Pig-Butchering Scams: How AML Teams Detect Romance-Investment Fraud

Pig-butchering, the unfortunate but accurate translation of the Mandarin sha zhu pan, is now the largest single fraud-loss category reported to the FBI Internet Crime Complaint Center (IC3) and a top priority for FinCEN, the FCA, AUSTRAC, and most major regulators. The typology blends romance fraud with investment fraud, typically involves cryptocurrency, and is run by organized criminal groups operating from compounds across Southeast Asia. For AML teams, the challenge is that the laundering of pig-butchering proceeds passes through ordinary retail bank accounts and exchange accounts before disappearing into the crypto layer. That makes detection a frontline AML responsibility, not just a fraud problem.

How the Typology Works

The typology follows a consistent multi-stage script. Understanding the script is the foundation of detection.

Stage 1: Contact. The victim is approached, usually unsolicited, on a dating app, social media platform, professional network, or messaging service. The opening message is often presented as a wrong number that develops into conversation.

Stage 2: Relationship building. Over weeks or sometimes months, the scammer builds trust. The relationship is presented as romantic, professional, or familial. Communication is constant. The scammer presents themselves as successful, often in finance, real estate, or tech.

Stage 3: Investment introduction. The scammer introduces a "trading platform" or "exclusive investment opportunity," often described as a cryptocurrency arbitrage, foreign exchange platform, or new financial product. Initial small investments by the victim appear to perform extraordinarily well, with screenshots of fake gains.

Stage 4: Escalation. The victim is encouraged to invest larger and larger amounts. They may be given live demonstrations of the platform, encouraged to recruit family members, or pushed to take loans against assets to invest more.

Stage 5: Exit. When the victim attempts to withdraw funds, they are told they must pay "tax," "release fees," or "compliance charges" first. After they pay these, the platform either disappears or continues to demand additional fees until the victim is exhausted.

What Pig-Butchering Looks Like in Bank Data

The laundering footprint of pig-butchering is distinctive once you know what to look for.

New beneficiary, large transfers. Victims typically send to a beneficiary they have never paid before, in amounts that grow over weeks. Early transfers may be in the low thousands; later transfers can run to hundreds of thousands.

Crypto exchange destinations. A very high proportion of pig-butchering payments flow into accounts at cryptocurrency exchanges, often domestic regulated exchanges, before being converted to crypto and sent onward.

Loans and asset liquidation precede transfers. Victims often draw on home equity, take personal loans, or liquidate retirement accounts to fund the investment. A sudden shift from saver to borrower in an established customer is a strong contextual signal.

Accelerating frequency and size. The transfers escalate. A scheme that begins with one 5,000 transfer can reach 50,000 per week within two months. The trajectory itself is a signal.

Pattern interruption attempts. When the bank intervenes (a phone call, a transaction hold), the customer often defends the activity strongly, sometimes with scripted answers. This is one of the most diagnostic single signals.

Victim age and isolation. While victims span all demographics, older customers and recently widowed or divorced customers are over-represented. Victims are also frequently isolated from family, often because the scammer has actively encouraged that distance.

The Detection Conversation

When a pig-butchering pattern is suspected, the customer conversation matters. Victims are typically convinced the relationship is real and the investment is legitimate. They will defend it. The most effective conversations focus on facts the customer can verify themselves:

Have you ever met this person in physical reality? Has every video call worked correctly, with no excuses? Is the trading platform regulated by a recognized authority you can verify on the regulator's website? Have you been able to withdraw any funds, not just see them on the platform? Has anyone connected to the relationship asked you to keep the activity secret from family or your bank?

These questions are not accusatory. They are factual. They give the customer space to recognize the pattern themselves, which is often more effective than direct intervention.

What AML Teams Should Do

Detection of suspected pig-butchering should trigger several parallel actions:

Hold or restrict the transaction while review takes place, where the regulatory environment supports this.

File a Suspicious Activity Report with the relevant financial intelligence unit. In the United States, FinCEN has issued specific guidance on pig-butchering SAR narratives. In the United Kingdom, the NCA has published similar guidance.

Engage with the customer carefully. Pattern-interruption conversations should be handled by trained staff. Aggressive intervention can entrench the customer's commitment to the scammer.

Coordinate with the receiving institution. Where the destination is a domestic crypto exchange, exchange compliance teams are often able to act quickly to freeze incoming funds if alerted in time.

Refer to law enforcement and victim support resources where appropriate. Many jurisdictions now have dedicated victim-support pathways for romance-investment fraud.

The APP Fraud Reimbursement Context

In the UK, the Payment Systems Regulator's Authorised Push Payment fraud reimbursement rules, in effect since October 2024, place direct financial liability on sending and receiving institutions for failures to prevent customers from being defrauded. Pig-butchering is one of the largest single contributors to APP fraud losses, and the reimbursement regime has materially increased the cost to banks of failing to detect this typology in time.

Other jurisdictions are moving in similar directions. The expectation is no longer that institutions detect pig-butchering eventually; it is that they detect and intervene before significant loss has occurred.

The Bottom Line

Pig-butchering is a mature, organized typology with a recognizable script and a recognizable banking footprint. Programs that treat it as a dedicated typology, with explicit detection rules, trained pattern-interruption staff, and clear escalation paths, materially outperform programs that try to handle it through generic fraud rules.

To assess a specific payment request for pig-butchering and other modern fraud typologies, the Red Flag Check payment assessment includes a dedicated romance-investment scam indicator alongside the broader payment fraud indicator set.