Exploiter contacted with fund recovery offer as investigation continues