JFD Forensics: the fake “fund recovery” service behind a spam campaign

👉 What you need to know…

• jfdforensics.tech presents itself as a fund recovery service for investment scam victims, and asks for an upfront fee of at least $5,000.
• The site was promoted through a spam campaign: short links (arnaque.s.gy/get-help) posted in dozens of comments on scam reports.
• Its FAQ copies content from the real service MyChargeBack, whose name still appears in the text.
• Its Trustpilot profile has been removed.
• The WhatsApp number +1 585-476-4247 is linked to several other “recovery” sites: cryptofirewall.tech, calyxrecoveryinc.com, cncintel.com and macenforensics.tech.

A “recovery service” with upfront fees and copied content

jfdforensics.tech presents itself as a fund recovery service: “Simple, Effective Fund Recovery Services”, with “case managers” and “investigators” who promise to recover funds lost in investment scams. The service requires a commitment fee starting at $5,000 before any work: the classic recovery room model.

The site’s FAQ copies texts from MyChargeBack, a real fund recovery service: the name “MyChargeBack” even remains in the FAQ text. The homepage displays logos of Fox News, CBC, Bankrate, PYMNTS, Yahoo Finance and CreditCards.com to suggest media credibility, without linking to any actual press coverage.

The domain was registered on 8 November 2024 through NameCheap and is protected by Cloudflare.

A spam campaign documented in the reports

The site was promoted through a large campaign involving fake testimonials. Around 40 promotional comments were identified on scam reports. They used the short link arnaque.s.gy/get-help, which redirects to jfdforensics.tech’s contact page. The same short link appeared in reports written in English, French and Spanish. This use of one short-lived link across multiple campaigns is common in spam operations.

Trustpilot: profile removed

A search for the company’s Trustpilot listing now leads to a removal notice: “This profile has been removed”. For a service that claims to have recovered millions for its clients, this is a significant warning sign. For a service that claims to have recovered millions for its clients, the removal of its Trustpilot profile is a significant warning sign.

One phone number, several “recovery” sites

The WhatsApp number +1 585-476-4247 displayed on the site is linked to several other “recovery” services: cryptofirewall.tech, calyxrecoveryinc.com, cncintel.com and macenforensics.tech, which have also been the subject of scam reports. Using the same contact number for several “recovery” brands is a common warning sign of a linked group of sites.

Red flags at a glance

What to do if someone offers to “recover” your money

The golden rule is simple: be suspicious of any “recovery” service that contacts you first or asks for payment before acting. If someone calls, messages you or sends you a short link promising to recover your funds in exchange for payment, treat it as a recovery scam: ignore it and report it.

If you have lost money in an investment or crypto scam, you should contact the relevant official agency directly:

• United States: report to the FTC (reportfraud.ftc.gov) and, for cryptocurrency-related losses, to the FBI’s IC3 (ic3.gov). Your bank or crypto exchange may also have a fraud team.
• United Kingdom: report to Action Fraud (actionfraud.police.uk).
• Canada: report to the Canadian Anti-Fraud Centre (antifraudcentre.ca).
• EU countries: contact the European Consumer Centre in your country via europa.eu/consumers.

You can also add your testimony to the existing scam report for jfdforensics.tech to help document the full scale of the fraud for authorities:

Have you been contacted by a recovery scam? Share your experience on the report page. It may help other victims avoid being scammed a second time.