Server data seized by law enforcement revealed that the same criminal network operated both the initial fake investment scheme and the secondary recovery scam.