Skip to main content
All scam alerts
Public scam alert

FSMA Issues Warning Against Fraudulent Recovery Room Services and Clone Firms

The Belgian Financial Services and Markets Authority (FSMA) has issued a warning against multiple fraudulent recovery room operators and clone entities preying on investment fraud victims.

Pause before you respond

Do not send money, disclose credentials, or use contact details supplied in an unsolicited message. Verify the organisation independently.

The Belgian Financial Services and Markets Authority (FSMA) has published an urgent warning regarding fraudulent recovery room operations. These schemes specifically target individuals who have previously lost money to investment fraud, falsely promising to help them recover their lost capital or assets. According to the FSMA, fraudsters often initiate contact through unsolicited telephone calls or emails, though victims also encounter them through web searches and social media advertisements. To build trust, these entities routinely impersonate law firms, accountants, law enforcement, or official financial supervisory authorities. A primary indicator of this scam is the demand for advance payment, which fraudsters justify as administrative fees, legal costs, or taxes. In other scenarios, scammers offer assistance for free but request remote desktop access (such as AnyDesk) to install spyware and compromise PC banking portals, or instruct victims to fund and activate new cryptocurrency wallets. The FSMA explicitly identified several unauthorized entities operating recovery room schemes: - Bunkerwallet (bunkerwallet.io) - Financial Recovery Ltd / Financial Recovery Services LTD - Fiscor (fiscor.org) - G&P Consulting / G&P Consulting Group / GNP Consulting / Goldman and Partners Consulting Group (gnp.consulting, gnpconsulting.cc, gnpconsulting.com) - Krypton (krpton.bz, krypton.so, krypton.sx, krypton.ec) - Mrkt4trd (mrkt4trd.com) The regulator also warned that scammers are impersonating reputable brands and public authorities. Flagged impersonations and clone websites include: - Crypto.com / Subcryptob (supcryptob.com) - Payward LTD Clone (paywardltd.co) - Refundee (unauthorized use of identity) The FSMA warns that investment fraud victims are frequently re-targeted by the original fraudsters or have their contact details sold to secondary recovery scammers. Financial authorities such as the FSMA do not contact individuals to recover lost funds or collect advance recovery fees. Consumers are strongly advised to cease all communication with unsolicited recovery services, refuse remote computer access or upfront fee requests, and report incidents directly to local police authorities.