Slow Cooked: How a Pig Butchering Scam Hooks You

• The first red flag is the relationship. By the time the fake trading site appears, the grooming has already done its job.
• It works as a sequence rather than a single trick. Trust gets built first, the money ask comes second, and the early “profit” exists to kill your skepticism.
• There is no safe demographic. The FTC says anyone on social media or a dating app who answers an unexpected message is a target, and the cases back that up.
• The losses are huge and still undercounted. The FBI put 2025 crypto investment fraud at $7.2 billion, its single largest category of loss.
• Speed changes outcomes. Operation Level Up flagged 8,103 likely victims by December 2025, 77% of whom had no idea, and reporting early can stop losses before people liquidate everything.

“Pig butchering” is an ugly name for an ugly thing. It comes from the fraudsters’ own slang, and INTERPOL has asked agencies and journalists to use something less dehumanizing, like “romance baiting,” because the older term puts the blame on the victim. U.S. agencies still use it, mostly because the public now recognizes it. Whatever you call it, the mechanics hold. A stranger makes contact, builds a relationship over days or weeks or months, then walks you toward a fake investment platform and keeps you depositing until the door slams shut.

What makes it work is not that victims are stupid. The scam is built as a sequence of small, reasonable-feeling steps. Research on romance fraud shows offenders build emotional dependence before they ever mention money. They use “near-win” effects to keep people committed. They lean on tragedy, urgency, shared future plans, and quiet isolation from anyone who might talk sense into you. Guidance from the FBI, SEC, FTC, and CFTC describes the same shape: a fast move to WhatsApp or Telegram, heavy daily contact, fake expertise, doctored screenshots, one small successful withdrawal to prove it is “real,” then escalating demands for deposits or “taxes” to unlock funds that were never there.

Try the leading VASP data free for 1 month. No card required.

The damage is financial and human at once. The FTC reported $12.5 billion in U.S. fraud losses for 2024, $5.7 billion of it in investment scams. The FBI reported that crypto investment fraud was the biggest source of financial loss to Americans in 2025 at $7.2 billion, and that by December 2025 its Operation Level Up had flagged 8,103 likely victims, 77% of whom did not know yet, while estimating more than $511 million in prevented losses and referring 80 people for suicide intervention. UNODC, the DOJ, Treasury, and INTERPOL all place these scams inside a larger machine that runs on trafficking, coercion, and organized scam compounds, concentrated in Southeast Asia but spreading.

The fake platform is the part you are meant to notice. The relationship is the part that gets you there.

This is a sensitive topic. If you or someone you know is dealing with the fallout of a scam and struggling, that distress is worth taking seriously, and talking to a trusted person or professional can help.

Where it came from, and how it runs

The cleanest way to understand pig butchering is as relationship-enabled investment fraud. The SEC calls it a “long con”: the fraudster builds trust through friendship or romance, then talks the target into a fake investment. The FBI and CFTC describe the same arc. Someone reaches you online or by text, works on you emotionally, then points you at a crypto scheme that looks profitable right up until you try to take money out.

The phrase comes from Chinese criminal slang, and specialists cited by Reuters say the pattern started in China before scaling outward through transnational organized crime. The industrial center of it now sits in Southeast Asia, where groups have run large scam compounds in places including Myanmar, Cambodia, Laos, and the Philippines, often staffed with trafficked workers forced into the outreach. UNODC and INTERPOL both warn the model is no longer regional. It has pushed into Africa, Latin America, Europe, and the Middle East as pressure builds in the Mekong region.

Part of why it spreads so well is that it is modular. The “relationship” can be romantic, or just friendly, or professional, or staged as an accident. The label is interchangeable. What stays fixed is the unsolicited contact, a move to a private channel, trust-building, a plausible investing story, fake profits, escalating deposits, and finally a wall between you and your money.

First contact comes through a wrong-number text, a dating match, a social DM, an ad reply, or a group invite. The conversation then moves to WhatsApp, Telegram, or some other channel that is harder to monitor. Grooming follows: daily contact, flattery, mirroring, an emotional bond, and a steady supply of reasons the two of you cannot meet yet. Then the pitch, usually framed as “I can teach you” crypto or forex or gold. You open a real exchange account and send funds onward to a second platform or wallet. Fake profits appear on screen, and a small withdrawal might even succeed. Then the pressure climbs: invest more, borrow, liquidate, avoid outside advice. Eventually, the account freezes, and “taxes” or “release fees” are demanded for money that does not exist. Often, there is a final stage, the recovery scam, where a new helper offers to get your money back for another upfront fee.

Buy bitcoin and stocks. Signup to Coinbase today

The FBI’s own breakdown maps almost exactly onto this. Its public guidance notes that scammers commonly start on social media, by text, on dating platforms, or in WhatsApp and Telegram groups, ask to move the conversation, mirror your circumstances, pitch an investment once trust is built, walk you through converting money into crypto, allow early withdrawals to manufacture legitimacy, then block withdrawals and start demanding fees. The variants differ only at the hook. A romance-led scam runs on intimacy and future plans. A wrong-number variant runs on casual “new friend” banter. A group-chat variant uses fake testimonials and the feel of a community. A job or task scam tells you that you are earning commissions but have to keep depositing to unlock them. Underneath, the machine is the same.

The psychology that makes it work

The scam exploits human decision-making in order, one lever at a time. Whitty’s work on romance fraud found that offenders groom victims before any money request, that the decision errors involved look like the ones seen in other fraud contexts, and that the “near-win” phenomenon helps explain why people stay in, or get pulled back in a second time. That last point is the one to sit with. Once you get an emotional reward, a small “profit,” or a withdrawal that clears, the fraud stops feeling hypothetical. It starts feeling personally confirmed.

The persuasion runs on a constructed narrative. The scoping review by Coluccia and colleagues describes a typical romance-fraud dynamic lasting six to eight months, with a deep emotional bond built around permanence, tragedy, and deadlines. Talk of marriage or a shared future. Stories about bereavement, injury, bad luck, being stuck overseas. Urgent pressure to send money so the relationship can continue or a meeting can finally happen. Those same mechanics carry straight into pig butchering. The emotional frame goes in first, to lower your guard, and the investing story arrives afterward.

Think of the manipulation as a stack. Grooming builds trust, trust gives the person’s advice weight, and fake profits create commitment. Official warnings note the offender often claims expertise, insider access, or a family connection to successful trading, and backs it with screenshots, fake testimonials, and altered images or video, sometimes while impersonating a licensed professional or firm. So the scam works several biases at once: authority through faked expertise, social proof through fake groups, scarcity through time-limited windows, commitment through deposits that keep growing after a first apparent win, and sunk cost once real money is already gone.

Then there is isolation. The FBI explicitly warns that scammers may ask victims to limit contact with family or financial advisors, or coach them on what to tell their bank and law enforcement. The FTC similarly urges people to keep a trusted friend in the loop, because fraudsters prefer secrecy and silence. Skepticism is partly a social function. You are most exposed when the people who would normally reality-check you have been quietly cut out.

The harm is not only money. The research describes a “double trauma.” Victims lose the money and lose what they experienced as a real relationship, then carry shame that suppresses reporting and help-seeking. Cole’s 2024 study found mental-health consequences, sleep disruption, debt, bad encounters with law enforcement, and vulnerability to being targeted again, including suicidal ideation. The Operation Level Up data confirms it operationally: by December 2025, 80 identified victims had to be referred for suicide intervention. And the whole thing increasingly has an industrial psychology. Wang and Topalli describe a “cyber-industrialization” of intimacy fraud, scaled through enterprise processes, software, and customer-service-style management. In some operations the people doing the grooming are themselves controlled, abused, or forced into the role. That does not soften the harm to the victim. It explains why the scam feels so scripted, responsive, and relentless.

Who gets hit, and what it costs

There is no safe stereotype, and that is worth being loud about. The FTC is explicit: almost anyone can be targeted if they are on social media or dating apps and reply to an unexpected message. Public conversation still frames victims as lonely, naive, or old. The complaint data and the enforcement cases say otherwise. Business executives, professionals, retirees, and younger adults all show up. Research does identify risk patterns, Coluccia’s review found recurring associations with female gender, middle age, higher education, sensation seeking, impulsivity, and trust, but Lazarus and colleagues caution that the literature skews heavily toward Global North and English-language data, so the profiles are suggestive at best.

Skip the wait. Buy a licensed company.

The economic harm is large and rising before you even account for underreporting. For 2025, the FBI’s IC3 reported that crypto investment fraud alone caused $7.2 billion in losses, the largest single category in the report, and that Americans who filed crypto-related complaints reported more than $11 billion overall. The channel data tells you where prevention has to start. FTC reporting for 2025 found nearly 30% of people who lost money to a scam said it started on social media, with $2.1 billion in reported losses, and nearly 60% of romance-scam victims said it started there. The FTC also reported $470 million in losses to scams that started with text messages in 2024. Older romance-scam figures help explain the potency: in 2022, crypto and bank wires together accounted for more than 60% of reported romance-scam losses, and the median individual loss for romance-scam payments made in crypto topped $10,000.

The Brooklyn DA said 21 web domains were seized after Brooklyn victims reported more than $5 million in losses, with one victim added to crypto chat groups, shown a fake balance of $387,495, and told to pay taxes to withdraw. The same office later seized 70 linked domains targeting Russian-speaking victims through Facebook ads, including ads featuring a deepfake Elon Musk, with investigators finding shared HTML structure, IP addresses, and registrar patterns across the sites. The DOJ in Massachusetts described a victim who matched with “Nino Martin” on Tinder, moved to WhatsApp, was told he was a financial advisor, and was directed into a fraudulent crypto trading platform. In June 2025 the DOJ filed a forfeiture complaint against more than $225.3 million, saying blockchain analysis connected the funds to crypto investment fraud affecting dozens of confirmed U.S. victims and more than 400 suspected ones worldwide. And in April 2026 the DOJ announced that cooperation with Dubai Police and others led to at least 276 arrests and the dismantling of at least nine scam centers. Europe shows the same scale. Europol said a ring dismantled in Spain had defrauded 5,000 victims worldwide and laundered EUR 460 million.

The early warning signs

The way to catch pig butchering early is to stop hunting for a single dramatic clue and start watching for a pattern of anomalies that arrive together. The scam opens with a relationship irregularity, then adds a channel irregularity, then becomes a money irregularity. When those three stack up, the safe assumption is that you are being groomed.

Unsolicited contact from a stranger or a “wrong number” is a common entry point, not a coincidence, so do not continue the conversation. A quick push to move onto WhatsApp or Telegram cuts moderation and hands the other person more control. Someone who is unusually attentive, flattering, or perfectly aligned with your interests is mirroring you. Someone who always avoids meeting in person, with excuses about military bases or oil rigs or overseas work, is using a classic script, and their photos are worth a reverse-image search. The conversation turning from friendship or romance to investing is the core transition, and that is the moment to end the financial discussion. Promises of high profit and low risk are not how legitimate investments talk. A first small withdrawal that succeeds is bait. Being told to open a crypto exchange account and then move funds to a second site or wallet should stop you cold, because that second destination is often the actual fraud mechanism. A polished platform on a strange or misspelled domain is a spoof. Withdrawal attempts that suddenly trigger taxes or release fees are an extraction move. Requests for your passport, tax documents, or utility bills feed further fraud. And a “recovery” company that contacts you afterward is usually the second scam in the same chain.

The signals are strongest as a sequence: contact, migration, intimacy, investing, fake gains, blocked withdrawal. The earlier you break that chain, the less likely you are to get pulled into sunk-cost thinking or cut off from the people who could help you see it.

Prevention, investigation, and the response

For individuals, the best defense is to add friction before trust turns into compliance. The CFTC advises keeping conversations on the platform where they began, reverse-image-searching profile photos, researching people and firms thoroughly, and checking whether a site’s domain age matches its claims. The SEC says investment decisions should be made independent of any unsolicited contact, and warns that app-store availability, polished design, and fake testimonials prove nothing. The FBI and FTC add the basics that carry the most weight: do not send money, do not invest on the advice of someone you only know online, and do not pay extra taxes or fees to release funds.

For institutions, the message is fairly clear even where parts of it have to be inferred. FinCEN says suspicious-activity reporting and strong Bank Secrecy Act compliance are critical to detecting these scams. Read together, the agency materials imply that banks, exchanges, telecoms, dating apps, and social platforms should be adding friction at key moments: monitoring unusual transfers to scam-linked wallets or freshly registered platforms, surfacing warnings when customers try to move funds shortly after social-media contact, speeding up domain and app takedowns, and sharing intelligence across public and private channels.

The future of finance is here. Trade crypto and more

INTERPOL is pushing more respectful terminology and a wider global framing. FinCEN issued a 2023 alert specific to pig butchering and kept highlighting these scams through 2025 and 2026. The SEC brought its first enforcement actions of this kind in 2024, alleging scammers used WhatsApp, LinkedIn, and Instagram to steer investors toward fake platforms. Treasury sanctioned scam-enabling networks in 2025, including actions tied to Huione and scam hubs in Myanmar and Cambodia. The DOJ created a Scam Center Strike Force in late 2025 and said it had already seized and forfeited more than $401 million, with proceedings filed for another $80 million.

These cases are hybrids, part social engineering, part platform fraud, part money laundering. The FBI asks victims to preserve how the scammer first made contact, plus names, phone numbers, emails, usernames, wallet addresses, exchange accounts, transaction hashes, dates, amounts, domains, the apps used, and the full timeline. None of that is busywork. It is the raw material for tracing, attribution, subpoenas, freezes, and linking victims across separate cases. TRM describes the standard workflow: start from an anchor point like a wallet address or transaction hash, trace inbound and outbound flows, enrich with attribution and open-source intelligence, then document findings in a defensible report. Elliptic adds a behavioral lens, looking for the pattern of initial deposit, bait return, then larger follow-on deposits, and for wallets interacting with multiple victims in similar ways. Because attribution gets harder once funds reach custodial services, the strongest cases combine on-chain mapping with communications records and platform cooperation.

Not every case ends in recovery, but speed helps. The FBI says quick reporting can support recovery efforts, and Operation Level Up’s results show early intervention can stop losses before victims liquidate retirement accounts, sell homes, or take out large loans.

Frequently Asked Questions (FAQ)

Is pig butchering the same as a romance scam? 

Not exactly. It overlaps with romance scams, but regulators increasingly treat it as a broader relationship-investment scam. Instead of asking you directly for emergency money, the scammer pushes you into a fake investment platform and uses the relationship to keep you depositing.

Why would a scammer let me withdraw money at first? 

Because that early withdrawal is often the psychological turning point. The FBI says scammers commonly allow it to reassure victims, and Whitty’s work on near-win dynamics helps explain why people persist. A small success is designed to collapse skepticism and justify larger deposits.

If the app is in a well-known app store, doesn’t that mean it’s legitimate? 

No. The SEC explicitly warns that a popular app store is not proof an app, or the activity inside it, is legitimate. Scammers use polished sites, spoofed domains, and fake dashboards precisely because people treat professional design as credibility.

What if the platform says I need to pay taxes or fees before I can withdraw? 

Treat that as a stop sign. The FBI, SEC, CFTC, and multiple DOJ case summaries all describe demands for taxes, penalties, or release fees as a hallmark end-stage tactic. Paying more almost always deepens the loss.

Try the leading VASP data free for 1 month. No card required.

Can crypto in a pig butchering case be traced? 

Often yes, though tracing does not guarantee recovery. The FBI and DOJ now routinely describe cases where blockchain analysis supported seizures and forfeiture. TRM notes tracing works best when on-chain evidence is combined with exchange records and off-chain intelligence.

What evidence should I preserve immediately? 

Wallet addresses, transaction hashes, dates, times, amounts, screenshots of balances and chats, usernames, phone numbers, emails, URLs, app names, and the full timeline. The FBI asks for those details because they help connect victims, trace funds, and identify infrastructure.

Are recovery companies that contact victims afterward legitimate? 

Usually not. Recovery fraud is common enough that the FBI, SEC, and DOJ all warn about it. If someone claims they have already found your money and only needs an upfront fee, that is a classic second-stage scam.

Are all the scammers willing participants? 

No. Many are, but official sources also show large scam-center operations using trafficked or coerced workers. UNODC, DOJ, Treasury, and Reuters reporting all indicate some of the people doing the outreach are themselves trapped in compounds under abuse or threat.