What to Do After a Pig Butchering Scam

A pig butchering scam is a long-term fraud scheme in which a scammer builds trust with a victim before introducing an investment, trading, or cryptocurrency opportunity.

The relationship may begin through a dating application, social media platform, messaging application, professional network, or an apparently accidental message. The scammer may spend days or weeks building trust before discussing money.

Once you suspect that the relationship and investment platform may be fraudulent, focus first on preventing additional losses and preserving evidence.

• Stop additional deposits
• Do not pay withdrawal or release fees
• Preserve the complete conversation history
• Save investment platform records
• Record every payment
• Save wallet addresses and transaction hashes
• Contact the financial providers involved
• Secure any compromised accounts

Unlike many short-term scams, pig butchering schemes may involve extensive communication. These records can help show how trust was established and how the victim was gradually directed toward the investment.

• Dating-app conversations
• WhatsApp messages
• Telegram chats
• SMS messages
• Social media conversations
• Emails
• Voice messages
• Phone numbers
• Usernames
• Profile URLs
• Photos used by the contact
• Investment group invitations

Where possible, export complete conversations instead of saving only isolated screenshots.

Record when and how the conversation changed from personal or social contact to financial advice or investment activity.

• Who first mentioned investing
• What investment opportunity was described
• What profits were promised
• Whether the scammer claimed personal success
• Whether a relative, mentor, analyst, or insider was mentioned
• Which website or application was recommended
• How the victim was instructed to deposit funds

Pig butchering scams commonly use fraudulent trading websites or mobile applications that display deposits, trades, profits, and account balances.

• Full website URL
• Account username or ID
• Displayed balance
• Trading records
• Deposit records
• Withdrawal attempts
• Customer support messages
• Deposit addresses
• Claimed company information
• Claimed licenses
• Terms and account rules

When the victim tries to withdraw money, the platform may introduce new payment requirements.

• Tax payments
• Security deposits
• Verification charges
• Account upgrade fees
• Liquidity payments
• Anti-money-laundering deposits
• Insurance charges
• Withdrawal commissions

Pig butchering schemes often involve many payments over an extended period. Every transaction should be recorded separately.

• Date
• Amount
• Currency or cryptocurrency
• Payment method
• Sending account
• Receiving account
• Beneficiary name
• Wallet address
• Transaction hash
• Blockchain network
• Reason given for the payment

Many pig butchering scams instruct victims to purchase cryptocurrency from a legitimate exchange and then send it to wallets controlled by the fraudulent platform.

• Save every destination wallet
• Save every transaction hash
• Record the blockchain network
• Record the cryptocurrency type
• Download exchange purchase records
• Download withdrawal history
• Preserve messages containing wallet instructions
• Record each transfer date and amount

If money was transferred through a bank, contact the sending institution as quickly as possible and explain that the payment was connected to suspected fraud.

• Identify each transfer
• Provide beneficiary information
• Provide transaction references
• Ask about available recall procedures
• Ask whether transaction tracing is available
• Request a fraud case reference
• Preserve all responses from the bank

If payments were made by card, contact the card issuer and identify the transactions connected to the fraudulent investment.

• Transaction date
• Amount
• Merchant descriptor
• Payment confirmation
• Whether you authorized the payment
• Evidence of how the payment was induced
• Card issuer dispute reference

A timeline is especially useful because pig butchering scams often develop slowly and combine personal conversations with financial activity.

• Date of first contact
• Platform where contact began
• Date communication moved to another application
• Date investment was first discussed
• Date the first account was created
• Date and amount of every payment
• Dates profits were displayed
• Dates of withdrawal attempts
• Dates additional fees were requested
• Date the fraud was discovered
• Dates financial institutions were contacted

The identity used by the scammer may be false, stolen, or partially fabricated, but all identifying information should still be preserved.

• Names used
• Phone numbers
• Email addresses
• Messaging usernames
• Social media profiles
• Dating profiles
• Profile photographs
• Claimed occupation
• Claimed location
• Claimed relatives or associates
• Investment adviser or customer service identities

Preserve the information as evidence without assuming that the person shown in a profile photo is actually responsible for the fraud.

The appropriate reporting process depends on the country, payment method, investment activity, and circumstances of the case.

• Prepare a factual case summary
• Provide transaction details
• Provide wallet and blockchain information
• Include platform URLs
• Include relevant communications
• Preserve complaint numbers
• Keep confirmation emails and responses

GFKC country guides provide jurisdiction-specific fraud recovery and reporting information.

The scammer may have collected personal, financial, or account information during the relationship.

• Change compromised passwords
• Enable multi-factor authentication
• Review banking accounts
• Review cryptocurrency exchange accounts
• Remove suspicious devices or sessions
• Review email security
• Secure identity documents if they were shared
• Do not provide additional authentication codes

The scammer may attempt to maintain the relationship even after withdrawal problems become obvious.

• Claims that the scammer is also losing money
• Promises to contribute part of the required fee
• Emotional appeals to trust the relationship
• Threats that the account will be permanently frozen
• Urgent deadlines for paying taxes or verification charges
• Claims that the victim is abandoning a profitable opportunity

These scams commonly involve multiple jurisdictions. The scammer may claim to live in one country, the investment platform may claim registration elsewhere, and payments may move through banks or cryptocurrency services in several locations.

• Victim's country
• Claimed scammer location
• Claimed company location
• Receiving bank countries
• Cryptocurrency exchanges used
• Known payment services
• Wallet transaction destinations
• Reports already submitted

The possible recovery pathway depends primarily on how money moved rather than on the scam label alone.

• Bank transfer recall or tracing
• Card dispute procedures
• Payment-provider fraud review
• Cryptocurrency exchange notification
• Blockchain transaction analysis
• Regulatory or fraud reporting
• Legal assessment
• Cross-border recovery assessment

Organize relationship evidence and financial evidence into a clear case file.

• Case summary
• Relationship and communication timeline
• Complete transaction table
• Bank records
• Card records
• Cryptocurrency records
• Wallet addresses and transaction hashes
• Investment platform records
• Identity and profile information
• Reports already submitted
• Financial-provider responses

• Payment methods used
• How quickly the fraud was discovered
• How quickly financial institutions were contacted
• Transaction destinations
• Blockchain transaction paths
• Whether identifiable services are involved
• Quality of available evidence
• Countries and jurisdictions involved
• Whether funds remain accessible
• Available financial or legal procedures

Two pig butchering cases with similar stories may have very different recovery possibilities because their transaction histories and counterparties are different.