What exactly is a pig butchering scam?

A woman sits at her desk and recieves a text on her table from an unknown phone number—a telltale sign of a pig butchering scam.

Among cybercriminals, a new relationship scam is emerging. Don’t be fooled: there’s no farm-to-table dinner ahead, only empty bank accounts.

Have you received a text like this?

“Had a great time last night! Let me know what I owe you for dinner 😊”

Look how cordial that is! Sure, it’s from an unknown sender, but they clearly enjoyed our (or whoever’s) company, and they just want to square up the bill. Even now, the intended recipient could be wondering: Did their friend have a good time? Do they intend to pay their share for dinner? This person at least deserves a response to let them know they’ve got the wrong number. Right?

But something doesn’t smell right. You think about it for a minute. You exercise your healthy skepticism. Obviously, this isn’t the usual “click this link for souper deals” spam text. You text back.

“So sorry, you have the wrong number.”

Unfortunately, odds are, you’ve likely just confirmed to a total stranger that they have a valid phone number, and you’re a thoughtful person. It’s exactly what the scammers were hoping for.

Pig butchering: A slow-cook relationship scam 

This particular form of romance or relationship scam comes from the Chinese phrase “sha zhu pan,” inferring that the scammers would “fatten up the pig” (i.e., the victim) with compliments and romance before taking “the whole hog.” The scams are thoughtful, complex, and sophisticated. They can even be deployed at scale, with strategies and playbooks designed to enable organized crime entities to offload the work onto forced laborers

The scam begins with a text sent to the wrong number, though connections can also begin via seemingly accidental connections over social media and dating apps. When a recipient responds to the lure of the message, the scammer’s playbook goes into action.

“I’m so sorry! I appreciate you letting me know – do you know Paul? Wondering how I got the number wrong. My name is Terri, btw ✌️

What follows is a carefully scripted set of exchanges designed to make the intended victim feel as though they’ve stumbled into a great online friendship. It takes time. The relationship over text is developed slowly, building confidence and rapport before the next stage can begin.

“I know it’s totally random but I just like texting with you if that’s ok? NBD if not, but you seem cool and I’m thankful.”

At some point, after a connection is established, the scammer introduces the subject of investments. They might off handedly mention a spending splurge, because they cashed in some of their cryptocurrency. Or they may be more direct, letting the victim know they have inside knowledge about an investment … and are happy to let you in on the deal. 

“Letting you know I might be slow to respond this weekend - treating some of my friends to a trip to Rome! Have you ever done crypto? Srsly 🤑

At this point, the scammer guides the victim toward downloading a custom application or directs them to a scam website. But unlike other online scams, it doesn’t stop with trying to get a little bit of identity information. Recall, the scammers won’t stop until they get the whole hog.

Crypto Investments are the earmark of pig butchering

Through a fake application or a fake website, the scammer shows the target what they want to see: big returns on investment. 

In this scheme, the data (the value of a cryptocurrency) may actually be real, but be aware that the investments and account information are fake. Pointing at their successes in the past, the scammer asks the victim to make a small investment, then manipulates the app or the website to show a big return on the initial investment.

That initial success sparks the dopamine rush, and the scammer encourages that feeling of success to foster more and more investments from the victim over time. This is known as “fattening the pig.”

“I’m going to do a big re-up on Tuesday – only leaving it in until Friday unless the rate shoots up. At this rate, you’re going to have a new house by fall.”

Of course, the rate shoots up. 

When everything disappears

When the fraudster begins to feel the victim’s interest waning (or suspicion arousing), the scam stops, and they take everything.

Immediately, the app stops working. The website disappears. The phone number no longer works. In some variations, the scammers have captured the victim’s banking information along the way, and they clean out whatever remains as they disappear.

What makes this scam particularly insidious is that the majority of stolen money is given voluntarily and invested into cryptocurrency that cannot be retrieved by the bank or any government entity. The victim is left with few options.

Keep yourself and your loved ones off the chopping block

Awareness and healthy skepticism are the great frontline defenses against confidence scams. Online scammers are becoming adept at finding and exploiting weaknesses like a sense of loneliness, a longing for fast and easy money, or even mental infirmity. They leverage every avenue of trust and take their time doing so. Be aware and wary when someone connects with you and wants you to trust them with your money or your personal information

Always consider it a red flag when someone asks you to invest with them. Consider how you know that person, how long you have known them, and how did you meet? Consider how many friends you’ve known in real life for more than a decade, and how many among them have ever pressured you to buy cryptocurrency with them?

The costs for victims are high, not just monetarily, but at a human level. Be relentlessly protective of your personal information. Don’t be taken in by random message senders attempting to convert you into a friend, and keep the butchers away.

Norton technology blocked 142 million threats a day.

Norton™ 360 brings real-time protection for your PCs, Macs, smartphones or tablets against ransomware, viruses, spyware, malware and other online threats.

Try Norton 360. Post, bank and shop from your device. We’ll keep it secure.

Clare Stouffer
  • Clare Stouffer
  • Gen employee
Clare Stouffer, a Gen employee, is a writer and editor for the company’s blogs. She covers various topics in cybersecurity.

Editorial note: Our articles provide educational information for you. Our offerings may not cover or protect against every type of crime, fraud, or threat we write about. Our goal is to increase awareness about Cyber Safety. Please review complete Terms during enrollment or setup. Remember that no one can prevent all identity theft or cybercrime, and that LifeLock does not monitor all transactions at all businesses. The Norton and LifeLock brands are part of Gen Digital Inc. 


    Want more?

    Follow us for all the latest news, tips and updates.