Pig Butchering Scam

A pig butchering scam is a confidence fraud in which a scammer makes unsolicited contact, spends weeks or months building a relationship, and then introduces the target to a supposedly lucrative investment on a platform the scammer controls. The account statements, the balances and the gains on that platform are fabricated. Money sent to it is not invested in anything; it goes to accounts the scammer and their associates control.

The name is unpleasant, and it is the criminals' own metaphor rather than the agencies' or ours. FinCEN explains it directly: "These scams are referred to as 'pig butchering' as they resemble the practice of fattening a hog before slaughter. The victims in this situation are referred to as 'pigs' by the scammers." The phrase also translates a Chinese term, Sha Zhu Pan, which FinCEN notes "loosely translates to pig butchering".

The official vocabulary is worth knowing, because it splits. The U.S. Treasury's Financial Crimes Enforcement Network titled its 2023 alert "FinCEN Alert on Prevalent Virtual Currency Investment Scam Commonly Known as 'Pig Butchering'" and made "FIN-2023-PIGBUTCHERING" a key term that financial institutions are asked to include when they file a suspicious activity report. The FBI's Internet Crime Complaint Center, meanwhile, described the identical scheme at length in its 2025 annual report under the heading Cryptocurrency Investment Fraud, and the phrase "pig butchering" does not appear in that document at all. Both labels are in current official use, and both are narrower than the conduct: FinCEN records scammers increasingly using electronic funds transfers, wire transfers and foreign exchange contracts as well as virtual currency, and the FBI's 2025 description has victims offered guidance on trading cryptocurrency or gold.

The contact is engineered to look like an accident. FinCEN's description is that the scammer typically makes first contact "through text messages, direct messages on social media, or other communication tools and platforms, usually under the guise of accidentally reaching a wrong number or trying to re-establish a connection with an old friend", and may communicate through instant messaging services and text messages, professional networking sites, social media and dating sites. The scammer "may claim to be an investor or money manager" and "may also create a social media profile which showcases wealth and an enviable lifestyle". The FBI's 2025 report adds that the conversation is moved quickly to a messaging platform, which takes it off any system that might flag it.

The platform is the whole fraud, and it is not always a fake website. FinCEN describes three variants. The scammer may direct the victim to fraudulent virtual currency investment websites or applications designed to look legitimate; may use "legitimate applications with third-party plugins that allow the scammer to manipulate or falsify information presented to the victim"; or may request remote access to the victim's own devices to open accounts on their behalf. Victims are also instructed to take screenshots of their screen so the scammer can walk them through buying virtual currency. The significance of the second variant is that a victim who verifies the app is real, and finds that it is, has verified nothing.

The permitted withdrawal is the most useful thing on this page. FinCEN records that once the victim has sent money, "the scammer will show the victim extraordinary returns on the investment that have been fabricated", and "may even allow the victim to withdraw a small amount of that investment to further build the victim's confidence before urging the victim to invest more." So the single test most people would apply, taking some money back out to check that the platform works, is a test the scheme is built to pass. The money that comes back is the victim's own money, returned as a sales cost.

The escalation is where the financial damage actually happens, and it is specific. FinCEN's alert states that "victims have been known to liquidate holdings in tax-advantaged accounts or take out home equity lines of credit (HELOC) and second mortgages on their homes in order to increase their investments." That is the point at which a loss stops being an amount of savings and becomes a tax bill, an early-withdrawal penalty and a lien on a house. The FBI's Operation Level Up reported stopping one victim from cashing out $750,000 from a 401(k) and another from selling her house to invest $500,000.

The exit is a fee, and it is designed to extract one last payment. FinCEN: "If the victim attempts to withdraw their investment, the scammer may demand that the victim pay purported taxes or early withdrawal fees." The FBI's 2025 report says the same, that victims "will be charged taxes and fees as a final attempt to exploit money from the victims before the scammers disappear with all the victim funds." A demand for new money before a withdrawal will be released is a documented feature of this scheme rather than an incident of it: where a genuine platform charges a fee or withholds tax, it ordinarily deducts the amount from the balance rather than asking for a separate payment first.

The person on the other end is often not the beneficiary. The FBI's 2025 report describes these operations as "largely perpetrated by organized criminal enterprises based in Southeast Asia using victims of human trafficking as forced labor to run the scam operations", and FinCEN records that a significant number of the scammers who make contact "are likely victims themselves of human and labor trafficking rings operated by criminal organizations and are perpetrating such activity against their will". This is worth knowing for a practical reason as well as a human one: the individual sending the messages usually has no authority over the money and no ability to return it.

How large it is, as of one report. In its 2025 Internet Crime Report the FBI stated that cryptocurrency investment fraud "was the highest source of financial losses to Americans in 2025 with $7.2 billion reported in losses", and reported the Investment crime type overall at 72,984 complaints and $8,648,617,756. Its Operation Level Up, launched in January 2024 to identify and notify victims, reported for 2025 that 3,780 victims were notified, that 78 percent of those victims were unaware they were being scammed, that estimated victim savings were $225,871,319, and that 38 victims were referred to a victim specialist for suicide intervention. Since launch the operation reported surpassing 8,000 total victims notified and $500 million in savings. The 78 percent figure is the one worth carrying: at the point an outside party could see the fraud, most of the people inside it could not.

What belongs elsewhere. Recovery, where to report, the payment-method tell, and the follow-on approach from someone offering to recover the loss for a fee are shared across every scheme of this kind and are covered under fraud. Where the relationship itself is the instrument and the ask is money for a life event rather than an investment, that is a romance scam.

1. Unsolicited contact, framed as a wrong number, a mistaken reintroduction, a networking message or a dating match.

2. The conversation moves to a messaging app, away from whichever platform it started on.

3. Weeks or months of ordinary conversation, during which no investment is mentioned and nothing is asked for.

4. The introduction to a platform, presented as the scammer's own source of wealth, sometimes with an offer to guide each step or to set the account up remotely.

5. Fabricated gains appear, and a small withdrawal is permitted on request.

6. The escalation, with larger sums drawn from savings, retirement accounts or home equity.

7. The withdrawal request, met with a demand for purported taxes or early withdrawal fees, followed by silence.

A hypothetical example of how the arithmetic lands. Ramona sends $15,000 to the platform. It shows a balance of $41,000 within a month. She asks to withdraw $2,000 and the money arrives in her account in two days, which she treats as proof the platform is real.

She then borrows $60,000 against her home and sends that too. The displayed balance reaches $180,000. When she asks to withdraw it, she is told a 20 percent withholding tax is due first: 20% × $180,000 = $36,000. She sends $20,000 of it, and the messages stop.

Total sent: $15,000 + $60,000 + $20,000 = $95,000. Total received: $2,000, which was her own money. Net loss $93,000, and $60,000 of that is now secured against her house. Note that the $2,000 withdrawal, the only verifiable event in the whole sequence, is what made the $60,000 possible. Figures are illustrative.

There is no upside here, so what follows is why the scheme works on people who are not careless, and what can be checked before money moves.

Why it works

• Nothing is asked for during the first phase, so the ordinary instinct to suspect a request never fires. Often weeks pass with no mention of money.
• The platform can be a genuine application with a manipulated plugin, so verifying that the app exists confirms nothing.
• A small withdrawal is allowed on request, which converts the reader's own verification step into the scheme's strongest evidence.
• The displayed gains are large and consistent, and the account is under the victim's own login, which feels like control.
• The FBI reported that 78 percent of the victims it notified in 2025 were unaware they were being scammed, so failing to recognize it is the normal outcome rather than an unusual one.

What can be checked

• Whether the platform is a firm registered anywhere. An entity that cannot be found in any regulator's records is a finding on its own.
• Whether the balance can be verified anywhere other than on the platform's own screen, which for a manipulated display it cannot.
• Whether a withdrawal requires a separate payment first. A genuine platform ordinarily deducts any fee or tax from the balance instead.
• Whether anyone has proposed borrowing against a home or drawing from a retirement account. Both are documented features of this scheme rather than incidental to it.