Pig Butchering Scam Decision Check: What to Verify Before the Next Deposit

A pig butchering scam is usually built around one decision: whether the victim will send more money after trust has already been established. By that stage, the contact may feel personal, the trading portal may show gains, and the next payment may be framed as a fee, tax, account requirement or temporary step before withdrawal.

That is the dangerous moment for readers. The question is not whether the person sounds kind, whether the chart looks professional, or whether a small earlier withdrawal appeared to work. The question is whether the contact, platform, payment request and claimed firm can be checked through sources that are independent of the person asking for money.

Official warnings from the SEC’s Investor.gov and the FBI describe a recurring pattern: unsolicited contact, movement to private messaging, relationship building, crypto or digital asset investment claims, displayed profits, and difficulty getting money back once funds have been sent. Those warnings do not prove that every named website or account is fraudulent. They do give readers a practical test before adding new exposure.

Many victims do not start with a large transfer. The sequence often begins with a casual message, social media contact, dating-app conversation, professional networking approach or “wrong number” text. The conversation then moves toward trust and, later, an investment idea.

The staged structure matters. A first small deposit may be used to make the platform feel real. A dashboard may show profit. A supposed account manager may praise the victim for good timing. Then the pressure changes: add more capital, pay a tax, verify the account, increase the balance, or meet a withdrawal condition.

That is where the reader needs to stop treating the issue as a trading question and start treating it as an evidence question. A displayed profit is not proof of market activity if the same operator controls the website, the account messages and the withdrawal rules.

The safest working assumption is narrow: do not send additional funds until the platform, firm, contact path and payment demand have been checked outside the platform itself.

Investor.gov, an SEC investor education site, warns that crypto and digital asset scams may begin through social media, dating apps, text messages or other online contact. Its crypto scam alerts tell investors to verify people and firms before sending money and to be cautious around promises, pressure and requests involving digital assets.

Relevant SEC Investor.gov resources include:
https://www.investor.gov/introduction-investing/general-resources/news-alerts/alerts-bulletins/investor-alerts/crypto-scams
https://www.investor.gov/introduction-investing/general-resources/news-alerts/alerts-bulletins/investor-alerts/digital-asset-and-crypto-investment-scams-investor-alert

The FBI’s cryptocurrency investment fraud resources describe how victims may believe they are using a legitimate investment platform while the fraud relies on fake account balances, fake support staff, or withdrawal demands. The FBI also warns that crypto transfers can be difficult to recover after they are moved.

Relevant FBI resources include:
https://www.fbi.gov/how-we-can-help-you/victim-services/national-crimes-and-victim-resources/cryptocurrency-investment-fraud
https://www.fbi.gov/how-we-can-help-you/victim-services/national-crimes-and-victim-resources/operation-level-up

Chainalysis adds a different kind of context. Its crypto crime reporting discusses blockchain-enabled illicit finance and helps explain why fraud operators use crypto rails: funds can move quickly across wallets, services and jurisdictions. That does not mean every wallet movement proves a named person is responsible. It means transaction records should be preserved carefully and interpreted with caution.

Relevant Chainalysis resource:
https://www.chainalysis.com/blog/2025-crypto-crime-report-introduction/

A professional-looking trading screen can distract from the weaker part of the story: how the reader reached the platform.

The contact path is often more revealing than the dashboard. A legitimate investment opportunity should not depend on a stranger building emotional trust, moving the chat away from the original platform, and discouraging outside checks. A legitimate firm should be verifiable through official registration, regulator, app store, corporate and domain records that do not come from the person pitching the investment.

Unsolicited contact followed by a private investment pitch.
A romantic, friendship or mentorship dynamic tied to trading advice.
Instructions to use a specific app, domain or wallet address supplied by the contact.
Pressure to act quickly because of a market window or account deadline.
A withdrawal blocked by a new payment demand.
Warnings not to speak with banks, exchanges, family members or law enforcement.

One warning sign alone may be inconclusive. A cluster of warning signs changes the risk calculation. The reader does not need to prove the entire network before acting defensively. It is enough to decide that no more money or personal data should be sent until the claims can be verified independently.

Use each platform claim as a testable statement. If the only proof comes from the person asking for money, the claim is weak.

This checklist is for a live situation where the reader is being asked for another payment, document, wallet action or login step.

Stop all additional transfers while checking the claim. Do not send a “final” fee to release funds.
2. Do not share a seed phrase, private key, remote-access session, exchange login, two-factor code or identity document with the contact.
3. Save the exact domain, app name, app download link, account number, support email, chat handles and phone numbers.
4. Take screenshots of balances, withdrawal messages, fee requests and any threat or deadline.
5. Export or preserve chat logs before the other party deletes messages.
6. Save transaction hashes, wallet addresses, exchange withdrawal records and bank transfer records.
7. Search the exact domain and company name together with terms such as “withdrawal,” “regulator warning,” “complaint” and “scam.” Treat forum posts as leads, not final proof.
8. Verify any claimed firm through official regulator or company channels that you locate yourself, not through links supplied by the contact.
9. If the person asks you to lie to a bank, exchange or family member, treat that as a severe risk signal.
10. If a recovery agent contacts you after the loss, check whether the pitch repeats the same pressure pattern with a new upfront payment.

This is not a substitute for legal advice or law-enforcement reporting. It is a damage-control step: stop new exposure, preserve evidence and avoid turning one loss into two.

Evidence is most useful when it keeps the timeline intact. A single screenshot of a balance is less helpful than a connected record showing how contact began, what was promised, where funds were sent, and what happened when withdrawal was requested.

Chat logs from the first contact through the latest payment request.
Screenshots of profile pages, usernames and account IDs.
Website URLs, app store pages, download links and archived pages if available.
Emails including full headers if you know how to save them.
Bank wires, card payments, exchange deposits and exchange withdrawals.
Wallet addresses, transaction hashes, timestamps and network names.
Copies of any contract, tax notice, AML notice or “account verification” demand.
Names, photos or documents supplied by the other party, while treating them as unverified.

Do not edit screenshots to make them cleaner before saving the originals. If you need a working copy with notes, keep it separate. The original record should remain as close as possible to what appeared on the device.

Several facts should not be overstated.

A website name does not prove who operates the site. Scammers can copy logos, registration numbers, executive names and office addresses from real companies. Unless an official regulator, court filing, exchange notice or verified company statement connects a site to an entity, the safer wording is that the site “claimed” the connection.

A wallet address does not automatically identify a real-world person. Blockchain records can show that funds moved from one address to another, but attribution may require exchange records, subpoenas, analytics, device evidence or other corroboration. Public accusations based only on wallet movement can be unreliable.

A small earlier withdrawal does not prove legitimacy. Fraud operators may allow a limited withdrawal to build confidence before a larger deposit request. The relevant test is whether the platform allows normal withdrawals without surprise fees, threats or new conditions.

A recovery promise is not evidence of recovery ability. Anyone who guarantees the return of crypto funds for an upfront fee creates a new risk. Evidence preservation, reporting and professional investigation are different from a promise to reverse a transfer.

If funds have already been sent, reporting should not wait until the victim can prove every detail. Reports are often built from partial information: wallet addresses, transaction hashes, domains, messages, bank records and identity claims.

Possible reporting paths depend on location and payment route. In the United States, victims may review FBI cryptocurrency investment fraud resources and report through the appropriate FBI channel. Investors can also use SEC and Investor.gov materials to understand whether a securities-related complaint or tip may be relevant. Banks and crypto exchanges should be contacted quickly if recent transfers may still be reviewed internally.

If no money has been sent, do not send funds to a platform introduced by an unverified contact.
If some money has been sent and withdrawal is blocked, do not pay a new fee to release it.
If identity documents or logins were shared, secure accounts and credentials immediately.
If a recovery agent appears, verify the person independently and reject guaranteed-return claims.
If transaction records exist, preserve them before accounts, domains or chats disappear.

A pig butchering scam works by keeping the victim inside the operator’s version of events. The practical response is to step outside that script: pause payments, verify through official sources, keep the transaction trail, and report with the evidence available.