Pig Butchering Scam: How the Wrong-Number Text Works

A pig butchering scam opens as a wrong-number text or a dating match, never as an investment pitch. After weeks of ordinary conversation, the stranger moves you onto a fake trading platform where your balance is typed in by hand. The scam only reveals itself when you try to withdraw.

The U.S. Secret Service publishes the name the operators use: sha zhu pan, pig butchering. It describes three phases, and it is the business plan, not a metaphor. Find the pig. Fatten the pig. Butcher the pig.

How it works

1. First contact looks like an accident. A text to the wrong number. A dating app match. A friendly reply to a comment. There is no offer and no link. The opening is designed to survive suspicion because there is nothing yet to be suspicious of.
2. The conversation moves to a private app. Usually WhatsApp or Telegram. This takes the relationship out of any platform that could flag it, and out of reach of anyone who could warn you.
3. Weeks pass with no mention of money. The CFTC calls this phase grooming in its own advisory. Photos, routines, a voice note, a video call that is somehow always cut short. The asset being built is not affection. It is your assumption that you already know this person.
4. Investing arrives as a detail, not a pitch. An uncle who works at a fund. A method the family uses. Something they were already doing before they met you. You are never sold to. You are allowed to ask.
5. The first deposit is small and it works. Often on a real exchange, so the paper trail looks normal. Then the money is moved onto a private platform or app that only they can show you.
6. The dashboard is theatre. The number on your screen is a number on their screen, editable. Gains appear. Small withdrawals may even be honoured early on, because a withdrawal that works is the most expensive advertisement they can buy.
7. The butchering happens at the withdrawal. A fee. Then a tax. Then a compliance hold, an anti-money-laundering charge, a deposit to unlock the account. Each payment produces a new obstacle, because the obstacles are the product.
8. The money leaves in minutes. Crypto moves out through laundering networks and offshore accounts. Chainalysis measured the shape of the industry directly: revenue rose about 40% year on year, the number of deposits rose 210%, and the average deposit value fell 55%. That is a business taking smaller bites from far more people.

Key facts

• The FBI’s Internet Crime Complaint Center logged $5.8 billion in crypto investment fraud across 41,557 complaints in 2024, and reported that nearly one-third of investment-fraud losses came from people over 60 (IC3 2024 Annual Report).
• The Federal Trade Commission puts the median reported romance-scam loss at $1,996 (FTC, March 2025). The median is small because most victims are stopped early. The scam’s economics live in the tail.
• Under Operation Level Up, the FBI notified 8,103 victims while the fraud was still running. 77% of them had no idea. The programme reports $511,511,288 saved (FBI).
• In October 2025 the Justice Department filed a civil forfeiture complaint against 127,271 bitcoin, roughly $15 billion, tied to forced-labour scam compounds in Cambodia. The Department describes it as the largest forfeiture action in its history (DOJ).
• Four months earlier the Department filed a separate complaint against $225.3 million traced to investment-fraud victims (DOJ, June 2025).
• The UN Human Rights Office has documented at least 300,000 people from 66 countries inside these compounds (UN News). INTERPOL has tracked scam centres far beyond South-East Asia, with victims in more than 60 countries (INTERPOL).

The person messaging you is frequently working under coercion. That does not make the loss smaller. It does explain why the messages never stop arriving.

How to spot it

The consumer-protection regulator for derivatives markets, the CFTC, publishes the warning signs for exactly this fraud. Four of them do most of the work.

1. Unsolicited contact that steers you off-platform. A stranger who reaches you by accident and needs the conversation to continue somewhere private.
2. The conversation always arrives at money, and the money has no risk. Real markets have losses. The pitch that has none is not a market.
3. You never meet in person or on unbroken video. The camera fails. The trip is cancelled. The emergency is real enough to be unanswerable.
4. The problem appears when you try to take money out, not when you put it in. Deposits are frictionless. Withdrawals require one more payment.

Two more checks are quick and decisive:

• Look up the platform in the official registries — the SEC, FINRA and the CFTC all publish them. A firm that holds your money and appears in none of them is not regulated anywhere.
• Try to withdraw a small amount early. Not as a test of good faith, but as a test of the plumbing.

What to do if it already happened

1. Stop sending money today. Including the fee that supposedly releases everything else. Especially that one.
2. Report it to the FBI at ic3.gov and to the FTC at reportfraud.ftc.gov. Speed is the variable you still control. Operation Level Up exists because interruption works.
3. Keep everything. Wallet addresses, transaction hashes, the platform’s URL, the app, the full chat history, and the phone numbers. Screenshots before you delete anything.
4. Tell your bank or exchange. Ask them to flag the destination addresses and freeze anything pending.
5. If you handed over identity documents, work through identitytheft.gov.
6. Refuse the second scam. Anyone who contacts you offering to recover the funds for an upfront fee is running the follow-up. Recovery fraud targets people who have already been robbed once, because that list is for sale.
7. Tell one person you trust. The isolation was engineered. Ending it is part of the fix.

Watch the full documentary

The full case, the money trail and the four fingerprints investigators use are in the documentary: How a Text Message Becomes a $15 Billion Scam.

FAQ

Is a wrong-number text always a scam? Not always, but both the FBI and the U.S. Secret Service list the unsolicited wrong-number text as a standard opening move of crypto investment fraud. A genuine wrong number ends when you say they have the wrong person. A scam keeps the conversation going.

Why can’t I withdraw my profits from the trading platform? Because the profits are a number typed into a page the scammer controls. The CFTC lists withdrawal problems among its official warning signs for these frauds. Every fee, tax or compliance charge you are asked to pay to release the money is another payment, not a step toward release.

What does pig butchering actually mean? It is a translation of sha zhu pan, the term the U.S. Secret Service uses for this fraud. The Secret Service describes three phases: find the pig, fatten the pig, butcher the pig. The fattening is the friendship, and the butchering is the withdrawal request.

Can I get my money back after a pig butchering scam? Sometimes, and speed decides it. The Justice Department filed forfeiture actions over $225.3 million in June 2025 and roughly $15 billion in October 2025, and the FBI’s Operation Level Up says early notification saved victims $511,511,288. Report to ic3.gov immediately, and never pay a company that promises recovery for a fee.

Who is actually typing the messages? Often someone who is also a victim. The UN Human Rights Office has documented at least 300,000 people from 66 countries inside scam compounds, many held against their will. INTERPOL has tracked victims of these operations in more than 60 countries.

Related

The same withdrawal-fee machinery is bolted onto a famous face in the celebrity crypto giveaway deepfake. The same advance-fee logic, at a fraction of the price, drives the free prize that charges shipping. And when the opening move is a borrowed brand instead of a borrowed friendship, you are looking at the fake Microsoft security alert.