A pig butchering scam is an investment fraud in which a scammer builds a relationship with someone before directing them to a fake investment opportunity. The relationship makes the pitch feel personal and credible. The apparent investment is designed to take their money.
The FBI describes these schemes as confidence-enabled cryptocurrency investment fraud. The familiar nickname is derogatory; understanding the mechanism is more useful than blaming the people targeted.
How does the scam develop?
Contact can begin through texts, social media, professional networks, investment groups or dating services. The scammer develops what appears to be a professional, friendly or romantic connection before introducing an investment.
A convincing website or app may display a balance and supposed profits. The FBI notes that some scammers even allow an early withdrawal to build confidence and encourage larger deposits. A successful small withdrawal therefore does not establish that the platform is legitimate.
When someone tries to retrieve more of their money, the platform may refuse. The balance on screen was never reliable evidence that the money was invested as claimed.
What warning signs matter?
Be cautious when an online contact introduces an investment and directs you to a platform they control or insist you use. Promised returns, pressure to increase deposits and difficulty withdrawing funds deserve independent scrutiny.
An attractive interface is not proof of legitimacy. Neither is a convincing profile or an account balance shown by the same service seeking your money.
Verify the claimed business and contact through independently obtained sources, not the links or phone numbers supplied by the person making the pitch. Do not send more money to test whether an unfamiliar investment is real.
Why is this a digital risk problem?
The relationship is only part of the operation. Messages, profiles, domains and apps can support the same fraud. A complaint about one page may reveal a wider set of connected assets.
The FBI says its Operation Level Up shares illicit domains and accounts with the private sector so organizations can consider action. For a brand team, a fraudulent platform may also involve misuse of its identity or a false affiliation claim.
Outtake Recon Agent describes tracing an initial signal through ownership, hosting and infrastructure relationships. That investigation can inform reports and remediation. It does not mean every connected asset is malicious or that removing a website recovers stolen funds.
What should someone do if they suspect fraud?
Stop sending money and contact the relevant bank or exchange promptly. The FBI recommends filing a complaint with the Internet Crime Complaint Center. Outside the United States, contact the appropriate local reporting authority.
Preserve the messages, exact website addresses, account identifiers and payment records. For cryptocurrency, IC3's guidance asks for receiving addresses, amounts, transaction hashes, and transaction dates and times. Keep this information for verified reporting channels rather than posting sensitive records publicly.
Be wary of people who promise recovery, especially services demanding an upfront fee. A recovery offer can be another attempt to take money from someone already harmed. No recovery outcome should be assumed.
How can organizations respond?
Give customers a clear official channel for reporting suspected impersonation. Keep the complaint and supporting evidence together, verify the claimed affiliation, and assign ownership for investigation and abuse reporting.
For a broader explanation of how trust is manipulated, read What is social engineering defense?. Supporting people who report concerns is part of the response, not an admission that they should have recognized the scam sooner.
Sources
Reviewed October 2, 2026.