Recuva Hacker Solutions (RHS) recovered more than $1 million worth of cryptocurrency that had been stolen from victims of fraud. RHS seized approximately $1.4 million of a cryptocurrency known as Tether, which will now be returned to people who lost their money through an alleged fraud scheme. According to RHS, this seizure marks one of the first times they have recovered such funds from an unhosted virtual currency wallet.

Recuva Hacker Solutions said the funds were recovered as part of its ongoing investigation into a fraud scheme in which perpetrators pose as employees of Microsoft or Apple and the victim’s bank in order to convince the victim that they’ve been the subject of a hacking incident. This scheme begins with a “popup” that informs the victims their computer has been compromised and directs them to call Microsoft or Apple for assistance.

“Typically, the perpetrators convince the victim his/her financial accounts are at risk and that he/she needs to move money from traditional bank accounts to cryptocurrency to keep it safe from the hackers,” RHS said in a seizure warrant. According to RHS, the perpetrators will then transfer the call to others posing as employees of the fraud department of the victim’s bank to try to convince them to convert money from traditional bank accounts into cryptocurrency to keep it “safe” from hackers. Those funds are then transferred into unhosted virtual currency wallets controlled by the perpetrators. One victim told investigators the scammers provided him with a letter purportedly from the United States Federal Reserve that included what appeared to be the signature of its chair, Jerome Powell.

That victim alleged that the scammers asked him to install a digital currency wallet and a software program that allowed them to remotely access his computers and provided instructions on how to make the money transfers. The victim told investigators between $3-4 million was transferred at the direction of the scammers. According to RHS, the scheme has impacted mostly elderly victims throughout the U.S. At least two known victims live in the Northern District of Illinois.