In 2022, a software engineer in San Francisco lost $1.5 million to a months-long WhatsApp relationship. He believed he had met the woman by coincidence. She messaged him first, a wrong number, she said, looking for a restaurant recommendation. They talked daily for weeks. She was warm and intellectually curious. She mentioned that her uncle worked in finance and had introduced her to a cryptocurrency trading platform with remarkable returns. She was not pushy about it. She mentioned it the way someone mentions a good restaurant. He tried it. He made money. Then he deposited more. Then he lost everything, and the woman, the platform, and everyone he had been speaking to disappeared. ProPublica and the New York Times both documented this case and dozens like it across 2022 and 2023. The money was gone. There was no recourse. The FBI received more than 40,000 investment fraud complaints in 2023, when IC3 logged $4.57 billion in losses.
The short answer. Pig butchering is a long-con investment scam. A stranger builds a warm relationship with you for weeks or months, usually over WhatsApp or a dating app, then introduces a fake crypto trading platform. Small early withdrawals work, which builds trust, so you deposit more. When the balance is large, withdrawals suddenly fail and “tax” or “fee” payments are demanded. The platform is fake and the money is gone. The red flags: a stranger made accidental-looking first contact, the investment came only after personal bonding, and the platform isn’t listed on FINRA BrokerCheck or the SEC’s EDGAR. Verify any platform before you send a dollar.
This scam type has a name: pig butchering. The name comes from a Chinese phrase, 杀猪盘 (shā zhū pán), which translates roughly to “pig slaughter plate.” The metaphor is agricultural and deliberate. You fatten the pig before you slaughter it. Rushing the process produces a smaller yield. The scam is optimized for patience.
What Pig Butchering Is
Pig butchering is a form of investment fraud that combines extended social engineering with a fake trading platform. Unlike a phone scam that resolves in a single call, pig butchering operates over weeks or months. The relationship-building phase is not incidental to the scam — it is the mechanism. By the time the victim deposits money into a fraudulent investment platform, they trust the person who introduced it. That trust has been built deliberately, over dozens of conversations, personal disclosures, shared experiences, and emotional intimacy.
The operation originated in Southeast Asia and expanded globally over the following decade. Investigative reporting by the International Justice Mission, the Associated Press, and Al Jazeera documented the conditions inside the scam compounds in Myanmar, Cambodia, and the Philippines where this work is performed. Many of the individuals running scripts on the other end of these WhatsApp conversations are themselves victims. They are trafficked workers, recruited with fake job advertisements for legal employment, then forced to run fraud scripts under threat of violence. The BBC estimated in 2023 that hundreds of thousands of people were being held in these compounds across the region.
Understanding the origin matters for one practical reason: the person you are speaking to is operating from a script. They are not a rogue individual. They are part of a production system with defined roles, shift schedules, and performance metrics. The warmth, the coincidental first contact, the gradual escalation — all of it is documented procedure.
The Five-Stage Playbook
The scam follows a sequence that fraud researchers have mapped with enough precision that it reads like a flowchart.
Stage 1: The chance contact. The first message is designed to look like a mistake. A wrong number. An accidental connection request on LinkedIn. A match on a dating app where the person seems unusually thoughtful and almost too compatible. The accidental framing is important because it explains why a stranger is reaching out and removes any suspicion of targeting. The conversation that follows is light and without any financial dimension. Weeks may pass before money is mentioned at all.
Stage 2: Trust-building. Daily contact, genuine-seeming personal disclosures, photos, voice messages, sometimes video calls using real footage or deepfake technology. The person playing the role of the new friend or romantic interest is trained to mirror the target’s interests and emotional needs. If the target expresses loneliness, the contact provides companionship. If they express financial stress, the contact demonstrates financial success. Every conversation is moving toward a specific destination, but nothing about it feels transactional. This stage can run for two to three months.
Stage 3: Platform introduction. The investment platform is introduced casually and with apparent reluctance. The contact does not pitch it. They mention it offhandedly, then downplay it when the target shows interest. They explain that their uncle set up the account for them, that it is not really something they discuss, that they feel awkward recommending financial products to friends. This friction is manufactured. It functions as social proof: something that must be extracted is more valuable than something freely offered. The target eventually asks to be shown how the platform works.
Stage 4: The profit run-up. The target deposits a small amount — a few hundred dollars. The platform shows immediate gains. The interface looks real: live charts, order books, trade confirmations, a customer service chat. The target deposits more. Gains continue. At this stage, the fraudulent platform is showing the target a number that represents money they do not have. There is no actual investment activity. The UI is displaying whatever figure the operators choose to display. The target may withdraw small amounts early on, and those withdrawals go through — this is intentional. It proves the platform is real. The target tells friends. Some of them join. Deposits grow.
Stage 5: The slaughter. When deposits reach a target threshold — typically in the tens or hundreds of thousands of dollars — withdrawal attempts begin to fail. The customer service team explains that a tax payment is required before funds can be released. Or a compliance fee. Or an account verification charge. The contact, still present, encourages the target to pay it. The tax is paid. A new fee appears. Each payment extracts more money. Eventually the platform goes dark, the contact disappears, and the money is gone.
How the Fake Platforms Work
The investment platforms used in these scams are custom-built software. They have real domain names, SSL certificates, professional design, and live-looking market data pulled from legitimate sources to make charts and price feeds look authentic. They display fake account balances, fake trade histories, and fake profit summaries. The customer support team is part of the operation.
Some platforms have impersonated real, regulated financial institutions. The Financial Industry Regulatory Authority (FINRA) maintains a BrokerCheck tool at finra.org/brokercheck that lists registered US broker-dealers and investment advisers. The Securities and Exchange Commission’s EDGAR database at sec.gov/cgi-bin/browse-edgar lists registered investment entities. When a platform claims to be SEC-registered, the registration number can be verified directly. Pig butchering platforms either use fabricated registration numbers, stolen registration numbers from real dormant entities, or jurisdiction-shop to countries with minimal oversight.
The profit run-up mechanism works because the victim never actually withdraws their full balance. They see a number. They may withdraw a small portion, which goes through. But the large balance exists only as a number on a screen. The operators control what that number says.
Why Intelligent Adults Fall For It
The fraud exploits specific psychological mechanisms that have nothing to do with intelligence. A software engineer, a physician, a retired executive — these are among the documented victims because the scam is not designed to fool people who are credulous. It is designed to fool people who are forming genuine social bonds.
The first mechanism is manufactured social proof. The contact is not a stranger; by the time the platform is introduced, they are someone the victim has spoken to every day for weeks. The victim has met their “family” in photographs. They know details about the contact’s life that feel intimate. The recommendation comes from within an established relationship.
The second mechanism is gradual escalation. The first deposit is small enough to feel like an experiment. Each subsequent deposit is anchored to the previous one and to the visible balance in the account. When someone has $47,000 showing in an account, depositing another $3,000 to bring it to $50,000 feels proportionate to what they have already committed.
The third mechanism is sunk cost. Once a victim has lost $200,000 and been told that paying $30,000 in “tax” will release the funds, the $30,000 looks like 15% of recovery rather than more loss. The operators understand this and time the fees to arrive when the victim’s sunk cost is high enough that the fee looks rational by comparison.
The fourth mechanism is the exploitation of loneliness and connection. Many victims describe the relationship that preceded the fraud as genuinely important to them. The loss is not only financial. There is a compound grief: the money is gone, and so is someone who felt real.
Contact Vectors
The wrong-number contact on WhatsApp is the classic delivery method, but the operation runs across every platform where strangers talk. LinkedIn contacts claiming to be in finance or tech who want to connect over shared professional interests. Instagram DMs from accounts with hundreds of posts and a plausible personal history. Dating app matches, particularly on Hinge, Tinder, and Bumble, where the match is attractive and unusually communicative. Telegram groups around investing topics where a participant begins a private conversation.
The scripted openers are recognizable once you know them. The accidental message. The “I got your number from a mutual friend.” The “I noticed your profile and thought you seemed interesting.” The platform introduction always follows a trust-building period, and always arrives as something the contact is reluctant to recommend.
Scale and the Southeast Asia Connection
The FBI Internet Crime Complaint Center’s 2023 Internet Crime Report documented $4.57 billion in investment fraud losses in 2023, up from $3.31 billion in 2022. Investment fraud was the single largest category of reported cybercrime losses. The report notes that cryptocurrency was the dominant payment method and that losses for victims aged 30 to 49 increased by the largest margin year-over-year.
These numbers represent only reported losses. Victims frequently do not report because of shame, because they believe it will not help, or because they do not realize what has happened to them until months later.
The connection to human trafficking is documented and ongoing. The compound workers identified by the International Justice Mission and investigative journalists are people who responded to legitimate-looking job postings for hotel, casino, or tech support jobs in Southeast Asia. They were transported across borders, had their travel documents confiscated, and were forced to operate fraud scripts under threat of beatings, starvation, or sale to other compounds. The UN Office of the High Commissioner for Human Rights (OHCHR) estimated in an August 2023 report that over 220,000 people were being held in Myanmar and Cambodia alone. The financial system powering the scam depends on this labor.
Red Flags That Distinguish This Scam
Several specific indicators differentiate pig butchering from a legitimate investment opportunity.
A stranger initiated the contact, and it felt accidental. The investment platform was introduced only after weeks of personal conversation. The platform is not listed with any domestic regulator — verification takes two minutes on FINRA BrokerCheck or the SEC’s EDGAR. The contact is enthusiastic about the investment but oddly reluctant to recommend it directly. Early withdrawals of small amounts succeed, which functions as proof-of-concept for larger deposits. When a larger withdrawal is attempted, fees are required before release. Customer support for the platform exists only within the app and cannot be independently verified.
Any single one of these is a reason to stop. The presence of multiple is decisive.
What To Do If Money Is Already Gone
The honest answer is that recovery is rare and that the likelihood decreases with time and with how funds were moved.
Act immediately. File a complaint with the FBI’s Internet Crime Complaint Center at ic3.gov. The IC3 forwards complaints to federal, state, and local law enforcement and can initiate coordination with international partners. File a complaint with the FTC at reportfraud.ftc.gov. Contact your bank’s wire fraud department on the same day you realize the fraud occurred. Banks can sometimes start a wire recall within 24 to 72 hours of a fraudulent transfer, though success rates are low.
If funds went to cryptocurrency wallets, firms including Chainalysis and Elliptic specialize in tracing blockchain transactions and have worked with law enforcement on seizure actions. The DOJ announced seizures of over $112 million in pig butchering proceeds in April 2023, coordinated with law enforcement in multiple countries. These seizures are real but represent a small fraction of total losses. Be wary of “recovery services” that promise to retrieve cryptocurrency for an upfront fee. These are almost always secondary scams that target people who have already lost money, as covered in the guide to recovery scams.
Zelle, wire transfers, and cryptocurrency are the preferred payment methods in these scams for a reason. They are difficult or impossible to reverse, unlike credit card payments, which carry dispute rights under the Fair Credit Billing Act. If a victim used a credit card to buy cryptocurrency and then transferred that cryptocurrency, the card-level dispute may still be viable. Raise it with the card issuer immediately.
The psychological impact of these scams is substantial. The Cybercrime Support Network at fightcybercrime.org maintains referrals to counselors and support groups that specialize in fraud victims.
KnytX Scam Shield isn’t live yet. Once it launches, it’s built to flag fraudulent investment contacts before they ever reach your wallet. See how Scam Shield is designed to work →