The Outlier Lab

Investment Scams (Pig Butchering)

Long-con investment fraud where scammers build trust, show fake gains on fabricated platforms, and steer victims into repeated, escalating transfers, increasingly via crypto, kiosks, couriers and mule accounts.

What it is

This is the largest loss category in US fraud reporting. The FBI's IC3 recorded $8.65B in investment-fraud losses in 2025, the top category, of which $7.2B was crypto investment fraud. Crypto investment complaints rose 48% year over year. The FTC's 2025 Consumer Sentinel data also puts investment scams first by dollars, at $7.9B, about half of all reported losses.

The name "pig butchering" comes from the scammers' own metaphor: fatten the victim with attention and small apparent gains, then take everything. What separates it from other Authorized Push Payment (APP) Scams:

  • Duration and repetition. It runs as a sequence of payments over weeks or months, escalating in size.
  • A plausible counter-narrative. The victim believes they are investing their own money in their own account. Bank warnings about "scams" don't match their experience, because the platform shows their balance growing.
  • The late-stage fee trap. Withdrawal attempts trigger demands for "taxes," "fees" or "penalties." FinCEN flags this as a hallmark, as well as follow-on recovery scams that target the same victims again.

The investment-club variant pushes victims to buy real, thinly traded stocks in their own brokerage accounts. It overlaps with Ramp-and-Dump via Account Takeover and is covered here because the victim places the trades.

How it works

Diagram: Unsolicited contact (wrong-number text, social, dating, ad), Trust built, moved to encrypted chat, Introduce investing; small test deposit shows gains, Escalating deposits (savings, retirement, loans), Withdrawal blocked: fees and taxes demanded, Contact cut, or 'recovery' scam follows

Stages, conceptually:

  1. Contact and grooming. Unsolicited messages, social media, dating apps, and fake advisor or celebrity personas, increasingly AI-assisted (Generative AI and Deepfake Fraud).
  2. Platform. A look-alike trading site or app, or a real third-party brokerage account, displays fabricated gains. Small "inducement" payouts make the returns feel real.
  3. Escalation. The victim liquidates CDs, retirement accounts, home equity, or borrows from family.
  4. Extraction. Withdrawal fees, taxes and account "flags." When a bank blocks a transfer, the scammer reroutes the payment rather than stopping. IC3 described a 2026 pattern of in-person cash couriers, usually collecting from older victims.
  5. Re-victimization. Fake recovery firms, fake law enforcement, fake lawyers.

Transaction footprint

StageWhat you see in the dataDecision point
First outboundA customer with no crypto history makes a first transfer to an exchange or VASP, or buys at a kiosk; often a small "test" amountNew-payee and new-rail friction; contextual warning (Customer Education and Scam Warnings)
EscalationRising payments to the same VASP, exchange or individual; early CD redemption, 401(k) or IRA distribution, HELOC draw, brokerage liquidationReal-Time Transaction Risk Scoring with source-of-funds context; human outreach
Rail switchingAfter a decline or hold: the same amount retried on another rail (wire → P2P → cash withdrawal → kiosk), or at another institutionCross-rail velocity at the customer level, not per rail
Fiat-to-muleWires or ACH to individuals or small businesses with no relationship to the customer, sometimes described as "buying crypto from a seller"Payee and Counterparty Risk; name mismatch; payee seen in other victims' flows
Fee phaseRepeated payments labeled or explained as "tax," "fee," "penalty" or "release"Strong late-stage indicator; escalate to specialist outreach
Cash phaseLarge cash withdrawals, sometimes repeated, with no plausible use; precious-metal purchasesTeller and branch scripts; Trusted Contact and Senior Investor Holds
AftermathA victim contacts support about a "platform" they can't withdraw from; a recovery-service payment followsLabel as authorized scam (not unauthorized); block recovery-scam payees

The most important data pattern is that many institutions only see the first hop. The victim's bank sees a wire to an exchange in the victim's own name, which looks like a legitimate self-transfer. The loss happens one hop later, when the crypto leaves the exchange for a scammer address. Detection has to use customer context, such as a first-time crypto user, a sudden liquidation of long-held assets, changed behavior in the branch or on the phone (Scam Victim Indicators).

Common variants

VariantWhat's differentWhere it shows up
Classic crypto pig butcheringFake trading platform, crypto on-ramp, stablecoin launderingBanks, exchanges, kiosks
Fiat-to-muleVictim wires to a mule or shell account believing they're buying cryptoBanks and neobanks; see Money Mules
Investment club / stock tipsReal stocks, real broker, victim's own account; a thin issuer is rampedBrokerages; FBI and FINRA alerts on social-media "investment groups"
Courier and goldVictim hands cash or gold bars to couriers after transfers are blockedOlder victims; IC3 2024 and 2026 PSAs
Kiosk paymentsCash → crypto at a kiosk to a scammer addressFinCEN 2025 kiosk notice; IC3 kiosk data
Recovery scamA second wave posing as recovery firms, lawyers or law enforcementAny prior victim
Fake "licensed" MSBPlatform cites FinCEN registration as endorsementFinCEN warns registration is not a license or endorsement

Where it shows up

  • Banks and neobanks: source of funds, wires and ACH to exchanges and mules, cash withdrawals. The bank often has the best chance to intervene and the least visibility into the scam itself.
  • Brokerage and Investing: liquidations to fund "investments," investment-club stock purchases, and securities firms' own SAR filings. FinCEN counted about $785M in suspected scam activity reported by securities and futures firms over 2023–2025.
  • Payments and P2P and crypto platforms: the on-ramp and first-hop VASP. MSBs filed the majority of FinCEN's digital-asset-scam reports.
  • Cashback, Coupons and Rewards and Retail and Ecommerce: mostly indirect. Gift cards are sometimes demanded for "fees" (Gift Card Fraud), and scam-linked spending can pass through rewards accounts.

Impact

  • Scale: IC3 2025: $8.65B in investment fraud ($7.2B crypto). Adults 60+ reported $3.5B in investment-fraud losses. FinCEN's trend analysis covering September 2023 through 2025 counted 33,904 BSA reports with about $12.7B in suspected scam activity, with monthly report volume rising about 11% on average.
  • Victim harm: losses often include retirement savings and borrowed money. In 2025, Operation Level Up notified 3,780 victims, of whom 78% didn't know they were being scammed. 38 were referred to a victim specialist for suicide intervention.
  • Institutional exposure: these are authorized payments, so in the US they generally fall outside Regulation E unauthorized-transfer protection (see Regulation E and Unauthorized Transfers). Political and regulatory pressure toward reimbursement is rising, though, as in Case Study - Zelle Scam Liability Disputes (2024-2025), and the UK already mandates it (Case Study - UK APP Scam Reimbursement Rules (2024)).
  • Mule-side exposure: receiving institutions that host mule accounts face SAR, BSA and reputational exposure. See Case Study - TD Bank AML Failures (2024) for what weak monitoring costs.

Red flags

Prevention and detection at a glance

LayerControl or signalWhat it does here
PreventCustomer Education and Scam Warnings tailored to the payment's contextWorks best at first contact with a new rail or payee, before sunk cost builds
PreventPayee Confirmation and Payment FrictionName checks and cooling-off on first payments to new VASPs or individuals
DetectReal-Time Transaction Risk Scoring using customer contextScores source-of-funds changes and first-time crypto alongside amount
DetectTransaction Monitoring + Graph Analytics on the receiving sideFinds mule accounts and wallets collecting from multiple victims
RespondHuman outreach by trained specialists working Manual Review Queues; Trusted Contact and Senior Investor HoldsBreaks the scammer's narrative; FINRA Rule 2165 holds for specified adults
RespondRapid recall: FBI IC3 / Recovery Asset Team, FinCEN Rapid Response ProgramOnly works within days; FinCEN stresses reporting within 72 hours for wires
RecoverConsortium and Data Sharing (314(b)), exchange freeze requestsThe first-hop exchange can sometimes freeze before funds move on

Emerging variants and adversary adaptation

  • IC3's June 2026 PSA describes scammers switching to in-person cash pickups when banks block transfers or the platform claims the account is "flagged." Couriers verify themselves with passphrases or banknote serial numbers. Expect cash and precious-metal withdrawals to grow wherever digital friction rises.
  • FinCEN's August 2025 kiosk notice reported that people 60+ were more than three times as likely to report a kiosk-related loss. IC3 counted 13,460 kiosk complaints and $389M in 2025 (complaints up 23%, losses up 58%). State caps and operator controls are pushing some flows back to bank wires and mule accounts.
  • FinCEN's September 2026 scam-center alert describes operators who handle only victim communication and outsource accounts, front companies and fund movement to professional launderers through escrow-style marketplaces. It notes that takedowns are quickly followed by reconstitution. See Fraud-as-a-Service Ecosystem.
  • FinCEN reports the compound model spreading beyond Southeast Asia to South Asia, the Pacific, Africa, the Middle East and South America.
  • FinCEN notes AI-supported scam tooling. IC3 attributed more than $632M of 2025 investment losses to complaints with an AI nexus, such as deepfaked celebrity or executive videos and AI-driven chats.
  • Treasury's October 2025 Section 311 final rule cut a Cambodia-based payments conglomerate off from the US financial system, and a June 2026 proposal targets its successor entity. Add DOJ's interagency Scam Center Strike Force (April 2026 actions) and the record actions in Case Study - Prince Group Pig Butchering Enforcement (2025), and operators' costs are rising. Expect laundering to shift toward less-regulated stablecoins and underground banking.

Real-world examples

Sources and further reading