AI Phishing, Deepfakes and Pig-Butchering: How Modern Online Fraud Works

A pig butchering scam is a long-con investment fraud: the criminal builds trust over weeks, steers the victim onto a fake trading platform, shows invented profits, then takes everything when the victim tries to withdraw.

In 2026 the con is rarely run on its own. Generative AI writes the messages, deepfake audio and video “prove” the persona is real, and phishing kits harvest the accounts used to move the money.

This guide explains how each tactic works, where they connect in a single fraud chain, and which signals let individuals, banks and security teams interrupt the chain before the money leaves.

It is written for SOC analysts, fraud teams and IT leaders who field these cases from employees, customers and family members.

How big is the investment fraud problem?

Investment fraud is now the costliest crime category reported to the FBI. The FBI IC3 2024 Internet Crime Report recorded $16.6 billion in total losses from 859,532 complaints, with investment fraud alone accounting for about $6.57 billion and cryptocurrency investment fraud about $5.8 billion (2024).

A year earlier, investment fraud losses reached $4.57 billion in 2023, so the growth is steep and sustained.

Consumer data points the same way. The FTC reported that consumers lost more than $12.5 billion to fraud in 2024, with investment scams the largest category at $5.7 billion, and 38% of people who reported fraud said they lost money, up from 27% in 2023 (2025 release).

Behind those numbers are industrial operations. Coverage of U.S. Treasury sanctions on Southeast Asian scam centers shows how compounds staffed by trafficked workers run scripts at scale, while research into a pig butchering-as-a-service platform shows the tooling (stolen PII, aged accounts, fraud kits) being sold to anyone who wants to run the play.

How a pig butchering scam unfolds, stage by stage

The scam follows a predictable sequence. Knowing the stages matters because each one produces different signals, and the earlier the interruption, the smaller the loss.

Stage	What the scammer does	Observable signal
1. Contact	“Wrong number” text, dating-app match, LinkedIn or WhatsApp group invite	Unsolicited message from a stranger who keeps the conversation going
2. Grooming	Daily chat, shared photos, talk of wealth and a mentor who trades crypto	Requests to move to WhatsApp or Telegram; refusal of live, unscripted video
3. Platform	Victim is sent to a lookalike trading site or app and makes a small deposit	Newly registered domain; app sideloaded or installed via a web clip
4. Fattening	Dashboard shows large gains; a small withdrawal is allowed to build trust	Inbound crypto deposit close to the amount sent, then larger outbound transfers
5. Slaughter	Withdrawals blocked pending “taxes”, “fees” or “verification”	Payments labelled as taxes or penalties; distress and urgency

The fattening stage is where many victims escalate. A fake dashboard can show any balance it wants, and scam platforms often mirror real market data so the numbers look plausible.

Checking a claimed balance against a public quote, such as the Bitcoin price on a major exchange, does not prove a platform is legitimate, but a mismatch is a clear warning.

Operators have also scaled this stage with AI. Reporting on pig-butchering operators using AI assistants describes how chat assistants translate, keep personas consistent and handle many victims at once.

AI phishing: better lures, faster kits

AI phishing removes the tells defenders trained users to look for. The FBI’s public service announcement I-120324-PSA (December 2024) warns that criminals use generative AI to write convincing messages, fix grammar and spelling, create large numbers of fake social profiles and build content for fraudulent crypto investment sites, some with embedded chatbots that steer victims to malicious links.

Phishing campaigns also abuse trusted cloud services so the first link in the chain passes reputation checks. In ATT&CK terms, the delivery is still T1566 (Phishing); what changes is the quality and volume.

For defenders, that means content-based filtering matters less and identity controls matter more.

Where AI phishing meets investment fraud

Phishing supplies the infrastructure that the investment scam needs: compromised social media accounts to make first contact look personal, stolen identities to open mule accounts, and bank credentials to move funds.

A single campaign can feed several downstream frauds.

Voice deepfake scams and synthetic video

A voice deepfake scam clones a voice from a few public clips and uses it to create urgency.

The same FBI PSA describes criminals cloning a relative’s voice to fake a crisis and request urgent payment, and using AI video in live chats to pose as executives or to “prove” that an online contact is real.

That second use is central to modern pig butchering: a short, pre-rendered video call ends the victim’s doubts.

Attackers also combine voice with real-time phishing. Reporting on AI voice calls paired with fake banking pages shows callers walking victims through MFA prompts while a kit relays the codes. This maps to T1656 (Impersonation) plus credential capture.

Victims are frequently targeted a second time. The FBI has warned about deepfakes and fake IC3 sites used to re-victimize fraud victims, posing as recovery services or law enforcement that will return funds for a fee.

Detecting investment fraud: practitioner examples

Example 1: bank and fintech transaction rule (illustrative)

FinCEN’s pig butchering alert FIN-2023-Alert005 (September 2023) lists financial red flags that translate directly into monitoring logic: early cash-out of savings sent to a virtual asset service provider (VASP), home-equity proceeds used to buy crypto, a crypto deposit close to the amount previously sent followed by much larger outbound transfers, and payments to a VASP labelled “taxes”, “fees” or “penalties”.

The rule below is an illustrative sketch, not production code.

— Illustrative: flag first-time, high-value VASP transfers by long-tenured customers
SELECT c.customer_id, SUM(t.amount) AS vasp_total_30d
FROM transactions t JOIN customers c ON c.customer_id = t.customer_id
WHERE t.counterparty_category = ‘VASP’
  AND t.txn_date >= CURRENT_DATE – 30
  AND c.prior_vasp_txn_count = 0          — no crypto history before this month
  AND c.account_age_days > 365
GROUP BY c.customer_id
HAVING SUM(t.amount) > 10000
  OR MAX(CASE WHEN t.memo ILIKE ANY (ARRAY[‘%tax%’,’%fee%’,’%penalt%’,’%unlock%’]) THEN 1 ELSE 0 END) = 1;

Tune thresholds to your customer base. The behavioral flags in the same alert (a customer describing a new online contact offering high returns, or anxiety about an investment deadline) belong in branch and call-center scripts, because front-line staff often see them before any rule fires.

Example 2: response steps when an employee or customer reports a scam

1. Stop further payments. Freeze outbound transfers and cancel pending wires; the first hour matters most for recall.
2. Preserve evidence: platform URLs, wallet addresses, transaction hashes, chat exports and the scammer’s phone numbers and handles.
3. Report to the bank or exchange and file with IC3 (or the national equivalent), including transaction details and how contact began.
4. If any device was used to install a “trading app” or remote-access tool, isolate it, reset passwords from a clean device and revoke active sessions.
5. Warn the victim about recovery scams. Legitimate agencies do not charge fees to return funds.

Controls that break the fraud chain

No single control stops all of these tactics, so map defenses to the stages above. The table aligns common controls with NIST CSF 2.0 functions and CIS Controls v8.

Control	Stage disrupted	Framework mapping
Phishing-resistant MFA (passkeys, FIDO2) for email, banking and exchange accounts	Account takeover used to move funds	CSF PR.AA; CIS 6.3–6.5
Out-of-band callback on any payment request received by voice or video	Deepfake executive or relative requests	CSF PR.AT; CIS 14.1
Family or team code word, as the FBI PSA recommends	Voice cloning emergencies	CSF PR.AT
VASP transfer monitoring and customer friction on first-time crypto purchases	Platform and fattening stages	CSF DE.CM
Mobile device management blocking sideloaded apps and unknown configuration profiles	Fake trading app install	CSF PR.PS; CIS 2.5
Awareness training built on real local cases, repeated quarterly	Contact and grooming stages	CSF PR.AT; CIS 14

For individuals, the most effective rule is simple: anyone you have met only online who introduces an investment opportunity is a scammer until proven otherwise. Verify through a channel you choose, never one they provide.

Key takeaways

• A pig butchering scam is a staged investment fraud; each stage (contact, grooming, platform, fattening, slaughter) produces detectable signals.
• Investment fraud led reported losses in the FBI’s 2024 data at about $6.57 billion, with crypto investment fraud around $5.8 billion.
• AI phishing and voice deepfakes remove traditional red flags, so verification must rely on callbacks, code words and phishing-resistant MFA.
• Banks and fintechs can turn FinCEN’s published red flags into monitoring rules and front-line scripts.
• Victims are often targeted again by fake recovery services; no legitimate agency charges to return funds.

FAQ

What is a pig butchering scam?

It is a long-running investment fraud in which a scammer builds a relationship with the victim, persuades them to deposit money on a fake trading platform, shows fake profits to encourage larger deposits, and then blocks withdrawals and disappears with the funds.

How can you tell if a crypto trading platform is fake?

Warning signs include a platform introduced by someone you met online, a recently registered domain, an app installed outside the official app stores, and withdrawal requests that trigger demands for taxes or fees.

Check the platform’s registration with your financial regulator before depositing anything.

How do voice deepfake scams work?

Criminals clone a voice from public recordings and call the target pretending to be a relative, colleague or executive in urgent need of money. Hang up and call the person back on a number you already know, and agree on a code word in advance.

Can you get money back from a pig butchering scam?

Recovery is difficult once crypto has moved, but acting fast helps. Contact your bank or exchange immediately, file a report with IC3 or local police, and ignore anyone who offers to recover funds for an upfront fee.

Is AI making phishing emails harder to detect?

Yes. The FBI warns that generative AI fixes the spelling and grammar errors people used to rely on and produces convincing messages at scale.

Identity controls such as passkeys and verifying requests through a second channel are now more reliable than spotting typos.