All briefings

Daily brief — August 25, 2026

Recovery Scams, Toll Texts & AI Romance Cons Surge

Fraud aimed at people already victimized, a nationwide toll-text wave, and AI-driven romance-investment cons top today's active threats.

Published August 25, 2026

Key points

  • Fake recovery firms and people impersonating the FBI/IC3 are targeting people who already lost money to a prior scam — a second-hit pattern flagged by both AVASC and the FTC this month.
  • A large-scale 'unpaid toll' smishing operation (the Smishing Triad) is behind hundreds of thousands of scam text domains still active nationwide.
  • AI is being used to run romance-investment ('pig butchering') scams at scale, with billions in reported crypto fraud losses tied to the pattern.
  • Government/agency impersonation (IRS, SSA, FTC, FBI, police) remains a leading complaint category, typically demanding gift cards, wire transfers, or crypto.
  • Task-based 'job' scams — small payouts followed by demands to deposit your own money — continue to drain financially stressed workers.

Fake 'Recovery' Firms Are Re-Targeting People Who Already Lost Money

The FTC issued a blunt warning this month describing recovery and refund scams as "the worst of the absolute worst: scams that target people who have already lost money to a scam." These operators buy lists of prior victims — people already proven willing to pay — and pose as recovery specialists or federal agents offering to get lost funds back for an upfront fee.

This lines up with what AVASC has been logging: our public-incident data shows prior victims being contacted by fake recovery firms and people impersonating the FBI/IC3, promising to recover lost funds for an upfront fee, with the FBI stating it does not operate that way. The FBI has also reissued guidance specifically about this pattern, noting it is an ongoing fraud scheme where criminal scammers are impersonating FBI personnel facilitating Internet Crime Complaint Center (IC3) complaints to deceive and revictimize individuals.

The FTC's own homepage is also actively flagging impersonation of the agency itself, reminding the public that the FTC will never threaten you, say you must transfer money to 'protect it,' or tell you to withdraw cash or buy gold and give it to someone.

Toll-Text Smishing Wave Still Growing, Now Tied to a Massive Domain Operation

The fake 'unpaid toll' text wave that AVASC has tracked since May is not slowing down. New reporting this month ties the campaign to the 'Smishing Triad,' described as a phishing-as-a-service operation that registered 194,345 domains for toll, DMV and USPS scam texts — a phishing-as-a-service economy selling kits for $8 per 1,000.

The pattern matches AVASC's own data: mass texts claiming small unpaid tolls that link to look-alike payment pages built to harvest card and personal data, prompting warnings from multiple state DOTs and courts. Security researchers say the campaigns are run by financially motivated organized cybercrime groups based in China, who employ sophisticated tools and infrastructure, referred to as SMiShing kits, and the FTC continues to advise: if you get a text about unpaid tolls, reach out to the state's toll agency using a phone number or website you know is real.

AI Is Making Romance-Investment ('Pig Butchering') Cons Harder to Spot

AVASC's cluster on AI-run romance-investment fraud is backed by broader reporting on syndicates using automation to scale grooming. Analysts note that cryptocurrency-related fraud caused over $11 billion in losses in 2025 according to the FBI's IC3, with reported losses from AI-assisted scams accounting for almost $893 million. Older adults are disproportionately affected — AARP's 2026 study found almost one out of every 10 adults over 50 said they had been asked to send money or get involved in cryptocurrency investments via online romance.

The mechanics match what AVASC is seeing: long-running fake relationships that pivot into a 'can't-lose' crypto platform, fabricated dashboard gains, and a withdrawal 'fee' that never lets the money out.

Protect yourself

  • If someone contacts you out of the blue offering to recover money you already lost, treat it as a second scam — legitimate recovery, when it happens, comes through federal forfeiture processes, not cold calls.
  • Never click links in unsolicited toll or DMV texts; go directly to the agency's known website or phone number to check your account.
  • Be skeptical of any online relationship that moves toward a crypto 'investment opportunity' — verify any platform independently, and treat a demand for a withdrawal 'fee' or 'tax' as a stop sign.
  • No real government agency will ever demand payment by gift card, wire transfer, or cryptocurrency, or threaten immediate arrest over the phone.
  • Ignore unexpected job offers via text or WhatsApp that ask you to complete 'tasks' for pay — never pay money to unlock earnings.
  • If you've been scammed, tell someone you trust right away and report both the original fraud and any follow-up 'recovery' contact to ReportFraud.ftc.gov and IC3.gov.

Sources

Think you've been targeted by a scam?

Reporting takes just a few minutes. It helps us warn others, strengthens the scam database, and connects you to recovery resources.

This briefing is public-safe intelligence: it surfaces only indicators and patterns that are already public, alongside protective guidance — never a playbook for scammers. AVASC is not a law firm, investigator, or government agency, and this is not legal or financial advice. If you've been targeted, you can report a scam or explore recovery resources.