Pig butchering

What it is

Pig butchering is an investment scam wrapped in a relationship. Someone you have never met starts a conversation — a wrong number, a friendly reply on a dating app, a LinkedIn message about your industry — and then does something no ordinary scammer does: nothing. For weeks. They ask about your day. They send photos of their lunch. They remember what you told them last Tuesday. By the time money is mentioned, the person raising it is not a stranger; they are the person you talk to most.

The ask, when it comes, is not a request for money. It is an invitation to do what they are already doing: trading crypto, or gold, or foreign exchange, on a platform they have been using successfully. You install an app or open a web dashboard. It has charts, an order book, a support chat, a verification flow. Your first deposit shows a gain within a day. If you try to withdraw a small amount, it arrives in your wallet.

From there the scheme takes everything it can reach. Not just savings — the operators push for loans, remortgages, borrowing from family, retirement accounts. The number on the dashboard keeps rising, which is what makes each additional deposit feel rational. The platform is a rendering. There is no trading, no counterparty, no custody. The FBI recorded $8.6 billion in reported investment-fraud losses in the United States in 2025 alone, of which cryptocurrency investment fraud was the largest single component at $7.2 billion.

How it actually works

1. Contact that looks like an accident

   A message arrives that appears misdirected — a wrong number confirming a dinner reservation, a “hi, is this Michelle?” — or a warm approach on a dating app, Instagram or LinkedIn. Profiles are attractive, plausible and lightly aspirational: a business owner, a designer, someone who travels. The apology-and-chat that follows a “wrong number” is not a recovery from a mistake. It is the opening move.

2. Weeks of relationship, with no ask

   Conversation moves quickly to WhatsApp, Telegram or Line. There is no request for money, no link, no pitch. This phase can run one to three months and is the whole reason the scheme works: it converts a stranger into a trusted person before anything is asked of you. Voice notes are common; video calls are refused, deflected, or increasingly faked.

3. Wealth mentioned in passing, never pushed

   Investing enters as biography, not advice. They mention an uncle in finance, a strategy they learned, a good month. If you ask about it, they are reluctant. The reluctance is the pitch — you end up asking to be included, which makes the decision feel like yours.

4. A small deposit that performs

   You are walked onto a platform that looks institutional. The first deposit is deliberately modest. It gains. The interface is responsive, the support agent is polite, and there is a real verification process — all of which signal legitimacy to someone who has never had to audit an exchange.

5. One successful withdrawal

   You take a small amount out and it arrives. This is the pivot point of the entire scheme. Nothing else buys credibility as cheaply, and nothing else reliably produces a much larger second deposit. If you remember one thing about this page, make it this: an early withdrawal that works is evidence of the scam, not against it.

6. Escalation, with help

   Deposits grow. The scammer invests alongside you, or appears to. When you hesitate, they suggest ways to find more — a loan, a credit line, family, a retirement account. Some operations offer “loans” inside the platform itself, which manufacture a debt you now feel obliged to trade out of.

7. The withdrawal is blocked

   You try to take out a serious sum. Now there is a tax. Then a compliance fee, an anti-money-laundering deposit, an account-upgrade requirement. Each one is payable only from new money, never from the balance shown on screen — which should be impossible if the balance existed. This is the stage where a victim’s own money is used as the reason to send more of it.

   Where it could have stopped

   Any fee that must be paid from outside a balance you can see is proof the balance is not real. A genuine platform deducts fees from your funds. Stop here, send nothing more, and report it.

8. Silence, then a second approach

   The account is frozen or the contact disappears. Weeks later someone gets in touch offering to recover the funds — a “blockchain investigator”, a lawyer, a government-sounding agency. They want a fee. This is the same industry selling to the same list. See recovery scams.

Why it works

The mechanics are ordinary. The psychology is not, and it is worth naming precisely, because “they were greedy” and “they were naive” are both wrong and both stop people asking for help.

Time is the weapon. Almost every fraud defence people carry — be suspicious of strangers, don’t click links, if it sounds too good to be true — is calibrated for a fast attack. This scheme spends one to three months making sure that when the pitch arrives, it does not come from a stranger. You cannot be suspicious of a stranger who is no longer one.

The ask is engineered to feel like your idea. Investing is introduced as something the scammer already does and is mildly reluctant to discuss. Reactance does the rest: the more they hold back, the more the target pushes to be let in. People defend decisions they believe they made.

The early withdrawal converts belief into knowledge. Before it, you trust a person. After it, you have personally tested the system and it worked. That shift is extremely hard to reverse, which is why the operators spend real money on it.

Sunk cost, then debt. Each deposit makes withdrawal feel closer and abandonment more expensive. By the time borrowed money is in, stopping means admitting a loss that cannot be quietly absorbed. The scheme’s most reliable engine is the victim’s own reluctance to have wasted everything so far.

Isolation is deliberate. Targets are told the opportunity is private, that family will not understand, that mentioning it risks the allocation. Australia’s National Anti-Scam Centre found older Australians reported the highest total losses of any age group, and secrecy is a recurring feature of the highest-loss reports.

Shame keeps it going and keeps it hidden. People who realise what has happened often do not report, which is exactly why the FBI’s most effective single intervention has been telling victims they are being scammed before they work it out themselves — almost 9,000 people contacted, an estimated $562 million saved.

Where it comes from

This is one of the few scam types with a well-documented physical geography, and the documentation is official rather than inferred.

The operations run substantially from compounds in the Mekong region. The UN Office of the High Commissioner for Human Rights, in its 2026 report “A Wicked Problem”, put the workforce at at least 300,000 people originating from 66 countries, and found that 74% of all scam compounds are still located in the Mekong sub-region. Individual compounds can hold thousands to tens of thousands of workers; some exceed 500 acres and function as self-contained towns behind fortified walls.

The US Treasury has named specific sites. Its September 2025 designations covered nine targets in Burma and ten in Cambodia, naming Shwe Kokko in Karen State, Burma, and Sihanoukville, Bavet and Pursat Province in Cambodia. In October 2025 the US and UK jointly designated Cambodia’s Prince Group as a transnational criminal organisation, alongside a Justice Department forfeiture action covering approximately 127,271 bitcoin — about $15 billion, the largest in the department’s history.

The workforce is largely not there by choice. Treasury describes recruitment under false pretences followed by debt bondage, violence and the threat of forced prostitution; escapees have reported being held for ransom, beaten for missing quotas, and forced into commercial sex work. The UN report documents torture, sexual violence and food deprivation. In February 2025 some 7,000 people were released from operations along the Thailand–Myanmar border in a little over two weeks.

Two qualifications matter. First, this is about criminal enterprises and the territories where they have found protection — not about the nationalities of the people in the compounds, who come from dozens of countries and are frequently the victims of a separate crime. Second, the geography moves. The UN report records operations spreading to Pacific Island countries, South Asia, the Gulf States, West Africa and the Americas. Enforcement in one place relocates the industry rather than ending it.

Real cases

Red flags

• The conversation began with a message that was not meant for you. A wrong-number text that turns into a friendship is a scripted opening, not a coincidence.
• Weeks of warmth, then investing comes up. Ordinary friends do not follow that arc; this scheme always does.
• They will not video call, or the call is short and strange. Refusals get creative — a broken camera, a bad connection, a shy personality. Deepfaked calls now exist, so a call that happens is not proof either.
• The platform came from them. Any app, link, QR code or “install this” that reached you through the relationship. Real brokers are found by you, on your own regulator’s register.
• An early withdrawal worked. Treat this as the strongest single indicator that you are inside the scheme, not outside it.
• You are asked to pay a tax or fee before withdrawing. No legitimate platform requires new external money to release your own balance.
• Deposits go to a wallet address or a personal bank account rather than a named, regulated institution — and the address changes between deposits.
• You are encouraged to borrow. Loans, credit lines, remortgaging, family money, retirement accounts. No legitimate investment relationship pushes this.
• You have been asked to keep it to yourself. “Don’t tell your bank what it’s for” is not discretion. It is the scheme protecting itself from the one person who might stop it.
• Someone contacts you afterwards offering to recover the money. That is the second scam, and it works on the same list.

If it’s happening to you

If you have not sent money yet. Stop replying. You do not owe an explanation and you will not win an argument — the person on the other end is working from a script, often under duress. Do not tell them you have worked it out; simply stop. Screenshot the conversation, the platform and the wallet addresses before you block anything, then report it.

If money has already gone. Move today; the first hours matter more than anything else you will do.

1. Call your bank’s fraud line. A transfer that has not settled can sometimes be recalled, and your bank can freeze further payments. Say the words “I have been scammed” — banks have a process that starts with them.
2. If it went to crypto, contact the receiving exchange immediately. Send them the transaction hashes. Exchanges can and occasionally do freeze deposits, but only if they hear quickly.
3. Report it to your national agency. This is what generates the intelligence behind takedowns like the ones on this page. See where to report in your country.
4. Preserve everything. Screenshots, phone numbers, profile URLs, wallet addresses, transaction hashes, the platform’s domain, the app installer if you still have it. Do not delete the app before you have it recorded.
5. Tell one person you trust. Isolation is a load-bearing part of this scheme, and it does not end when the money does.
6. Expect the recovery approach and refuse it. Nobody legitimate charges an up-front fee to recover stolen crypto. If a “recovery” contact reaches you, that is new evidence for your existing report, not a solution.

What not to do. Do not send one more payment to release the balance — there is no balance. Do not pay for recovery. And do not carry this on your own: people who lose money to this scheme lose it because it was engineered by an industry, not because they were foolish.

Where the money goes

Deposits leave on a rail that cannot be reversed — cryptocurrency, a bank transfer to a mule account, occasionally a cash courier. From there the funds are consolidated, split across wallets, swapped between tokens and chains, and moved through over-the-counter brokers who exchange them for local currency outside any exchange that would ask questions. The UN’s report describes the standard path: mule bank accounts, conversion to virtual currency, movement through crypto wallets, laundering by over-the-counter brokers, then reintroduction into formal banking. That the Prince Group forfeiture found roughly 127,271 bitcoin sitting in unhosted wallets shows how much of it never returns to a regulated institution at all.

By the numbers

No agency publishes a line item for most of the schemes on this site, so these charts show the official categories that contain this scheme. Each series is labelled with the agency's own category name. See how the mapping works.