Pig Butchering Scam: How Do You Spot Each Stage?
Pig butchering is a long-con investment fraud: a stranger builds a friendship or romance with you over weeks, introduces a crypto "trading platform" that the scammers control, shows you fake profits, lets you withdraw a little, then pushes for larger deposits and finally demands a "tax" or "fee" before you can withdraw. The money never comes back. The US Treasury's Financial Crimes Enforcement Network (FinCEN) named the scheme in a September 2023 alert, and the FBI counted $7.228 billion in reported crypto investment fraud losses for 2025.
If someone you met online has started talking about a trading opportunity, you are asking at the right time. The scheme runs in a fixed sequence, and every step leaves marks you can check. The map below pairs each stage with the red flags FinCEN published, using official sources read on October 22, 2026.
The Script Map: Seven Stages and the Red Flags Each One Matches
FinCEN's alert (FIN-2023-Alert005) describes the method in four movements: initial contact, the "investment" sales pitch, the promise of greater returns, and what it calls "the point of no return." It then lists red flags in three groups: behavioral, financial and technical. They were written for compliance staff, but most describe things you can see from your side of the conversation. The table splits the method into the seven stages victims actually live through and lines each one up with the matching flag.
| Stage | What it looks like to you | What is really happening | Matching FinCEN red flag (group) | The check you can run at this stage |
|---|---|---|---|---|
| 1. First contact | A "wrong number" text, a message from someone claiming to be an old acquaintance, a dating match, or a friendly approach on a professional networking site | An operator is working through a list of numbers or profiles, waiting for anyone to reply | A new contact who reached out unsolicited online or by text mentions an investment with significant returns (behavioral) | Ask how they got your number. Reverse-search their photos. A real wrong number apologizes and leaves. |
| 2. Trust building | Daily, warm conversation over days or weeks; photos of an expensive lifestyle; the chat moves from the app where you met to a private messaging app | The operator follows a script and collects details about your finances, family and loneliness | No single flag yet; FinCEN notes the profile often showcases wealth and an enviable lifestyle (methodology section) | Notice who keeps steering toward money, success and "financial freedom." Ask for a live video call and see whether it keeps failing. |
| 3. The pitch and the move to a platform | They mention a relative or mentor with a trading method; you are walked through buying crypto at a real exchange and sending it to a website or app they recommend | The website or app is controlled by the scammers; the deposit address belongs to them | A platform with poor spelling, dubious testimonials or amateurish design; a lookalike or newly registered domain; an app installed from a website instead of an official store (technical) | Look the platform up in regulator databases before sending anything. Check how old the domain is. Never install an app from a link sent in chat. |
| 4. The small win | The dashboard shows fast gains; you are allowed to withdraw a modest amount and it really arrives | The withdrawal is bait paid from victims' money, to convince you the platform is real | An incoming transfer at or slightly above an amount you sent earlier, followed by much larger outgoing transfers (financial) | Treat a successful small withdrawal as proof of nothing. A scam can afford to return a few hundred dollars. |
| 5. Escalation | Pressure to add more before a deadline, a "VIP tier," a special event, a loan offer from the platform, or a push to cash out savings or borrow against your home | The scammers are measuring how much more you can reach | Liquidating savings or certificates early, taking a home equity loan or second mortgage to buy crypto, appearing distressed to meet an investment timeline (financial and behavioral) | Any request to borrow, break a retirement account or move home equity into crypto is the moment to stop and call someone you trust. |
| 6. The withdrawal tax | When you try to take out the full balance, the platform says you must first pay a tax, an early-withdrawal fee, a penalty or a "verification" deposit | This is the final extraction; each payment is followed by a new demand | Transfers labeled "taxes," "fees" or "penalties" sent to a crypto platform (financial) | A fee that must be paid in new money before you can touch a balance is the clearest single tell in the whole scheme. Stop paying. |
| 7. Aftermath and the second scam | The contact goes silent or turns hostile; later, someone offers to recover the money for a fee, or claims to be from a law firm or government agency | The same or a related group targets you again, now as a known victim | Not in FinCEN's list; the FBI's 2025 report says crypto investment victims are also targeted in recovery scams | Report through official channels only. Nobody legitimate charges you to get stolen crypto back. |
Two points shape how to use this map. First, FinCEN itself says no single red flag is decisive on its own, and that context and the presence of several flags matter. A wrong-number text alone is usually innocent; one that becomes a friendship and then a trading tip is the full pattern. Second, the pace varies: some operators pitch within days, others spend months on stage 2. The FBI's 2025 report also describes a variant where the "friend" is replaced by an investment group of supposed insiders in a chat app, which skips the romance and goes straight to the platform.
Where the Name Comes From, and How Large the Problem Is
FinCEN's alert explains the name plainly: the scam resembles the practice of fattening a hog before slaughter. The people running it call victims "pigs," spend weeks building a false relationship to "fatten" them, and refer to the theft as the "butchering." The alert notes the term translates the Chinese phrase "Sha Zhu Pan," and that the same schemes are also called confidence scams or, in some cases, romance scams.
The FBI's Internet Crime Complaint Center (IC3) uses the broader category "cryptocurrency investment fraud" in its 2025 annual report, and its description matches FinCEN's, from the first text or dating-app message to the "taxes and fees" charged at withdrawal.
The 2025 numbers from that report:
These are complaints people chose to file, so they understate the true total. The FTC makes the same point about its own data: most fraud is never reported to the government.
Who loses the most: original arithmetic from the IC3 age table
IC3 breaks crypto investment fraud down by the victim's age. Dividing each age group's reported losses by its complaint count gives the average reported loss per complaint, which the report does not print. We did the division ourselves.
| Age group | Complaints | Reported losses | Average loss per complaint (our calculation) |
|---|---|---|---|
| Under 20 | 629 | $12,582,997 | about $20,000 |
| 20 to 29 | 4,627 | $117,353,587 | about $25,400 |
| 30 to 39 | 8,576 | $412,626,617 | about $48,100 |
| 40 to 49 | 10,750 | $924,623,370 | about $86,000 |
| 50 to 59 | 9,856 | $1,383,263,248 | about $140,300 |
| 60 and over | 13,685 | $2,763,921,910 | about $202,000 |
Three things stand out. The average loss rises steadily with age, and people 60 and over lose about eight times as much per complaint as people under 30 ($201,967 against $24,721). That group filed 28.4% of the complaints that reported an age, but accounted for 49.2% of the losses that reported an age. And the age rows add up to 48,123 complaints and about $5.61 billion, less than the 61,559 and $7.228 billion totals, because not every complaint records an age. Across all 61,559 complaints, the average reported loss works out to roughly $117,000.
That fits stage 5: FinCEN reports victims liquidating tax-advantaged accounts and borrowing against their homes to keep "investing," and older savers simply have more to reach.
Stage by Stage: What Each Step Is Designed to Do
Knowing the purpose behind each move is what lets you spot a variation you have not seen before.
First contact is a numbers game
FinCEN lists the channels: text messages and instant messaging, professional networking sites, social media and dating sites. The opening is often a message that seems to be meant for someone else, or an attempt to "reconnect" with an old friend. The FBI's October 2022 announcement on crypto investment schemes describes the same thing: contact through social media or dating apps, from people posing as old contacts, new friends or romantic partners.
A polite reply to a wrong-number text tells the operator a real, friendly person is on the other end. The FTC's analysis of 2022 romance-scam reports found that 40% of people who lost money to a romance scam said contact began on social media. A stranger who answers "sorry, wrong number" with a photo and a question about your job is not making a mistake.
Trust building runs on consistency, not romance
Many victims never think of the relationship as romantic; it may feel like mentorship. FinCEN notes the scammer may claim to be an investor or money manager. The operator writes daily, remembers details, and avoids anything that would test the story, especially live video and meeting in person. The FTC's rule cuts through this stage: never send money or gifts to someone you have not met in person. Its 2023 data spotlight lists, among romance scammers' common lies, posing as a crypto investor who offers to teach you, with any money you "invest" going to their wallet.
The pitch arrives as a favor
The investment arrives as help, not a request: something the contact, or an uncle or mentor, does with "a method" or "insider signals." FinCEN says victims are directed to websites or apps "designed to appear legitimate" that the scammer controls, sometimes real apps with third-party plugins that falsify what you see. Some scammers ask for remote access to open exchange accounts in your name, or for screenshots so they can walk you through buying crypto.
You usually buy the crypto at a real, regulated exchange, then send it out to an address the platform shows you. The exchange is not the scam; the second step is. Once the coins reach the scammers' address they are gone, and the "balance" you see afterwards is a number on a web page the scammers write.
FinCEN's technical flags describe the platform: poor spelling, dubious testimonials, amateurish design, a lookalike or recently registered domain, no physical address, chat-only support, and apps downloaded from a website rather than an official store. A footnote adds that the business is often not registered with FinCEN as a money services business. Our walk-through on looking up a crypto platform in regulator databases shows how to run that check and the equivalent checks outside the US.
FinCEN's case study shows how convincing the copies can be. In November 2022, federal prosecutors in the Eastern District of Virginia announced the seizure of seven domains that spoofed the Singapore International Monetary Exchange. Five US victims sent funds to deposit addresses shown on those sites between May and August 2022, the money was moved immediately through private wallets and swapping services, and the victims lost more than $10 million in total.
The small win is the most persuasive moment
FinCEN states that the scammer may allow a victim to withdraw a small amount to build confidence before urging larger deposits. To the victim it feels like proof. To the scammer it is a marketing cost: a few hundred dollars, paid from other victims' money, buys a much larger next deposit. FinCEN's matching flag describes how this looks in an exchange's records: an incoming deposit at or slightly above an amount sent out earlier, then much larger outgoing transfers. A related flag describes several small "trial transactions" before a switch to high-value wires.
Escalation uses deadlines, tiers and loans
FinCEN describes deadline pressure, requests to bring in friends and family, and fake "play-to-earn" games. The FBI's 2025 report adds that platforms offer loans to encourage larger investments, which also gives the scammers a "debt" to hold over you later. FinCEN's flags at this stage include early liquidation of savings such as certificates of deposit, home equity loans or second mortgages used to buy crypto, and a customer who seems anxious to access funds to meet an investment timeline. If a bank teller or exchange agent asks unexpected questions about a large transfer, they may be following exactly these indicators, and their questions are worth answering honestly.
The end: a tax demand, then silence or a second approach
FinCEN calls the last stage the point of no return. The scammer may report sudden losses you must cover, or demand purported taxes or early withdrawal fees when you ask for your money; when you stop paying, contact stops. The silence is not always the end. The FBI's report says these victims are also targeted in recovery scams, and IC3 logged 10,516 recovery-scam complaints with $1.4 billion in reported losses in 2025 (a figure the report says may include the earlier scam losses). Our explainer on how crypto recovery scams target people who have already lost money maps that follow-up script separately.
Worked Example: Why the "Withdrawal Tax" Gives the Scheme Away
This example is hypothetical. Every figure is invented to show the arithmetic, not taken from any case.
Inputs. Over eight weeks, a reader sends three deposits to a platform recommended by an online friend: $5,000, then $15,000, then $40,000, for $60,000 in total. Early on, they withdraw $800 and it arrives in their exchange account. The dashboard now shows a balance of $142,000. When they request a full withdrawal, support replies that a 20% "capital gains tax" of $28,400 must be paid first, by a new deposit, before funds can be released.
Test 1: who would collect a tax? A tax owed to a government is reported and paid to that government through its own process. It is not wired into the trading account that is supposedly holding your money. In the US, for example, crypto gains are reported on your own tax return; our US crypto tax explainer covers how that works.
Test 2: why not deduct it? If the platform really held $142,000 of the reader's money, it could subtract a $28,400 charge and send $113,600. Demanding fresh money instead only makes sense if the $142,000 does not exist.
Test 3: what happens after payment? In the pattern FinCEN and the FBI describe, payment is followed by another demand: an anti-money-laundering review deposit, a penalty for "late" tax payment, an account-upgrade fee. Each looks small next to the displayed balance, which is the trick. If the reader pays the $28,400 and then a $9,000 "verification" deposit, their real loss rises from $59,200 (the $60,000 sent minus the $800 returned) to $96,600, while the dashboard number stays the same fiction it always was.
The decision rule this produces. If a platform requires a new payment before you can withdraw an existing balance, assume the balance is not real, stop all payments, and move to reporting. FinCEN lists transfers labeled "taxes," "fees" or "penalties" to a crypto platform as a red flag in its own right.
Is My Online Friend Scamming Me? A Decision Path
People asking this question are usually looking for a way to be sure without hurting the relationship. The path below is ordered so the early questions cost nothing and the later ones protect your money directly. Answer honestly and stop at the first "yes" that sends you to the right-hand column.
| Step | Question | If yes | If no |
|---|---|---|---|
| 1 | Did contact start with a message from someone you did not know, including a "wrong number" or a reconnection you cannot verify? | Keep going, but note it: this is how most of these schemes start. | Keep going. Real acquaintances can be impersonated, so check step 2 anyway. |
| 2 | Have they avoided every live video call or in-person meeting, with reasons? | Treat the identity as unverified. Do not send money or crypto while it stays unverified. | Continue. Video can be faked, but a working live call lowers the risk. |
| 3 | Has the conversation turned to their trading success, a relative's method, or "signals"? | You are at stage 3. Do not open or fund any account they recommend. | Continue, and watch for this turn later. |
| 4 | Is the platform one they chose, reached by a link they sent, or an app installed outside an official store? | Look it up yourself in regulator databases and check the domain's age. Expect it not to be registered. | Continue. A real, regulated exchange chosen by you is not the warning sign; sending coins out of it to someone else's address is. |
| 5 | Have you been asked to borrow, break a deposit or retirement account, or use home equity? | Stop. This is the escalation stage, and FinCEN lists each of these as a red flag. Talk to someone you trust before anything else. | Continue. |
| 6 | Are you being asked to pay a tax, fee, penalty or deposit before you can withdraw? | Stop paying. This is the final stage. Go to the reporting steps below. | If the platform has never let you withdraw your full balance, test it before sending anything else, and do not add money to make the test "work." |
A "no" at every step does not prove the person is genuine; it may only mean the scheme has not reached the stages that cost money. The most protective habit is simple: never move crypto to a platform someone else picked for you.
If you would like the general red flags that apply to every type of crypto scam rather than this specific script, the FTC-based crypto scam red-flags checklist is the shorter companion to this page.
Who Is on the Other End
FinCEN states that these scams are largely run by criminal organizations based in Southeast Asia, and that many of the people sending the messages are likely victims of human and labor trafficking, working against their will. The FBI's 2025 report says the same: organized criminal enterprises in Southeast Asia using trafficking victims as forced labor.
So the person writing to you may be reading from a script, handing off to colleagues and working under quotas. Patience and apparent sincerity are part of the product, which is why "but they seemed so real" is such a common reaction afterwards.
The FBI's report describes a Scam Center Strike Force, led by the US Attorney's Office for the District of Columbia with the Justice Department's Criminal Division, the FBI and the Secret Service, that is pursuing leaders of scam compounds in Cambodia, Laos and Burma and the US-based infrastructure the scams rely on.
Common Mistakes and Edge Cases
Assuming you are too careful to be targeted. The age table shows losses in every age group, from under 20 to over 60.
Assuming no romance means no risk. FinCEN describes friendship and "old acquaintance" versions, and the FBI describes chat-app investment groups with no one-on-one relationship at all.
Asking the platform's own support for help. Its "compliance officer" or "tax department" is part of the same operation.
Letting someone install remote-access software. FinCEN notes scammers request remote access to victims' devices to open exchange accounts on their behalf. If you allowed it, treat any wallet or account on that device as exposed and secure it from a clean device.
Approving something you did not read in a wallet. Some fake platforms ask you to connect a self-custody wallet. If a token disappeared from a wallet you control after you connected it to a site, read our guide to token approvals and how wallet drainers work and revoke anything you do not recognize.
Hiding it from family out of embarrassment. The FTC's first two steps for a suspected romance scam are to stop communicating and to talk to someone you trust. Shame is part of what keeps victims paying.
If You Are Already Inside the Script
If you have sent money, the steps are short and they work best in this order.
Reporting does not usually bring money back, and nobody can honestly promise that it will. It does create the official record, can help an exchange act on funds that have not moved yet, and connects your case to others run by the same group.
If the loss has left you feeling hopeless or unsafe, please talk to someone today. In the US you can call or text 988 to reach the 988 Suicide and Crisis Lifeline. The FBI's report notes that its Operation Level Up team referred 38 victims to a victim specialist for suicide intervention in 2025. You do not have to carry this alone.
Helping a Parent, Partner or Friend Who Is Being Groomed
Most people inside the script do not believe they are being scammed. The FBI's Operation Level Up, which uses IC3 complaint data to find and warn victims of crypto investment fraud, notified 3,780 victims in 2025, and the report says 78% of them did not know they were being scammed. Since its launch in January 2024 the operation reports more than 8,000 victims notified and $500 million in savings to the people it warned.
That is why arguing rarely works on its own. Questions do better than claims: "Have you withdrawn your full balance?" and "Who would collect a tax from a trading account?" lead the person to the tell themselves. Walking through the stage map together, or running the regulator lookup side by side, is a neutral test rather than an accusation. Focus on the next payment, not the whole story, and agree in advance that any later offer to recover money for a fee will be reported, not paid.
For background on how stolen crypto moves and why nobody can reach into a wallet to pull a payment back, our explainer on what a crypto wallet actually controls is a short, useful read. All of our fraud guides are collected on the scams and fraud topic hub.
Before anyone sends crypto to a platform an online contact recommended, the most useful ten minutes they can spend is checking whether that platform is registered with any regulator, because a fake platform is the one part of this scheme that cannot pass that lookup.
Frequently Asked Questions
What is a pig butchering scam?
It is a long-running investment fraud in which a scammer builds a friendship or romance online, then steers the victim to a fake crypto trading platform that shows invented profits. The victim is encouraged to deposit more and more, and when they try to withdraw, they are told to pay taxes or fees first. FinCEN named the scheme in a September 2023 alert, and the name refers to fattening a hog before slaughter.
How do I know if my online friend is scamming me?
Look at the sequence rather than the person. If contact began with a stranger or a "wrong number," the relationship has avoided live video or meeting, and the conversation has turned to trading profits on a platform they recommend, the pattern matches the scheme FinCEN describes. Do not send money or crypto to anyone you have not met in person, and check any platform yourself in regulator databases.
Why did the platform let me withdraw money at first?
Allowing a small withdrawal is a planned step. FinCEN's alert says scammers may allow a victim to withdraw a small amount to build confidence before urging larger investments. The returned money usually comes from other victims and is a small cost to the scammers compared with the deposits it encourages.
Should I pay the tax or fee to release my withdrawal?
No. A demand for new money before you can withdraw an existing balance is the clearest sign the balance is not real, and both FinCEN and the FBI describe it as the final stage of the scam. A real tax is paid to the government through your own tax filing, and a real platform holding your funds could deduct a fee from them. Stop paying and report the platform instead.
Can I get my money back after a pig butchering scam?
Usually not, and anyone who promises it, especially for an upfront fee, should be treated as a second scam. Reporting to your exchange, your bank, IC3 and the FTC is still worthwhile because it can help freeze funds that have not moved yet and adds your case to investigations of the same network. Recovery, when it happens, comes through law enforcement processes, not paid recovery services.
Is it still pig butchering if there was never any romance?
Yes. FinCEN describes versions that begin as a wrong-number text or a reconnection with an old friend, and the scammer may present as an investor or money manager rather than a partner. The FBI also describes chat-app investment groups that skip the one-on-one relationship and go straight to a fake platform. The common thread is trust built first, then a platform the scammers control.
Sources
CryptosEyes publishes general educational research, not investment, legal, or tax advice. This page describes a fraud pattern from official sources and cannot tell you whether a specific person or platform is legitimate. CryptosEyes does not recommend or refer to any private recovery service. If someone is pressing you right now to send more money to release a balance, stop, and report that request through the official channels above.
Source & Review Basis
This article is reviewed against the source types below. Source links are provided to help readers verify primary documents, market context, and methodology independently.
Methodology, red flags, trafficking context and case study. Checked October 22, 2026.
Crypto investment fraud totals and age breakdown, recovery scams, Operation Level Up. Checked October 22, 2026.
Contact channels and fake tracking platforms. Checked October 22, 2026.
2022 romance-scam contact channels and crypto-investor lie. Checked October 22, 2026.
Consumer warning signs and steps. Checked October 22, 2026.
How treasury data, market metrics, and corrections are reviewed.