Correption
Menu
HomeBlogAboutContact

Pig Butchering Scams: How Crypto Investment Fraud Works, Stage by Stage

How pig butchering scams turn a friendly stranger into a fake crypto investment: the stages, who runs them, warning signs, and what to do if money is gone.

By Correption Editorial Desk9 min read
On this page

The short answer: a "pig butchering" scam is a long con in which a stranger builds a friendship or romance with you over weeks, then talks you into "investing" in cryptocurrency on a platform they control. The profits you see are fake. When you try to withdraw, you are asked for taxes or fees, and then the money and the person disappear. If a new online contact is steering you toward a trading app, stop sending money, call your bank or exchange, and report it to the FBI at ic3.gov (or Report Fraud in the UK).

The scheme is back in the headlines. At a White House event on cybercrime on 21 October 2026, the FBI director said the bureau had taken down 20 scam compounds around the world, Reuters reported. Two days earlier, California Attorney General Rob Bonta issued a consumer alert noting that Americans lost $11.4 billion to cryptocurrency scams in 2025, and urged people never to use a cryptocurrency ATM. The numbers behind those statements come from the FBI's 2025 Internet Crime Report, which names cryptocurrency investment fraud as the single largest source of reported losses: $7.2 billion in one year.

This explainer walks through how the scam works stage by stage, who runs it, the warning signs, and what to do if you or a relative is already in one.

This is a general awareness guide based on the official sources listed at the end. It is not legal or financial advice.

Why it is called "pig butchering"

The name is a translation of the Chinese phrase sha zhu pan. In its 2023 alert on the scheme, the US Treasury's Financial Crimes Enforcement Network (FinCEN) explained the metaphor: scammers "fatten up" victims with attention, trust and small apparent wins, then "butcher" them by taking everything at once. FinCEN also noted that many of these scams begin as romance or "confidence" scams and only later turn into investment pitches, which is why the FBI counts them as cryptocurrency investment fraud rather than romance fraud.

In 2024 INTERPOL urged police and media to say "romance baiting" instead, because the old label shames victims and can stop them coming forward. The mechanics are the same whatever it is called.

How the scam works, stage by stage

The FBI's description in its 2025 report follows a consistent pattern. Not every case hits every step, but most follow this order:

  1. The first contact looks accidental. A "wrong number" text, a dating-app match, a LinkedIn or Instagram message, or an invitation to an investing group. The FBI says contact typically starts through text messages, social media, ads or dating apps.
  2. The chat moves off the platform. Within days you are asked to switch to WhatsApp, Telegram or another messaging app, away from the safety tools of the site where you met.
  3. Weeks of grooming. Daily good-morning messages, photos of a glamorous life, shared worries about money. There is no request for money yet; the point is trust.
  4. The "opportunity". Your contact, or an "investment group" of supposed insiders, mentions they make steady returns trading crypto or gold and offers to show you how. You are sent to a specific website or app.
  5. Small wins. You deposit a modest amount and the dashboard shows impressive gains. Often you are allowed to withdraw a little, which makes the platform feel real.
  6. Escalation. You are pushed to add more: savings, retirement money, a home-equity loan. The FBI says victims are even offered "loans" from the platform to invest bigger sums.
  7. The exit fee. When you try to cash out, the platform says you owe tax, a "verification" charge or an anti-money-laundering deposit first. Paying it never unlocks anything.
  8. The second scam. After the platform goes dark, "recovery experts", fake law firms or people pretending to be government officials offer to get your money back for an upfront fee. The FBI warns that victims are deliberately targeted again this way.
Video: Avoid 'pig butchering' scams with these tips: FBI by 11Alive (YouTube)

Who is behind it

This is not usually a lone fraudster. The FBI says these scams are "largely perpetrated by organized criminal enterprises based in Southeast Asia", often using victims of human trafficking as forced labour to run the chats. In other words, the person typing to you may themselves be held in a compound against their will.

Government action shows the scale. On 14 October 2025 the US Department of Justice unsealed an indictment against the chairman of Cambodia's Prince Group, alleging that the conglomerate ran forced-labour scam compounds, and filed a civil forfeiture complaint against about 127,271 bitcoin, then worth roughly $15 billion. The charges are allegations, and a defendant is presumed innocent unless proven guilty. The same day, the Treasury sanctioned 146 targets in what it called the Prince Group transnational criminal organisation and moved to cut the Cambodia-based Huione Group off from the US financial system, alongside UK sanctions. The FBI's 2025 report also describes a new Scam Center Strike Force at the US Attorney's Office in Washington, DC, which works with the Secret Service, Treasury and the State Department against the compounds.

For the bigger picture on how offshore money flows hide the proceeds of crime, see our explainer on tax havens and banking secrecy.

Warning signs to take seriously

  • A stranger who "texted the wrong number" stays friendly and keeps the conversation going.
  • They avoid live video calls, or the video looks oddly smooth. AI face and voice tools are now part of the toolkit; our guide to deepfake scams explains what to look for.
  • They steer you to a particular trading site or app, especially one you cannot find in an official app store or that was sent as a link.
  • Returns are steady and high with "no risk". Real markets do not work like that, and steady promised returns are also the signature of a Ponzi scheme.
  • You are asked to keep the investment secret from family or your bank, or to tell the bank the transfer is for something else.
  • You are told to pay by cryptocurrency ATM, wire, or by moving funds out of a retirement account.
  • Withdrawing requires paying a "tax" or "fee" first. This is the clearest sign of all.

One test works well: ask yourself whether you have ever seen the money arrive in a bank account you control. A number on a website is not money.

How to check a platform before you send anything

Search the platform's exact name plus "scam" and look for regulator warnings. In the US, the Commodity Futures Trading Commission keeps a list of unregistered foreign entities (the RED list), and your state securities regulator can tell you whether a firm is licensed. In the UK, check the Financial Conduct Authority's Warning List and Register. Treat any platform that is not on an official register, or that only an online acquaintance has recommended, as unsafe. Hype-driven tokens are a related risk; our piece on crypto market manipulation covers pump-and-dump patterns.

If you have already sent money

  1. Stop sending money, including any "fee" to withdraw. It will not release your funds.
  2. Call your bank, card issuer or the exchange you bought crypto from straight away and tell them it is fraud. Speed matters: in 2025 the IC3's Recovery Asset Team used the banks' Financial Fraud Kill Chain process to freeze $679 million across 3,900 incidents, although most of those cases involved bank transfers (business email compromise, account takeovers) rather than crypto already sitting in a scammer's wallet.
  3. Report it. In the US, file at ic3.gov even if you are unsure, with every wallet address, transaction ID, website URL and username. In the UK, report to Report Fraud. Our step-by-step guide to reporting a scam in the US and UK lists every official channel and what to include.
  4. Keep the evidence. Screenshot chats and the platform's pages before they vanish.
  5. Ignore anyone offering to recover your crypto for a fee, including callers who claim to be from the FBI or the IC3. The FBI has warned that scammers impersonate the IC3 itself.

Sometimes the warning comes from the other direction. Under Operation Level Up, launched in January 2024, the FBI contacts people its data shows are being scammed. In 2025 it notified 3,780 victims, and 78% of them did not yet know they were being defrauded. If you get such a call, verify it independently by calling your local FBI field office using the number on fbi.gov, and remember that a genuine notification will never ask you for money.

Helping a parent or friend who will not believe it

People aged 60 and over reported $7.7 billion in losses to the IC3 in 2025, more than any other age group, but younger people are hit too. Victims are often deeply attached to the person they have been talking to, so arguing rarely works. Ask calm questions instead: have you ever met in person or on a live video call? Have you ever withdrawn the full balance? Who chose the trading app? Offer to try a full withdrawal together. When the "tax" demand appears, the story usually collapses on its own.

Be gentle afterwards. Shame keeps people quiet, and silence is what lets the next scammer in. The FBI's report says 38 of the people it notified in 2025 had to be referred to victim specialists for suicide intervention. The emotional damage is as real as the financial loss.

FAQ

Is a pig butchering scam the same as a romance scam?

They overlap. A romance scam usually ends with a direct request for money (a plane ticket, a medical bill). A pig butchering scam uses friendship or romance as the hook but ends with a fake investment, which lets it take far larger sums.

Can I get my crypto back?

Sometimes, but rarely in full. Recovery is most likely when you report fast and the funds are still at a regulated exchange or bank that can freeze them. Law enforcement seizures can lead to later restitution, but no legitimate agency charges you a fee to recover funds.

Why do scammers use crypto ATMs?

Cash deposited into a crypto ATM is converted and sent to a wallet within minutes and cannot be reversed. The FTC warns that no real business or government agency will ever ask you to pay through a Bitcoin ATM.

Do I report to the FBI or the FTC?

For crypto investment fraud, the FBI's IC3 is the main US intake point; you can also file with the FTC. Filing with both is fine.

Sources

This article is general consumer-awareness information, not legal or financial advice. Figures are as reported by the agencies cited; check the official sites above before you act.

Keep reading

All articles →