Pig Butchering: How to Read the Pattern Before the Money Is Gone

James Waddell | Founder & Managing Partner, Aegis Studios | 2026-04-20

---

Alarming Trends in Consumer Fraud

In 2024, the FBI reported a staggering 46,872 complaints related to cryptocurrency investment fraud—commonly referred to as "pig butchering." Victims reported losses amounting to $6.3 billion, with the average loss per individual now at approximately $134,900.

For context, this amount is equivalent to the median home price in many U.S. markets or even several years’ worth of retirement savings. Disturbingly, these losses occur over a short span, typically lasting just weeks.

Pig butchering is the fastest-growing scam by percentage, outpacing long-established fraud schemes such as romance fraud and business-email compromise. It is now the costliest category of fraud tracked by the FBI, surpassing all others combined. Additionally, recovery from such scams is incredibly challenging due to the obscure nature of money routed through cryptocurrency exchanges and foreign banks.

The term "pig butchering" derives from the scam's systematic approach: the scammer "fattening" the target by building trust and showcasing fake profits before the final theft, which is executed through withdrawal freezes and subsequent money loss. The metaphor is devoid of judgment and simply reflects a strategic methodology.

---

The Five Stages of Pig Butchering and How to Identify Them

Pig butchering scams adhere to a predictable pattern. Each stage features specific messages that signal the scammer's intentions. Below is a breakdown of each stage and the warning signs to watch for:

Stage 1: The Accidental Icebreaker (Days 1–3)

You might receive a text saying, *"Sorry, is this Michael? I think I have the wrong number."*

This seemingly innocent contact comes from the scammer aiming to establish communication without raising suspicion. They seek your engagement to continue messaging. They aren't making requests yet—just fishing for your response.

Key features observed:

• F-HOP: The scammer often shifts the conversation to encrypted messaging platforms like WhatsApp or Telegram, minimizing detection risks.

Takeaway:

Do not respond. If you do, you’ve already crossed the first barrier.

Stage 2: The Mentor/Friend Build (Weeks 1–4)

Once dialogue is established, you may receive multiple messages daily, such as:

*"How was your day? I heard about an investment opportunity; I'm making good money, but it’s not for everyone. Interested?"*

At this stage, the scammer seeks to build a false sense of trust, often sharing personal anecdotes that may or may not be fictitious. This rapid progression in relationship dynamics is a red flag.

Key features observed:

• F-TRUST: Rapid trust-building beyond normal social boundaries.

Takeaway:

Consult someone outside of the scenario. If you feel compelled to keep this secret, it’s a warning sign.

Stage 3: The Platform Introduction (Weeks 2–5)

You might hear something like:

*"My uncle uses this trading platform. I've made $3,000 in two weeks. Check out this screenshot!"*

This is when scammers introduce a counterfeit trading platform complete with a professional interface and fake account balances.

Key features observed:

• F-RAIL: The platform promotes unusual payment methods.

Takeaway:

Test the platform with a small withdrawal. If there are unexpected fees or issues, do not invest further and inform authorities.

Stage 4: Escalating Investment on the Fake Dashboard (Weeks 3–8)

After successfully withdrawing a small amount, you might encounter pressure:

*"Try investing $10,000. Many people see returns of $20K in the first month!"*

Your sense of security increases as the scammer illustrates fictitious growth.

Key features observed:

• F-URG: Pressure builds to escalate investment quickly.

Takeaway:

Request a substantial withdrawal to test the platform's legitimacy. Larger amounts often expose the scam.

Stage 5: The Slaughter — Withdrawal Freeze with a Fee (Weeks 6–10)

Attempting to withdraw a significant sum, you receive messages like:

*"Your account is flagged. To withdraw, you must pay a fee of $5,000 as a 'tax bond.'"*

This is the conclusive stage where the scammer demands a fee before permitting access to your funds.

Key features observed:

• F-VER: Claims that only the scammer can help with account validation.

Takeaway:

If you find yourself at this stage, immediate action is crucial. Report the incident to IC3.gov, contact your bank's fraud line, and file a report with local authorities.

---

Applying Enterprise AI Governance Principles for Scam Detection

To combat the rising tide of pig butchering scams, organizations can employ enterprise AI governance principles. These might include:

1. Data Transparency: Ensure that individuals can see how detection algorithms evaluate communications for signs of fraud, reinforcing trust.

2. Feature Attribution: Train AI systems to categorize the common features of scams distinctly, allowing users to understand the mechanics behind fraud notifications.

3. Response Protocols: Establish standard operating procedures for individuals when notified of potential scams, ensuring they can react swiftly and safely.

These principles can enhance risk management and empower consumers to identify and mitigate these threats effectively.

---

Conclusion and Next Steps

The recovery from pig butchering scams can be arduous. While the fraud recovery rates are notably low, proactive reporting can help in identifying patterns and protecting future victims.

Report Any Incidents:

1. IC3.gov — The FBI Internet Crime Complaint Center.

2. FTC Consumer Sentinel Network — Report fraud at fraud.ftc.gov.

3. AARP Fraud Watch Network — For real-time victim support, call 1-833-FRAUD-11.

For further assistance, explore Pretext Features.

---

Keywords: pig-butchering, deep-dive, consumer-safety, scam-patterns, romance-scam, investment-fraud, enterprise AI governance, risk management, fraud detection, Aegis Studios, Pretext, pattern recognition, cryptocurrency scams