Digital fraud schemes have developed into a multi-billion dollar business over the past decade alone, with the growth of financial technology and rise of decentralized currency opening up a plethora of new avenues for fraudsters to exploit. The success of one particular method has been correlated directly to the growing investment into and mainstream adoption of crypto-currencies across the globe, with this practice continuing to gain more widespread traction over the last several years to the point that it is now garnering an increased degree of attention from both domestic and international intelligence and security agencies. Known by its unique name, “pig butchering” (also known as approval phishing) is an investment scheme that often mimics certain fundamental aspects of other common phishing exploits targeting individual citizens, but has also targeted entire financial institutions and grown to affect their respective network of consumers, creating regional implications with respect to financial and data integrity.
The scheme’s moniker is derived from the very nature of the real-world butchering process, referring to the fattening up of the ‘pig’ (in the case of this scam, the target of the crime) before leading them to slaughter (i.e. financial loss). In these ploys, scammers reach out to individuals both domestically and abroad at random through various means (i.e. cold calls and texts, emails, private messaging on social media and even “matching” on dating apps) and attempt to build up a rapport with them through simple conversation. The initial contact is often as simple as a “hello”, though this correspondence can grow more detailed to include the target individual’s name or a piece of personal information that the target might respond further to in order to pique the target’s curiosity or interest and lead to additional relationship building. Once the fraudster has a foot in the door, there is then a greater chance that they can keep a conversation going long enough to fool the victim into thinking they have “accidentally” made a new friend or are connecting with a prior acquaintance.
Once a relationship is established between a scammer and their prey, they will typically introduce the target to a “lucrative” investment idea. Given the increased visibility of cyber-currencies today across major news outlets and social media and the recent explosion in altcoin markets, these investment ideas are now most commonly cryptocurrency-based. If the target takes the bait, the fraudster will move to get them set up with a website or app that appears completely legitimate on the surface, often mirroring the platforms of established financial institutions or stock/crypto trading sites. The scammers might also seek to further create a false sense of authenticity to the investment proposition, going as far as to conduct a live video call with instructions for the target on the investment process in order to boost their legitimacy or even by letting the victim withdraw a small amount of money from a wallet or account held by the fraudster as an incentive for joining in on the investment, all while drawing the victim’s defenses down even further. While unique in its approach, from the victim’s perspective, the scam ultimately ends up much the same as all other fraudulent ventures: when these individuals ultimately invest in the ploy and their funds are deposited or coins purchased and transferred (often within or into a crypto wallet owned by the scammer), the victim’s banking accounts are further ransacked and the scammer subsequently closes their original account and disappears, never to be heard from again. In other variations of the approval phishing ploy, a victim will sign an unknowingly-malicious blockchain transaction that authorizes the scammer’s address to spend specific tokens inside the victim’s wallet before ultimately draining the victim’s address of those tokens at will.1 The approval phishers will then send the victim’s funds to a separate wallet from the one granted approval to make transactions on the victim’s behalf.1 Further fueling this scam and the difficulties facing law enforcement bodies and regulators alerted to these transgressions is the anonymity of crypto wallets and platforms in general which eliminates any significant paper trail left for authorities to follow.
While one might assume that this process could prove very time-consuming and a rather inefficient method for scamming large numbers of people, the results of these exploits remain tangible. Much of the success of these scams are derived from the individuals being targeted. Much like elder fraud and romance fraud cases, “pig butchering” targets unsuspecting individuals fitting a certain demographic that may be more inclined to succumbing to the simple, harmless conversation the scam is centered around. Further, the fact that scamming pioneers – many of which are based in China and have ties to organized crime – have found ways to streamline their process via pre-planned scripts and responses held within cookie-cutter manuals provided to those they employ have allowed them to further scale the process and make it simple for their less-experienced underlings to complete a successful venture. In many cases however, the accessories in allowing major pig butchering operations to thrive are actually forced laborers that are victims themselves. Many of these individuals are ultimately lured by the organizers of these scams with promises of new work opportunities and are later captured, enslaved and forced to work for the criminal groups backing these fraud schemes. The success of these ventures in allowing criminals and entire organized crime syndicates to make off with quick and virtually untraceable funds has propelled its prevalence and the need for a larger workforce. As such, the gross increase in these scams and similar exploits have also become a major contributing factor in rising global human trafficking figures seen worldwide. In fact, it is estimated that around 220,000 people are being trafficked and forced into these scam operation centers in just Cambodia and Myanmar alone.2
All told, pig butchering is becoming a massive problem according to the U.S. Federal Bureau of Investigation. The FBI’s Internet Crime Complaint Report revealed that investment scams claimed the most substantial losses out of all crimes tracked by the agency in 2023. Last year, losses soared 38% from the year prior to reach a composite $4.57 billion total, with crypto-related investment fraud accounting for almost 90% of that total.2 Of this amount, at least $374 million of suspected stolen funds came as the result of pig butchering/approval phishing. As such, a growing amount of attention is being paid to this activity at the international level. A joint public and private sector effort involving multiple government law enforcement agencies across six countries (including the United States, United Kingdom, Canada, Spain, the Netherlands and Australia) being backed by leading American blockchain analysis firm Chainalysis is currently in motion under the name “Operation Spincaster.” The initiative has involved a series of operational sprints tied to over 7,000 leads Chainalysis has identified pertaining to compromised wallets and $162 million in losses, with the joint efforts ultimately leading to the closing of accounts, freezing of assets, and seizures of funds tied directly to these illicit exploits across various continents. In addition to these early results, these government bodies are also seeking to establish a framework to gather additional intel and ultimately pursue the organized crime groups behind these ventures to limit transnational crime altogether. Time will tell if this growing international cooperation will assist in limiting investment fraud schemes in addition to ongoing organized crime, human trafficking and other financial crime exploits.
Citations
- “Crypto Crime: Targeted Approval Phishing Scams on the Rise.” Chainalysis, 14 Dec. 2023.
- Laverdure, Brian. “‘Pig Butchering’ Crypto Scams a Growing Concern.” ICBA, 11 Apr. 2024.
