← All terms

Pig Butchering Scam

Pig butchering is a long-con investment scam where fraudsters build trust over weeks, then lure victims into fake crypto platforms and drain their funds.

Pig butchering (from the Chinese sha zhu pan, "killing pig plate") is a long-con investment fraud in which scammers "fatten up" a victim — building trust and rapport over weeks or months — before "butchering" them: persuading them to move ever-larger sums into a fraudulent investment platform, usually cryptocurrency, and then vanishing with everything. Unlike a phishing email that wins or loses in seconds, pig butchering is patient, industrialized social engineering, frequently run from scripted call-center-style compounds operated by organized crime groups.

How it works

Contact typically begins with an innocuous "wrong number" text, a dating app match, or a social media approach (see smishing). The scammer never opens with money. They chat about daily life, build a friendship or romance, and casually showcase a prosperous lifestyle. Eventually they mention an investment they have been profiting from — usually crypto trading on a slick platform the victim has never heard of.

The platform is the trap. It is a fully functional fake: charts move, balances grow, and small early withdrawals are honored to prove legitimacy. Encouraged, the victim invests more — savings, retirement funds, sometimes loans. When they finally try to withdraw a large amount, "taxes" and "fees" appear, extracting even more before the platform and the friend disappear together.

The scale is enormous. The FBI's IC3 2025 annual report counted $20.9 billion in reported cybercrime losses for the year, with cryptocurrency-linked fraud — the category pig butchering dominates — accounting for roughly half. Employees targeted personally can also become an enterprise problem: financial distress and shame are classic precursors to insider risk, and the same rapport-building playbook is used against finance staff in corporate contexts.

How to defend against it

  • Treat unsolicited contact + investment advice as one signal. However long the relationship, a friend you have never met steering you toward a trading platform is the pattern itself.
  • Verify platforms independently — regulator registries, app store provenance, and independent reviews. A platform that only exists via a link your contact sent is disqualifying.
  • Know the withdrawal-fee tell. Legitimate exchanges do not demand upfront "taxes" to release your own funds.
  • Include long-con scenarios in security awareness training so employees recognize slow-burn manipulation, not just malicious links.

Related terms

Social EngineeringSocial engineering is the practice of manipulating people into giving up confidential information, access, or taking actions that compromise security.SmishingSmishing (SMS phishing) is a social engineering attack that uses text messages to trick recipients into clicking malicious links or sharing sensitive information.PretextingPretexting is a social engineering technique where the attacker creates a fabricated scenario to gain the victim's trust and extract information or access.Invoice FraudInvoice fraud tricks a company into paying a fake or altered invoice, typically by impersonating a real supplier and changing the bank account details.
See your Human Risk Score

NOUSEC simulates attacks across 8 channels and turns the results into one number your board can read.

Book a demo