Pig Butchering Scam: How the Wrong-Number Text Works

A pig butchering scam opens as a wrong-number text or a dating match, never as an investment pitch. After weeks of ordinary conversation, the stranger moves you onto a fake trading platform where your balance is typed in by hand. The scam only reveals itself when you try to withdraw.

The U.S. Secret Service publishes the name the operators gave it: sha zhu pan, pig butchering. It is not a metaphor for cruelty. It is a production schedule in three phases — find the pig, fatten the pig, butcher the pig — and the fattening is the phase that takes weeks. What follows is one case from the first message to the last payment, then the trail the money leaves after it goes.

The case

Call her Sarah. She is not one person. She is a composite, assembled from the pattern in tens of thousands of complaints filed with the FBI and the FTC about this exact scheme, and the amounts in her story are illustrative rather than reported. Every beat below happens, in this order, to somebody today.

Day one. A text arrives from a number Sarah does not recognise. “Hi! Are we still on for coffee tomorrow?” She replies that they have the wrong person. That is where an ordinary wrong number ends. This one does not. The stranger apologises, and does it charmingly. He laughs at himself. He asks one small, harmless question — and the conversation simply keeps going.

Week two. He texts good morning, every morning. Photographs of a dog. A restaurant plate. A view from a balcony one notch more glamorous than hers. He suggests moving to WhatsApp, somewhere more personal, and she agrees, because by now that is what you do with someone you talk to daily. He asks for nothing. No links, no offers, no money. Just attention, in volume, for weeks.

That patience is the whole difference between this and an ordinary romance scam. The FTC puts the median reported romance-scam loss at $1,996. Nobody spends six weeks building a relationship for two thousand dollars. The target was never Sarah’s wallet.

Week six. Money enters the conversation for the first time, and not as a request. He shares. A screenshot of his own crypto account, up on the quarter. An aunt who works at an investment firm. Something he was already doing long before he met her. Sarah asks how it works, which is the point: she asks, he does not offer.

The first door is real. He walks her through opening an account at a genuine, regulated exchange, one she can look up herself. She buys a few hundred dollars of crypto and it is really there. Nothing about this step is fake, and that is what makes it work. She now has proof that he tells the truth about money.

The second door is not. He recommends a better platform, the one his aunt’s firm uses. Professional logo. Login page. Support that answers in minutes. Sarah moves her balance across, and the number starts climbing. She adds more. It climbs faster. Within weeks she is watching her retirement savings grow on a screen that has treated her better than any bank ever has.

None of it exists. The platform is a stage set, and the balance on Sarah’s screen is a figure an employee types into an admin panel, the way you would edit a spreadsheet. Her real money left the moment she transferred it. The profit she is looking at has exactly one job: to justify the next, larger deposit.

The withdrawal. One morning Sarah tries to take a little out, a few hundred dollars, as a test. There is a problem. A tax. Then a processing fee. Then a compliance office that needs one more payment before funds can be released. Each payment is small compared with the balance on the screen, which is the arithmetic the whole design depends on. She is not buying an investment any more. She is paying ransom on a number.

The silence. One day the app does not load. The messages stop. The profile is gone. And here is the detail worth carrying out of this case: Sarah’s mistake was not trusting a stranger. It was assuming there was a stranger. On the other end of that chat there was a shift schedule, a script, and a quota.

How it works, step by step

Eight moves, in order. Each one does a specific job, and the reason it works is not technical.

1. First contact looks like an accident. A text to the wrong number, a dating-app match, a friendly reply to a comment. There is no offer, no link and nothing to check. It works because suspicion needs an object. A message that asks for nothing gives you nothing to refuse, so the only available response is politeness.
2. The conversation moves to a private app. Usually WhatsApp or Telegram, framed as more personal. The CFTC lists this move among the warning signs of these frauds. It works because it removes the conversation from any platform that might flag the account, and out of sight of anyone who knows you well enough to say that sounds off.
3. Weeks pass with no mention of money. Good-morning texts, photos, voice notes, a video call that is always cut short. The CFTC calls this phase grooming; the Secret Service calls it fattening. It works because it is not building affection. It is building your certainty that you already know who you are talking to, so that later the introduction of money reads as a disclosure between friends rather than a pitch from a stranger.
4. Investing arrives as a detail, not an offer. A relative at a fund. A method the family already uses. A screenshot shared, not sent. It works because you ask the questions. Nobody defends themselves against information they requested, and consent obtained by curiosity feels like your own idea.
5. The first door is genuinely real. The account at the regulated exchange is a real account. It works because it converts a claim into evidence. After it, every later instruction inherits the credibility of the one thing you were able to verify.
6. The money then moves to a platform only they can show you. Clean interface, live-looking charts, responsive support. It works because the interface is the only evidence you are given, and interfaces are cheap. Your balance is a value in their database, editable at will, and the rising line exists to make the next deposit feel like the obvious move rather than a risk.
7. Small profits invite bigger deposits. The gains arrive early and look modest enough to be believable. It works because a number going up recruits you into managing it. You stop asking whether the platform is real and start asking how much more you should put in — and the answer to the second question is never less.
8. The trap closes at the withdrawal, not at the deposit. Deposits are frictionless. Withdrawals require a tax, then a fee, then a compliance hold, then an anti-money-laundering charge. It works because each payment is small next to the balance you can see, and because sunk cost argues on their behalf. The obstacles are not obstacles. They are the product, and the fees are the only real money in the room.

Who is actually on the other end of that chat

Not a lonely man with a dog. This is not a scam that happens to work at scale; it is a scale operation that happens to use romance. What sits on the other side of the conversation is an office floor: shift workers, team leaders, scripts, quotas and performance bonuses for the keyboarders who keep the most conversations warm.

One worker runs dozens of conversations at once from a script that has been optimised the way advertising copy is optimised — which opening line gets replies, which photograph builds trust fastest, which day of the relationship to introduce the relative who works in finance. The good-morning texts are not written for you. They go out like a newsletter.

That is why nobody is in a hurry, and why six weeks of patience is affordable. Your six weeks are a fraction of one shift, running in parallel with dozens of other people’s six weeks.

It is also why the person typing is frequently not free to stop. The UN Human Rights Office has documented at least 300,000 people from 66 countries inside these compounds, many recruited by fake job adverts for customer service and tech support, then held. INTERPOL has tracked the same model spreading well beyond South-East Asia, with victims in more than 60 countries. Victims, operated by prisoners, managed by criminals — which changes who you should be angry at, and changes nothing about the money.

Where the money goes

Follow the payments, and the shape of the business becomes visible.

Rail one: the crypto transfer. Sarah’s money left her bank as an ordinary purchase on a licensed exchange. It left her control when she transferred that crypto to an address the operation gave her. Crypto is the requested rail for a reason: it settles in minutes, crosses borders without asking permission, and cannot be recalled. There is no chargeback, no dispute window and no clearing bank to phone. What the deposit screen calls funding your account is a payment out.

Rail two: the release fees. The taxes and compliance charges at the end are collected on the same rails, or by wire. The balance being ransomed never existed, which makes the fee stage the most profitable part of the operation: pure margin, on a customer who has already proved they will pay.

Then it is swept. Funds arriving at the platform’s addresses do not sit there. They are moved out, split across wallet networks, mixed and forwarded, in a laundering pipeline that runs around the clock. Chainalysis measured the shape of that industry directly: revenue up about 40% in a single year, the number of deposits up 210%, and the average deposit value down 55%. Fewer whales, far more Sarahs. That is not a gang getting lucky. That is a company optimising a funnel.

And the ledger remembers. The same property that makes crypto attractive to the operators is the one that eventually exposes them, because most of it writes every transaction into a public record. Investigators cannot always seize the money, but they can follow it, wallet to wallet, for years. In June 2025 the Justice Department filed a civil forfeiture complaint against $225.3 million traced from victims of these schemes. Four months later it filed against 127,271 bitcoin, roughly $15 billion, tied to forced-labour scam compounds in Cambodia — the largest forfeiture action in the Department’s history.

Tracing works. It works on a timescale measured in months, and it starts from reports. That is the entire reason the section below matters more than it looks.

How to spot it

Six signs, each with a test you can run in about thirty seconds. The CFTC publishes the warning signs for this exact fraud, and the first four are its territory.

1. A stranger contacted you, and needs the conversation somewhere private. Test: say clearly that they have the wrong person, then stop replying. A real wrong number is over. Anything that keeps the thread alive after that has a reason to.
2. The conversation reaches money, and the money has no downside. Test: ask which month the strategy lost, and how much. Real investing has losing months and the person who does it can name one. Certainty is the tell, not the returns.
3. You can never quite meet, on camera or in person. Test: propose a video call in the next ten minutes. Do not accept a scheduled one. Treat the excuse as the answer, because the excuse always arrives and is always reasonable.
4. The problem appears when money comes out, not when it goes in. Test: attempt a withdrawal early, for a small amount, before you are deep. Not as a loyalty test — as a test of the plumbing. If releasing your own money requires a payment, the account is not an account.
5. The platform is not in any regulator’s register. Test: search the firm’s exact name in the public registers kept by the SEC, FINRA and the CFTC, typing the name yourself rather than following a link you were sent. A company that holds your money and appears in none of them is not supervised anywhere, and the interface tells you nothing about that.
6. The person who told you about the opportunity is the person you pay. Test: ask who profits if you deposit. In a real introduction the answer is a licensed institution you can verify independently. Here the answer is the chat window.

The two signs that survive everything

Scripts get rewritten and photographs get replaced, but two features cannot be edited out without breaking the business.

The first is the direction of the introduction: the relationship arrives before the opportunity. Every legitimate investment you have ever made started with you looking for one. Here it started with somebody looking for you, and the order is not incidental — reversed, the pitch would have to survive scrutiny it cannot survive.

The second is the asymmetry between putting money in and taking it out. A platform that can credit your account instantly can debit it instantly. When one direction is effortless and the other needs a payment, you are not looking at a technical problem or a slow compliance department. You are looking at the only part of the operation that is real.

What to do if it already happened

In this order, because the order is what protects you.

1. Stop sending money today. Including the fee that supposedly releases everything else. Especially that one. Nothing gets released, and every additional payment is real money leaving a real account.
2. Preserve the evidence before it disappears. Wallet addresses, transaction hashes, the platform’s exact URL, the app, the full chat history, the phone numbers and any names given. Screenshot everything, and export the chat rather than scrolling it. Accounts and pages are deleted from their side, often within hours.
3. Report to the FBI at ic3.gov. IC3 is the Bureau’s intake for internet crime. Reports with wallet addresses and transaction hashes are what blockchain tracing is built on, and they are what the forfeiture actions above were assembled from. Under Operation Level Up, the FBI works the other direction too: it notified 8,103 people who were being defrauded at that moment, 77% of whom had no idea, and reports $511,511,288 saved.
4. Report to the FTC at reportfraud.ftc.gov. This is the consumer-protection intake. It does not investigate your individual case, and it feeds the enforcement picture and the national loss data — the $12.5 billion figure exists because people filed.
5. Call your bank and your exchange. Ask them to flag the destination addresses, review recent transfers and hold anything pending. If a card or wire was involved, use the words fraud and dispute.
6. If you handed over identity documents, work through identitytheft.gov, which produces a personalised recovery plan and the affidavit banks accept, and set a fraud alert with the credit bureaus.
7. Refuse the second scam. Anyone who contacts you offering to recover the funds for an upfront fee is running the follow-up. People who have lost crypto once are a list that gets sold.
8. Tell one person you trust. The isolation was engineered on purpose over several weeks. Ending it is part of the fix, and it is also how the next person in your family hears about this before it is their turn.

Nobody can promise you recovery. Speed changes what remains possible, and that is the part still under your control.

How to not be next

• Treat the friendly wrong number as what it usually is. One reply to correct them, then nothing. This single habit removes the entire funnel.
• Never send crypto to somebody you have only met through a screen. However real the relationship feels. It will feel real; that feeling is the product being manufactured.
• Check the register before the first dollar, not after the first loss. SEC, FINRA, CFTC. Type the name yourself.
• Keep your money where you opened the account. The move from a regulated exchange to a platform someone introduced you to is the single step that changes everything, and it never has to be made in a hurry.
• Decide in advance who you tell. Agree with one person that no money leaves without you mentioning it to them first. That rule costs nothing while nothing is wrong, and it is the only defence that survives six weeks of grooming.
• Have the conversation with your parents this week. The FBI reports that nearly one-third of 2024 investment-fraud losses came from people over 60. Not a lecture — one sentence about wrong-number texts, before the good-morning messages start.

The numbers, and what they mean

• The FBI’s Internet Crime Complaint Center logged $5.8 billion in crypto investment fraud across 41,557 complaints in 2024, and reported that nearly one-third of investment-fraud losses came from people over 60. Across every category, 2024 was a record: $16.6 billion, up 33% on the previous year (IC3 2024 Annual Report).
• The FTC counted $12.5 billion in total reported fraud losses for 2024, with investment scams the largest single category at $5.7 billion, and puts the median reported romance-scam loss at $1,996 (FTC, March 2025). The median is small because most victims are interrupted early. The economics of this scam live in the tail.
• Under Operation Level Up, the FBI notified 8,103 victims while the fraud was still running. 77% had no idea. The programme reports $511,511,288 saved (FBI). Those are not careless people. They were standing inside a machine built to be invisible from the inside.
• Chainalysis measured revenue up about 40% year on year, deposits up 210%, and the average deposit down 55% (Chainalysis, 2025 Crypto Crime Report). Industrialisation, visible in three numbers.
• In October 2025 the Justice Department filed a civil forfeiture complaint against 127,271 bitcoin, roughly $15 billion, tied to forced-labour scam compounds in Cambodia, describing it as the largest forfeiture action in its history (DOJ). Four months earlier it filed against $225.3 million traced to victims of the same schemes (DOJ, June 2025).
• The UN Human Rights Office has documented at least 300,000 people from 66 countries inside these compounds (UN News), and INTERPOL has tracked scam centres far beyond South-East Asia, with victims in more than 60 countries (INTERPOL).

The person messaging you is frequently working under coercion, recruited by a fake job advert and held. That does not make the loss smaller. It does explain why the messages never stop arriving.

Watch the full documentary

The full case, the money trail and the four fingerprints investigators use are in the documentary: How a Text Message Becomes a $15 Billion Scam.

Related

The same withdrawal-fee machinery is bolted onto a famous face in the celebrity crypto giveaway deepfake. The same advance-fee logic, at a fraction of the price, drives the free prize that charges shipping. And when the opening move is a borrowed brand instead of a borrowed friendship, you are looking at the fake Microsoft security alert. And where this scam spends months building the trust it later spends, the virtual kidnapping call skips the construction entirely: it borrows the trust you already have in your own family.