Pig butchering, from the Mandarin sha zhu pan, is a long-form investment fraud. The attacker builds a genuine-feeling relationship over weeks or months before any money is discussed, then introduces a fake investment platform that shows growing returns until the victim tries to withdraw.
This library records 6 cases. What distinguishes the pattern is patience, and that the victims are frequently sophisticated.
How the attack runs
- Contact, usually an apparent wrong number or a benign social approach.
- Relationship building over weeks, with no financial content at all. This is the phase that defeats scam awareness training.
- Casual introduction of investing, framed as personal success rather than a pitch.
- A small first deposit on a fake platform, which appears to perform well and can be withdrawn.
- Escalation, with the displayed balance rising to justify larger deposits.
- The exit: withdrawal requires a fee, then a tax, then another, until contact ends.
Documented cases
How it differs from related techniques
Unlike business email compromise there is no impersonation of a known party; the relationship is the instrument. Smishing is a common first contact channel. Synthetic identity often supplies the persona.
The control that would have stopped it
- Treat unsolicited contact that becomes financial as the defining signal, however long the gap between the two.
- Verify any platform against the regulator’s register before depositing, not after.
- A withdrawal that requires a payment is fraud. There is no legitimate exception.
- For institutions: monitor executives too. Heartland had controls that a sufficiently senior insider could bypass.
- Make it easy to ask for a second opinion. The shame attached to these frauds is what keeps victims from checking.
Social Engineering Examples