What Is a Pig Butchering Scam? How It Works, Explained

A "pig butchering" scam is a long-con fraud that fuses a fake online relationship with a fake cryptocurrency investment: scammers spend weeks or months "fattening up" a target with affection and trust before "butchering" them financially by draining every dollar they can convince the victim to send into a counterfeit trading platform. The U.S. Treasury's Financial Crimes Enforcement Network (FinCEN) and the FBI's Internet Crime Complaint Center (IC3) have both issued formal alerts on the scheme, and the FTC says investment fraud — the category pig butchering falls under — cost Americans more than any other scam type in 2024.

What is a pig butchering scam, exactly?

According to FinCEN's September 2023 alert, pig butchering is "a prominent virtual currency investment scam" in which fraudsters "leverage fictitious identities, the guise of potential relationships, and elaborate storylines to 'fatten up' the victim into believing they are in trusted partnerships" before "butchering" or "slaughtering" them by stealing their assets. The scam is also referred to, or may begin as, a confidence scam or romance scam, because the fraudster builds the victim's trust before ever introducing money.

It is best understood as a hybrid of two older fraud types — the romance scam and the investment scam — stitched together and scaled up using fake cryptocurrency trading platforms. FinCEN notes that pig butchering is "largely perpetrated by criminal organizations based in Southeast Asia," which the FBI has separately linked to scam compounds that use victims of labor trafficking to run outreach campaigns against "millions of unsuspecting individuals around the world."

Where does the term "pig butchering" come from?

The name is a direct translation of the Chinese term sha zhu pan (杀猪盘), which the U.S. Secret Service's alert on cryptocurrency investment scams describes as loosely meaning "pig butchering." FinCEN's alert explains the metaphor plainly: the scheme "resemble[s] the practice of fattening a hog before slaughter." Scammers themselves refer to victims as "pigs" internally, to the relationship-building phase as "fattening up," and to the theft itself as "butchering" or "slaughtering" the victim. It's a cold, internal industry term — not something victims would ever hear used about them, which is part of what makes the scam's scale so unsettling to regulators.

How a pig butchering scam unfolds, step by step

FinCEN's alert, built on FBI IC3 public service announcements and law enforcement case data, lays out a consistent methodology. It generally plays out in five stages.

1. Initial, seemingly accidental contact

The scammer reaches out "under the guise of accidentally reaching a wrong number or trying to re-establish a connection with an old friend," per FinCEN. Contact also comes through dating apps, direct messages on social media, professional networking sites, and instant-messaging platforms, according to the FBI's October 2022 PSA on cryptocurrency investment schemes. The scammer's profile often "showcases wealth and an enviable lifestyle" to appear credible.

2. A real-feeling relationship

Once the target responds, the scammer "will communicate with them over time to establish trust and build a relationship," FinCEN notes — this grooming period can run for weeks or months, with no mention of money or investing. This is the "fattening" phase the scam is named for.

3. The investment pitch and a fraudulent platform

With trust established, the scammer introduces a "supposedly lucrative investment opportunity in virtual currency" and directs the victim to a trading website or app that "appear[s] legitimate, but which [is] fraudulent and ultimately controlled or manipulated by the scammer." Victims are sometimes asked to grant remote device access or are walked through screenshots to buy cryptocurrency and send it to the scammer's address.

4. Fake profits that buy more trust

Once money is in, FinCEN says the scammer "will show the victim extraordinary returns on the investment that have been fabricated," and may even let the victim withdraw a small amount — just enough to feel real — "before urging the victim to invest more." FBI data cited by FinCEN shows victims have liquidated retirement accounts or taken out home equity lines of credit and second mortgages to keep feeding the scheme.

5. The point of no return

When a victim's payments slow, FinCEN describes scammers turning to "more aggressive tactics," inventing fake "losses" the victim must cover with more deposits, or demanding payment of supposed taxes or early-withdrawal fees before any funds can be released. The FBI's September 2021 PSA on romance-investment scams confirms this withdrawal blockade is where many victims first realize something is wrong — and once the victim stops paying, the scammer cuts off all contact and disappears with everything sent.

Why cryptocurrency is central to the scam

Cryptocurrency isn't incidental to pig butchering — it's the mechanism that makes the theft both plausible and nearly impossible to reverse. FinCEN's alert explains that scammers rely on virtual currency because transfers to scammer-controlled wallets and addresses move quickly across borders, can be laundered through "numerous private wallets and swapping services," and — unlike a wire to a named bank account — give victims no traditional recourse once funds leave their control. The FBI's 2022 PSA found that cryptocurrency-related fraud, including pig butchering, made up the majority of the $3.31 billion in investment fraud losses reported to IC3 that year, rising 183% from 2021 to $2.57 billion. The FTC's most recent annual fraud data, published in March 2025, shows investment scams remained the single costliest fraud category for American consumers in 2024 at $5.7 billion — a 24% increase over 2023 — and that consumers lost more money to scams paid through bank transfers and cryptocurrency combined than through every other payment method put together. A companion FTC Data Spotlight on romance scams found that cryptocurrency produced the highest reported losses of any single payment method victims used.

In practical terms: the romance is the delivery mechanism, and the "investment" is the theft. If you strip the dating-app small talk out of a pig butchering case, what's left is a straightforward crypto investment scam — which is why both the FBI and FTC file these cases under investment fraud even when they begin on a dating app.

Red flags at every stage

FinCEN's alert, built for banks watching for suspicious transactions, doubles as a useful checklist for individuals, since the same behaviors show up on both sides of the transaction. The FBI's PSAs add platform- and app-level warning signs.

Reducing how easily strangers can find and research you also lowers your exposure to the first step of this scam. Scammers build convincing profiles using scraped personal data and photos; our comparison of data-removal services like DeleteMe, Incogni, and Aura walks through how that kind of exposure gets reduced. It's the same underlying instinct — don't trust an unverified message — behind our explainer on QR code "quishing" scams, another fraud built on hijacking a moment of trust.

Real cases and patterns regulators have documented

FinCEN's alert includes a documented case: in November 2022, the U.S. Attorney's Office for the Eastern District of Virginia announced the seizure of seven domain names used in a pig butchering scheme. Court records show that from roughly May through August 2022, scammers used domains spoofing the Singapore International Monetary Exchange to convince five U.S. victims they were investing in a legitimate cryptocurrency opportunity. After victims transferred funds to scammer-controlled deposit addresses, the money was immediately routed through numerous private wallets and swapping services to obscure its source. Combined, those five victims lost more than $10 million.

The pattern holds at scale. The FBI's September 2021 PSA documented more than 1,800 romance-scam complaints to IC3 between January and July of that year alone, totaling roughly $133.4 million in losses — before the "pig butchering" term had even entered common regulatory use. FinCEN also points to a May 2023 FBI PSA on fraudulent job advertisements linking scam compounds to labor trafficking, underscoring that many of the people typing the messages victims receive are themselves coerced workers inside criminal operations based largely in Southeast Asia, not independent fraudsters.

What to do if you or someone you know is being targeted

• Stop sending money immediately and do not download any app or create any account the contact directs you toward.
• Verify independently. Search the person's photo and any claimed company or exchange name separately from what they've told you; the FBI's October 2022 PSA flags misspelled domains and amateurish site design as common tells.
• Don't explain yourself or confront the scammer before you've secured your accounts — simply stop responding.
• Talk to someone you trust before making any financial decision tied to the relationship, especially large transfers, loans, or liquidating retirement funds.
• If the target is an older relative, the Department of Justice's National Elder Fraud Hotline (833-372-8311) is staffed specifically to help, per FinCEN's guidance for referring elder victims.

What to do if you've already sent money

FinCEN's guidance for banks doubles as guidance for victims: if you try to withdraw and are told you owe taxes or fees first, that is the scam revealing itself — do not pay it. The FBI's PSAs are explicit that additional payments almost never result in released funds; they simply extend the loss. Contact your bank or crypto exchange immediately to report the transfers and ask whether anything can be frozen or recalled, then change passwords and enable multi-factor authentication on your financial and email accounts, since scammers who had remote access or screenshots of your devices may have more than just the money. A password manager that generates and stores unique logins — we compare two popular options in 1Password vs. Dashlane — makes it faster to lock down every account at once rather than reusing a password a scammer may have seen.

Keep every piece of evidence: usernames, phone numbers, screenshots of conversations and the fake trading dashboard, wallet addresses, and transaction records. That documentation is exactly what investigators need, and it's required information when filing a report.

How and where to report a pig butchering scam

Report to all of the following — each one plays a different role, and filing with more than one does not slow any of them down:

• FBI Internet Crime Complaint Center (IC3): File at ic3.gov. This is the FBI's primary intake for cryptocurrency fraud and is the channel FinCEN directs financial institutions to send victims to.
• Federal Trade Commission: File at ReportFraud.ftc.gov, as recommended in the FTC's own consumer guidance on romance scams. FTC reports feed directly into the Consumer Sentinel database used by law enforcement nationwide.
• Securities and Exchange Commission: FinCEN's alert directs pig butchering victims to the SEC's Tips, Complaints, and Referrals system at sec.gov/tcr to report the investment-fraud component specifically.
• Your bank or crypto exchange: Report the transaction immediately; speed matters for any chance of a freeze or recall.
• The platform where contact started: Report and block the scammer's profile on the dating app, social network, or messaging platform, per FTC guidance.
• DOJ National Elder Fraud Hotline (833-372-8311): For victims age 60 and older, per FinCEN's referral guidance.

Reporting does not guarantee recovery of lost funds — the FBI and FTC are both candid that crypto sent to a scammer is rarely retrievable — but it is still the step that matters most beyond your own household. IC3 and FinCEN both use aggregated victim reports to trace wallet addresses, identify scam networks, and support the kind of domain and asset seizures documented in FinCEN's case study above. Your report can be the data point that connects a bigger case.

Written bySana Qureshi

Sana Qureshi runs the security and privacy desk. She reports on actively exploited vulnerabilities, vendor patches and data breaches, and covers the password managers, VPNs and authentication tools readers use to protect themselves. Her alerts cite vendor advisories, CISA and the CVE record directly.

More from Sana QureshiAll Security & Privacy coverage