Pig-butchering scams work because they spend weeks or months earning a target’s trust before any investment is mentioned, then move that target onto a fake trading platform that displays convincing gains. The money leaves through transfers the victim believes are funding a real account. This article walks through how the sequence typically unfolds, what the published case figures do and do not show, and what to do when a new online contact recommends an investment platform.
How the approach begins
Many pig-butchering operations open with a message that looks like a mistake: a text apparently meant for someone else, or a friendly greeting that seems accidental. Sophos, in an investigation of one operation, describes messages of this kind that led to extended personal conversation, after which the scammer moved the target to another messaging platform. The investment pitch came later.
Group-IB describes the core of the scheme as social engineering. The fraudster gains the target’s trust and then promotes an investment opportunity, often through a platform that imitates legitimate trading. Group-IB says the grooming phase can continue for weeks or months. That slow pace is part of the design: someone who has been in daily contact for months is less likely to question a sudden suggestion about money.
The typical sequence
Reported cases share a rough order, though not every case follows it exactly. Treat the steps below as a pattern rather than a fixed script.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →- Opening contact. A message that appears accidental or friendly.
- Relationship building. Regular conversation about everyday life, shared interests, or, in some cases, romance.
- Channel switch. The conversation moves to a different messaging app, away from the place where the first contact happened.
- Investment pitch. The contact describes a trading strategy, a platform, or an opportunity they say has produced profits for them.
- Fake platform. The target is directed to a trading site or app. Sophos reports fake applications for both iOS and Android, and says multiple people maintained contact with targets in the operation it examined.
- Funding. The target sends money, which the platform displays as growing. Transfers may come from a cryptocurrency account or be made by wire.
Why the fake platform is convincing
The platform is where the deception becomes concrete. Sophos describes fraudulent trading and liquidity-mining platforms that can display invented balances and trading activity. A U.S. Department of Justice complaint from 2024 records one victim’s use of a fake trading application presented as Stormgain. The use of a legitimate company’s name is part of the disguise. It says nothing about that company’s own conduct.
The central point is simple: a balance on a screen is a number the operator can set. Seeing rising numbers is not evidence that an investment exists, and it is not evidence that money can be withdrawn.
The two phases of the scam call for different kinds of caution:
| Phase | What the target typically sees | Check that matters |
|---|---|---|
| Contact and trust-building | An accidental-looking message, daily conversation, a request to move to another app, and a gradual shift toward money topics | Ask whether a relationship formed online is being used to steer you toward finances. Do not discuss investments with someone you have never met in person without outside advice. |
| Platform and fund transfers | A trading site or app with rising balances, instructions to deposit or transfer, and pressure to add more money | Find the platform through official channels you choose yourself. Treat any balance as unverified until you can withdraw real funds to an account in your own name. |
What the case figures show and what they do not
- Over $3 million in cryptocurrency over five months. Sophos reports this total for one operation it investigated, based on its own analysis. It describes the total for that ring, not an estimate of what the scam takes in overall.
- About $216,300 in alleged transfers. A 2024 Department of Justice complaint alleges that one victim sent seven wire transfers from a cryptocurrency account to a fake Stormgain trading app between March 7 and approximately April 8, 2023. These are allegations in a court filing about one victim, not established findings about every case.
- Regions where victims were detected. Group-IB reports detecting victims in Asia-Pacific, Europe, and the Middle East and Africa. Those are the regions where its work found victims. They are not a full map of where the scam operates.
None of these reports should be read as evidence that the specific operations described are still running today.
Free tools Windows power users keep installed
One-click scans. No signup required.
Rank #3
If a new contact recommends an investment platform
A recommendation from someone you have only met online is the start of the pattern described above. Before opening a link, downloading an app, or sending any money, work through these checks:
- Stop before you click. Do not open the link the contact sends. Go to the company’s website by typing the address yourself, or search for the app from the official app store listing on your phone.
- Check the company, not the app’s screen. Confirm the company’s name, its registration, and whether it is authorised to offer investment services where you live. Your country’s financial regulator can usually tell you this.
- Do not treat displayed profits as money. Gains shown inside an app are not withdrawable until you can actually move them out. Make no deposits to “unlock” a balance.
- Be wary of fees before withdrawal. Requests to pay taxes, verification charges, or other fees before you can take money out are a common warning sign of this type of fraud.
- Notice requests for secrecy or speed. Pressure to keep an opportunity private, to move to a new app, or to act before you can verify anything is part of the pattern.
- Talk to someone outside the conversation. A family member, a friend, or your bank’s fraud team can see what you may not see while you are emotionally invested.
If money has already been sent
- Stop all further transfers. Do not install additional apps or grant remote-access permissions to anyone who asks.
- Contact your bank or payment provider immediately. Describe the transfers and the platform involved and ask whether the payment can be recalled or flagged. Outcomes vary, and speed matters.
- Keep the evidence. Save chat histories, wallet addresses, transaction IDs, screenshots of balances, and the name of any app you installed.
- Report it. File a report with local police. In the United States, you can also report to the FBI’s Internet Crime Complaint Center (IC3). Other countries have national fraud-reporting bodies.
- Be cautious of recovery offers. People who contact you claiming they can recover lost funds in exchange for a fee are a common second wave of fraud. Nothing in the reporting cited here shows that a device, a paid security product, or any service can prevent these scams or reverse transfers already sent.
About the glacier story
This edition of The Download pairs the scam explainer with a MIT Technology Review story titled “How to save a glacier.” This article does not summarise that story, and nothing here reports its proposals, figures, dates, or quotations. Readers looking for glacier-saving methods should read the original article directly.
Quick Recap
Best Value
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
