Pig Butchering and Investment Scams: A Detection Guide for Institutions

Pig butchering is a long-term con where criminals develop a fake relationship with a victim over weeks or months, then direct the victim’s trust to a fake investment platform, and persuade the victim to deposit larger and larger sums of money before vanishing with the money. The victims believe they are investing, not being robbed. This makes it inherently dangerous, because detection has to rely on the transaction data an institution can see, not on the victim's own awareness.

That means watching both ends of the chain at once is required. The growing "investment" payments leaving the victim's account, and the mule accounts receiving and redistributing those funds before they are converted to cryptocurrency. By the time a scam has progressed this far, the victim's own awareness rarely stops it. The real point of intervention is whoever is watching the transactions, while there is still money to save.

The following topics are going to be covered in this article;

1. What Is Pig Butchering?
2. How the Scam Works: The Five-Stage Lifecycle
3. The Romance-Investment Blend: Where Pig Butchering Overlaps with Romance Scams
4. The Laundering and Mule Connection: Where Fraud Becomes AML
5. Red Flags for Financial Institutions: What to Watch For
6. Detection and SAR Filing: How to Respond
7. The Scam Compound Ecosystem: Industrial-Scale Fraud

1. What Is Pig Butchering?

Pig butchering, also known as romance-baiting or crypto investment fraud, is a type of fraud where criminals build up a trusting relationship with a victim over a period of weeks or months before persuading the victim to invest in a fraudulent platform, mostly crypto-based platofrms. The victim is allowed to make larger " investments steadily" until the platform vanishes and the money is gone.

The name comes from the Chinese term sha zhu pan, roughly "pig-butchering plate." The victim is the "pig," fattened up with steadily rising paper returns on their investment before being "slaughtered," stripped of everything they put in.

Most of the reporting on pig butchering has so far framed the problem at the level of the individual consumer to lose money. However, in practice catching such scams is the responsibility of institutions, not the individual being groomed by the scammer. Typically by the time a person is far enough into a fake relationship to wire funds to be invested on a pseudo crypto platform they are in no position to recognize the full pattern of fraud.

The institutions can see the pattern. The bank's fraud analyst who notices a customer's balances draining through escalating transfers, the exchange's compliance officer who sees a flood of deposits landing on one account, and the AML officer reviewing the account at the receiving end.

2. How the Scam Works: The Five-Stage Lifecycle

It’s important to understand the whole chain because each stage is a discrete point where an institution can intervene. Most institutions only have visibility at Stage 4.

Stage 1 - Contact:

The scammer starts contacting the victim on dating apps (Tinder, Bumble, Hinge), social media (Instagram, LinkedIn, WhatsApp) or through “wrong number” text messages. Photos are deepfake now, and AI is used to make profiles. Much of this work is often carried out by workers who are themselves victims of trafficking from scam compounds in South East Asia, the Philippines, Laos, Myanmar and Cambodia.

Stage 2 - Grooming (1–4 weeks):

Texting each other every day, whether it’s about romance or friendship/mentorship, creates trust. By providing fabricated “personal” details, photos and voice messages, the scammer’s stated goal is to build an emotional investment before any financial request. This whole stage is being automated at scale by AI chatbots. It is important to distinguish this from a pure romance scam, which it will be discussed in more detail below. The grooming mechanics are almost identical, but the direction they lead is not.

Stage 3 - The Investment Hook:

The scammer casually tells you that he has been making big returns on this platform and shares fake screenshots of profits. The victim is presented with a fake trading platform, often a convincing copy of a real exchange, with fake portfolio growth and real-time prices.

Stage 4 - Fattening (weeks-months):

The victim will usually send a small deposit, generally between $500 and $2,000. The platform provides instant “returns,” and the victim is permitted to take out a small amount to gain trust, then is encouraged to deposit a larger amount. The average victim deposit over the whole life cycle is between $50,000 and over $500,000. Some victims have taken out loans or liquidated retirement accounts to keep the platform funded.

Stage 5 - Slaughter:

When the victim tries to withdraw a larger amount, the platform requires a “tax payment,” “verification fee,” or “anti-money laundering deposit” before releasing the funds. This is a second scam built on top of the first to extract even more money from the victim. The scammer disappears, the platform eventually closes and the victim loses everything they have left.

For the Institutions, the opportunity to detect is the entire pattern of deposits and withdrawals (not just the last transaction). The behavior signals seen in Stage 5’s withdrawal attempt, the destination accounts that received the funds, and the increasing deposit sequence in Stage 4 all represent multiple, separate opportunities for compliance teams to flag the activity. When a financial institution only looks at the transactions in isolation, these opportunities are missed.

3. The Romance-Investment Blend: Where Pig Butchering Overlaps with Romance Scams

The romance scam also involves a grooming and emotional manipulation process; however, pig butchering has slight modifications

In traditional romance scams, the scammer often asks the victim to make a direct transfer of money to the scammer’s bank account or credit card, often for a fake emergency such as a medical bill. In pig butchering scams, a fake investment platform is created and used as an intermediary for the scam. This one change from traditional romance scams makes a huge difference in how such payments can be detected. While the scammer is grooming the victim and emotionally manipulating them to invest, the victim believes they are being led to believe that they are investing in something, as opposed to giving money to a stranger. Therefore, the payment to the intermediary platform appears to be a normal financial activity by the victim to wire the funds, and even to the bank.

The scale of the shift shows up in the FBI's numbers. In 2024, IC3 recorded $5.8 billion in losses to cryptocurrency investment fraud, the category that captures most pig butchering, across 41,557 complaints, and investment fraud was the costliest crime type it tracks overall at $6.57 billion. That far exceeds the traditional confidence and romance scam category, a measure of how much more lucrative the investment-platform model has made this fraud.

Much of the classic romance-scam playbook still applies like grooming, emotional manipulation, and a gradual escalation of demands. The first red flag is often the same, a new online relationship that appears out of nowhere, followed by signs of financial urgency and secrecy. What separates the two is where the money goes. A romance scam ends in a person-to-person payment to an individual, while pig butchering ends in a transfer to a crypto exchange or a wire to an investment platform that exists only to rob its users.

4. The Laundering and Mule Connection: Where Fraud Becomes AML

A single pig butchering payment moves through three distinct stages, each owned by a different control. First, the victim sends funds they believe are an investment into an account controlled by the scammers, often a mule account. That is the fraud event. Next, the mule moves the money onward, to other mules or out to cryptocurrency, which is the laundering stage. Finally, that crypto is layered through mixers or chains of wallet-to-wallet transfers and cashed out at a weak-KYC exchange, which is where sanctions evasion enters the picture.

This is now a reality. The October 2025 designation by OFAC of 146 individuals and entities tied to the Prince Group Transnational Criminal Organization, the Cambodia-based network run by Chen Zhi that Treasury and the Justice Department identified as operating forced-labor scam compounds. It followed Treasury's September 2025 designations of other Burmese and Cambodian scam facilitators. These are more than just fraud designations but they create live sanctions obligations. Financial institutions worldwide must now screen new and existing customers, and any related activity, against these parties. That is a clear sanctions duty.

The entire chain of events requires three capabilities that are typically operated by three different teams. Institutions that treat the fraud detection of payer behavioral patterns of payers, the AML transaction monitoring for mule accounts and the sanctions screening of known compound operators for OFAC-prohibited activities separately will undoubtedly fail to connect the dots between them.

5. Red Flags for Financial Institutions: What to Watch For

The warning signs differ by institution type, because each sits at a different point in the flow of funds.

For retail banks and neobanks as the victim's bank, are positioned to spot the scam at the source.

Key signals include:

• A customer with no history of crypto activity who suddenly begins sending funds to crypto exchanges.
• A customer who drains savings, or takes out a loan, to fund a "new investment opportunity."
• A customer who behaves abnormally on a call or branch visit, appears coached, or seems to be reading from a script.
• Behavioral signals such as hesitation during login or copy-pasted payment details, which can indicate a customer acting under instruction.
• A customer who becomes defensive or secretive when asked the reason for a large outgoing transfer.

Crypto exchanges and Virtual Asset Service Providers (VASPs) sit at the point where funds enter crypto.

Suspicious patterns include:

• New accounts receiving multiple fiat deposits that are immediately used to buy cryptocurrency.
• Rapid conversion to stablecoins followed by transfer to an external wallet.
• Multiple accounts logging in from the same device, IP, or phone signature.
• Transactions involving wallet addresses that blockchain analytics have already flagged as scam-linked.

Payment processors and Money Services Businesses (MSBs) see the cross-border and structuring layer.

Watch for:

• International wire transfers to unfamiliar countries with no prior history.
• Transfers structured to stay just below reporting thresholds.
• A customer using multiple payment methods to pay the same destination.

6. Detection and SAR Filing: How to Respond

Consistent execution of a well-defined response workflow for a single alert turned into a well-documented case. It should be started by treating each alert as a potential case, which began with the alert itself either being generated by a behavioral rule (e.g. anomaly detection) or the analyst actually seeing the pattern unfold before their eyes. The first step of assessing whether the observed activity was ‘pig-butchering’-type involved cross-checking the observed grooming timeline and subsequent escalation against the established pig-butchering indicators.

Once you have confirmed the activity fits the pig butchering typology, it is worth the team's time to reach the customer directly before taking any account actions. The FBI’s Operation Level Up has already notified thousands of potential victims of this type of their involvement in a scam and 77% of the notifications sent to the victims, the victims were unaware that they had been the victim of a scam at the time the notifications were sent. This type of early intervention can save thousands of dollars as a simple block or freeze of an account does not recover money that has already been sent to a scammer, whereas early intervention could stop the next deposit from being sent.

After customer intervention has been attempted to stop the crime, account actions, such as holding, blocking, or placing a transaction restriction, can be taken, depending on the investigator’s level of confidence and jurisdiction. Where appropriate, a SAR should also be filed using the key terms for an investment scam SAR as found on FinCEN’s web page.

The case should then be closed and referred to law enforcement for further action, i.e., an FBI IC3 report, report to local law enforcement, or report to the appropriate state or regional FIU.

Documentation of the completed case should include:

1) A detailed timeline of the transactions of the victim(s);

2) All relevant communication(s); and

3) Account and transaction details for the respective platforms involved.

7. The Scam Compound Ecosystem: Industrial-Scale Fraud

Pig butchering is not the work of lone, freelance fraudsters. These scams are industrialized, run from fortified compounds in Cambodia, Myanmar, Laos, and the Philippines that hold thousands of workers, many of them trafficking victims forced to work there against their will under threat of violence. As of March 2025, INTERPOL reported that victims had been trafficked into scam centres from 66 countries. Estimates from the US Institute of Peace put the annual revenue of Cambodia's scam industry alone at around $12.5 billion, close to half the country's GDP. Because these operations often hide behind seemingly legitimate businesses such as casinos, real estate firms, and even licensed crypto exchanges, fraud detection alone cannot dismantle them. Enforcement action from authorities is required.

The enforcement response has escalated sharply over the past year. In October 2025, the Department of Justice indicted Chen Zhi, chairman of Prince Holding Group, in what prosecutors called one of the largest investment fraud operations in history, alongside a record $15 billion cryptocurrency forfeiture. Then, in a coordinated takedown announced in May 2026, the FBI, Dubai Police, and China's Ministry of Public Security dismantled nine scam compounds across Myanmar, Indonesia, Cambodia, and Thailand, arrested 276 individuals, and seized more than $701 million in assets.

This creates a direct obligation for compliance teams. They must now screen their customers and transactions against the compound operators and entities OFAC has sanctioned. What was once purely a fraud detection problem is now a fraud-and-sanctions problem, and neither half of that obligation can be ignored. You can check any name with Sanction Scanner's 'Free Sanction Check'.

Sources:

[1] Financial Crimes Enforcement Network. FinCEN Issues Alert on Prevalent Virtual Currency Investment Scam Commonly Known as "Pig Butchering". 2023.

[2] Federal Bureau of Investigation, Internet Crime Complaint Center. 2024 Internet Crime Report. 2025.

[3] U.S. Department of the Treasury, Office of Foreign Assets Control. Transnational Criminal Organizations Designations: Prince Group TCO. 2025.

[4] U.S. Department of Justice. Chairman of Prince Group Indicted for Operating Cambodian Forced-Labor Scam Compounds Engaged in Cryptocurrency Fraud Schemes. 2025.

[5] Congressional Research Service. Cryptocurrency Investment Scams. 2025.

[6] U.S. Department of Justice. Coordinated Takedown of Scam Centers Leads to at Least 276 Arrests; Alleged Managers and Recruiters Charged in San Diego. 2026.

[7] INTERPOL. INTERPOL Releases New Information on Globalization of Scam Centres. 2025.

[8] United States Institute of Peace (via ReliefWeb). Transnational Crime in Southeast Asia: A Growing Threat to Global Peace and Security. 2024.

Minhac Celik

Marketing Lead

View full profile →