Has anyone ever recovered their stolen gil? Any advice?

[Packetdancer]

That may be true though as someone else mentioned the link is fairly obvious especially considering the OP mentioned they normally ignore links. Sure the most simple answer is a simple laspe in judgement but a part of me does wonder if that is the entire story.

Was thinking maybe the link seems far more legit or something.

If it's the one I'm thinking of, it can look very much like a real forum link at first glance (right downto the usual /ffxiv/threads/<numbers>-<title-breadcrumb> path), if you don't notice that the URL uses something like "com.xyz", instead of just ".com" in the hostname; just skimming over the link visually can be enough to look valid to someone tired/stressed—an unfortunately common situation right now given this whole "global pandemic" thing—even when they know better.

I've seen commentary from other normally-cautious players who were caught off-guard by the link on a day when they were tired/stressed, logged in, and got the /tell and saw a URL which their brain processed as "yeah, that looks like a real forum link", went "Huh, what fuss are people raising now?" and copied/pasted it in before their brain kicked in and they went "Oh crap no wait." Thankfully, most I know of caught themselves before entering login information ("Hey, wasn't I logged in on the forum already?") and others caught themselves when they hit a password autofill using 1Password/Keepass/LastPass/whatever and it didn't show a valid user/password for that site (which made them look at the address bar and go "Oh wait that's not the real site").

This current announcement at the beginning of each FFXIV session may have let me drop my guard:

The Moogle Treasure Trove The Hunt for Law event is underway until patch 5.3 maintenance. Details: https://sqex.to/5vczI

I followed that link before and reached an official page with useful information.

FWIW, anything Square-Enix links to in-game will show up in the server MOTD, and in-game URLs will pretty much always use the sqex.to URL shortener. But yes, having SE already providing official links to events there can contribute if folks are already a little hazy due to stress or exhaustion.

That said, I highly recommend using a password manager, and using it to log in to sites (as noted above). If you ended up on a scam site, even if you were tired/not paying as close attention, hitting 'Autofill' will show no password for the site, which is usually enough to shock people back out of complacency and make them look at the URL in the address bar more closely.

Regardless, sympathies.