3, last year).

The FBI's advice for spotting these firms amounts to assuming nothing. Confirm any claimed government affiliation by calling the agency directly, using a number looked up independently rather than one the caller supplies. Ask for a license or video verification; an unwillingness to appear on camera or provide credentials is itself telling. Keep records of every interaction, including recorded video chats, in case a report needs to be filed later (FBI IC3, last year).

None of this means a kidnapping scam and a bogus recovery firm are the same crime wearing different clothes. The FBI's recovery-firm warning applies specifically to cryptocurrency scam victims, and nothing in either advisory shows that a kidnapping scam reliably leads to a second contact down the road. What the evidence does support, across both, is that manufactured urgency paired with a fabricated authority figure is often enough to produce a payment, and that for crypto-recovery cases, a prior loss can become raw material for a second one.

Both advisories describe tactics in detail. Neither offers a count of how many people fall for them, what a typical loss looks like, or how the two schemes relate to each other beyond sharing a playbook. The FBI's recovery-firm notice is explicit that it targets people hurt by a prior cryptocurrency scam; the kidnapping advisory makes no claim about who gets targeted or how often the threat is followed through on.

That gap is worth sitting with rather than papering over. It would be easy to assume these scams scale the way headlines about fraud losses sometimes suggest, moving in a predictable line from first contact to six-figure loss. The public record, at least as laid out in these two advisories, supports something narrower: a documented set of mechanics, observed case by case, not a measured rate of success or failure. Knowing the tactic is not the same as knowing how often it works, and neither advisory pretends otherwise.

Before any money moves. No wire transfer, account-access request, gift card, or cryptocurrency payment gets authorized during an unsolicited call or text, period. The person on the line ends the conversation and verifies independently first. That mirrors the FBI's "zero trust" standard for recovery-firm contacts: assume no one should be trusted by default, and confirm any claimed government affiliation only through a phone number looked up separately, never one the caller provides (FBI IC3, last year).

During a kidnapping-style threat. Call emergency services right away if there's a credible claim of violence; that step runs alongside verification, not instead of it. Try the supposedly kidnapped person's number directly, use a family code word if one exists, and treat any photo sent through a disappearing-message feature as something to screenshot first and study second (FBI IC3, last December). If a search becomes public, keep in mind that posting details online can draw scammers offering fake information about the missing person.

After a payment has gone out. Contact the bank, wire service, or cryptocurrency platform immediately; a delay only narrows what can be done. Preserve screenshots, phone numbers, payment records, and any text or audio communications, then file a report with IC3.gov, contacting a local FBI field office directly if the contact involved a suspected fake recovery law firm (FBI IC3, last year).

The thread connecting a fake kidnapping text and a bogus recovery law firm isn't the size of the payment at the end. It's what each one tries to take away first: the chance to check the story against reality. Urgency, a caller-supplied phone number instead of one already saved, a demand to act before telling anyone: those are the recurring ingredients the FBI keeps finding across unrelated schemes, not because the criminals coordinate, but because the approach keeps working.

A household that has already agreed on how to verify a crisis, calmly, long before any threatening text arrives, isn't improvising when the moment comes. It's checking boxes against a plan instead of following a script someone else wrote for it.