Crypto Romance Scams: Understanding the ‘Pig Butchering’ Threat

Romance scams are nothing new, especially when online dating is involved. And with the popularity of cryptocurrencyover the past several years, crypto scams are starting to show up on people’s radars. But scammers are getting creative and putting the two together. Also called “pig butchering” by the scammers who do it, crypto romance scams are the newest scam to watch out for.

See Pig Butchering with Jane Lee for a complete transcript of the Easy Prey podcast episode.

Jane Lee is a Trust and Safety Architect at Sift, a fraud prevention platform powered by machine learning. Sift works with a wide variety of customers, from dating apps to McDonald’s to Twitter. Jane’s role is unique. She and her team specialize in malicious websites, spam, misinformation, account content, abuse, chargebacks, and payment risk – anything to do with fraud. A large part of Jane’s role is understanding new and emerging trends in fraud.

Before working for Sift, Jane spent five years at Facebook combating spam, a year at Square investigating payment fraud, and spent some time as a private investigator. In grade school, she was obsessed with cop shows like CSI, Law and Order, and NCIS. She wanted to be a detective until she learned how dangerous it was. Now what she does is similar to detective work, just behind the scenes and with the protection of working with technology.

I like to think of what I do right now as kind of detective work, but behind the scenes and under the safety of tech.

Jane Lee

What are Crypto Romance Scams?

We’ve all heard of old-school romance scams. We’re also familiar with their close cousin, the Nigerian Prince scam. The scammers get paid by convincing the victim to wire them money. Crypto romance scams, also called pig butchering scams, are romance scams on steroids. Scammers combine romance scams with cryptocurrency and investment scams to make something new. The crypto investment component and the technological sophistication of the scammers makes it especially dangerous.

How Crypto Romance Scams Work

Crypto romance scams start when the scammer baits a target. This is most common on dating sites, but they also use social media, messaging apps, or any platform where they can send messages. They catch victims’ interest by pretending to be successful businesspeople. They talk about how they have attained financial freedom. Or they will explain how they’re on track to retire at age 40 and travel the world.

Any platform with any messaging component is at risk.

Jane Lee

Wherever they find their victim, they try to move the conversation to an encrypted messaging app as soon as possible. It adds a layer of anonymity to help them avoid detection. Then they try to romance the target quickly. Love bombing is a tactic from behavioral psychology. With love bombing, someone overwhelms their target with compliments and expressions of love and care. It’s not genuine love, it’s manipulation.

The next step is interesting the victim in the scam. They say things like, “Look how much money I’m making with cryptocurrency, you should start investing!” or tell you you’re missing out and could have made so much money if you’d just invested. Their goal is to create urgency so the victim “invests” in the crypto romance scams quickly.

When the victim does send money, they will see their money making huge returns in a short amount of time. But crypto romance scams aren’t real growth – it’s all fake. When they try to withdraw the money, there is a tax or some sort of fee. That’s when most people realize it’s a scam. It’s often when the scammer running these crypto romance scams ghosts the victim.

Why the Name “Pig Butchering?”

This isn’t a name Jane came up with. “Pig butchering” is a term for crypto romance scams used by the scammers themselves. It’s a gruesome metaphor. Victims are “pigs” that the scammers fatten up with quick returns. Then the scammers lead the “pigs” to “slaughter” where they drain all their money and walk away with a lot of money.

Ultimately, they lead them to the slaughter in which they drain them of all of their funds and walk away with, in some cases, millions of dollars.

Jane Lee

Investigating Crypto Romance Scams

Sift does work with a number of dating apps and websites. The term “pig butchering” and the idea of crypto romance scams first surfaced there. Jane started investigating. She is an occasional dating app user herself, and she had noticed some profiles were very similar. Once she started looking behind the scenes, she knew something was fishy.

Any time you see too much of the same thing online, there’s a high chance that it’s fraud-y.

Jane Lee

Jane got curious. She wanted to understand the inner workings of crypto romance scams. So she downloaded every single major dating app in the App Store. She even recruited one of her single friends to download apps and help her research. Basically, she set herself up as bait to see what she could learn.

How to Spot a Scam Account

I downloaded every single dating app and no one’s safe. They’re everywhere.

Jane Lee

Once Jane knew what she was looking for, she found a lot of similarities between accounts trying to run crypto romance scams. At the time, most of them were pretending to be attractive Asian men. (They’ve since changed to be more diverse.) These are a few of the things she noticed.

Heavily Edited Photos

All the pictures on accounts running crypto romance scams were extremely photoshopped. Jane tried running some through a reverse image search and got no results. She thinks the scammers are either stealing from real people’s social media or creating fake AI-generated profiles. The look was very curated. It didn’t look like photos of a real person, but more like heavily edited photos for social media.

Similar Responses, Same Theme

On dating sites that let you answer questions, the answers provided by profiles running crypto romance scams were all similar. They also followed the same theme. Financial freedom was a topic in every single profile. So was dreams of being able to travel with their wife and family.

Generic Everything

The job titles listed by these crypto romance scam accounts were generic. Often, they would just list a job title and a location, with no company. “Entrepreneur in NYC,” for example, or “CEO in Los Angeles.” Every profile also sounded the same. In some ways it got easier to spot them the more you looked. Just look for the profiles that look and sound almost exactly the same.

But They’re Getting Better

Since Jane’s initial investigation, crypto romance scams have gotten even more sophisticated. The types of images have changed. It’s no longer just heavily-edited attractive Asian men. Answers to questions and prompts used to not be at all related to the question. Now that has changed. As people are becoming more aware of generic businessmen profiles hiding crypto romance scams, the scammers have started adapting so their profiles are less generic.

What I think they’re doing is either paying more attention as it’s getting more exposed, or they’ve started copy and pasting from other existing profiles.

Jane Lee

Spotting a Scam Account from the Technical Side

It’s getting harder to identify accounts running crypto romance scams. IP addresses can be a good signal. People on the technical side can see if the IP address location matches the location they claim to be from. But scammers running crypto romance scams are getting good at hiding their IP addresses. They know which IPs belong to specific Internet Service Providers (ISPs) and use emulators to look like they are using, for example, a T-Mobile IP address.

Jane’s team scours the dark web, deep web forums, and private Telegram forums looking for credentials being sold. They don’t buy, they just look at what’s happening. Jane has seen files of IP addresses being sold, with the seller saying to use them for scams because they’re reputable IP addresses from reputable sources.

For the naked human eye, it becomes really hard to tell at face value what’s going on.

Jane Lee

Sift is primarily a machine learning platform. This is one area where machines have advantage over people. If you have the right tech to do high-volume data integration and the algorithms to do something with it, it’s easier to see the big picture. A human moderator might see a new account that says they’re based in Los Angeles and use Verizon. To the moderator, this looks legitimate. But what if 1,000 other accounts with the same information are sending the same type of messages? Without the right tools to detect it, scammers could slip through.

Protect Yourself By Staying On the Platform

No matter what platform the scammer found their victim on, the first step in crypto romance scams is to get the victim off that platform and onto an encrypted messaging app. They do this to reduce their risk of getting reported. Switching platforms helps them avoid detection on any single platform. If they try to pitch their crypto romance scams on Tinder, you can report them to Tinder. But once they get you off Tinder, Tinder doesn’t know what they’re doing anymore.

By switching platforms, they’re not violating the Terms of Service on any single platform. Saying, “Hey, I don’t use this app much, let’s do WhatsApp instead,” isn’t a violation. But when you look at the aggregate data from every platform, you get a better picture of how crypto romance scams operate. Sift has a diverse group of customers, which helps them collect data and see patterns of fraud.

What to Watch Out For: The Process of Crypto Romance Scams

It’s important to be aware that fake accounts are out there. Watching out for the signs of a scam account, like overly-polished photos, weird text, and the image of an exotic successful entrepreneur traveling the world. But if you’re aware of the process behind crypto romance scams, you can spot the red flags. If you start seeing too many of these warning signs, you’re probably talking to a scammer.

Moving a Conversation to an Encrypted Messaging App

Crypto romance scams aren’t the only reason someone might ask you to move the conversation to an encrypted messaging app. There are perfectly harmless reasons to do so. It doesn’t indicate fraud all by itself, but it’s a piece of the puzzle. If there are a lot of other red flags and the person also wants to move the conversation to a different app, that’s suspicious.

Encryption is kind of a double-edged sword … you want to honor privacy, but from a fraud perspective, it does add some huge challenges.

Jane Lee

Love Bombing

Once they start messaging you, someone running crypto romance scams will bombard you with compliments. One scammer repeatedly told Jane she was beautiful and he wanted to plan a vacation with her. Jane may not be professionally qualified to give dating advice, but wanting to plan a trip is moving way too fast for someone you met online a few weeks ago. Excessive compliments from someone you’ve never met in person is also suspicious.

Reasons You Can’t Meet in Person

This is a common red flag for any online dating scam. But one thing that makes crypto romance scams unique is the scammers put in more effort. They take time to understand the region they’re targeting. Jane asked one scammer what they were doing that weekend, and they said they were going to a local restaurant. When she checked, that restaurant was local to the neighborhood the scammer was claiming to be from. They did their research to create a story that was believable.

It’s not just, hey, we’re going to do this in a day and steal your money. They really curate these relationships.

Jane Lee

Scammers are doing their homework. Many online dating scammers avoid video calls. Crypto romance scammers might say they can get on a video call, but you won’t get a good look at them. The video will be blurry, they’ll say their internet has issues, or there is some kind of technical difficulty. COVID-19 gave crypto romance scammers a great excuse for not meeting in person, as well.

Talking about Investments and Financial Success

Throughout the process, someone running crypto romance scams will talk about investments and how well they’re doing financially. It’s how they try to get you into the crypto part of crypto romance scams. They may send screenshots of their bank or investment accounts. They may flaunt an extravagant lifestyle. A scammer Jane interacted with sent her pictures of “him” on a yacht and doing other luxurious things. They work very hard to position themselves as financially successful.

Grammar and Location Issues

In old fashioned scams, overseas scammers would have time zone issues. They might claim to be in Europe but not be available in European time zone windows. The scammers running crypto romance scams must be working graveyard shifts, because Jane hasn’t encountered any of those issues.

Grammar issues are another common red flag for scams. This is one Jane has seen with crypto romance scams. Sometimes profile text and responses looks like a copy and paste from Google Translate. Other times, it’s not that bad but still doesn’t sound like a native English speaker. The scammers often pose as someone born overseas, though. By claiming to not be a native English speaker, they try to cover for their grammar issues.

Introducing Cryptocurrency to the Conversation

People running crypto romance scams don’t start out asking you to invest in cryptocurrency. That would be too obviously suspicious. Instead, they start gradually. They fill out their profile by talking about being financially successful. They start the conversation with love bombing, giving you compliments and talking about how great they think you are. If you ask them what they did that day, they might say something like, “I made $10,000 from Bitcoin,” but they don’t push it on you immediately.

After a few days of love bombing, they’ll ask if you want to get involved. They’ll say that they’re doing really well and they want to share the success with you. They claim they can teach you to be as successful as they are. When you agree, they’ll invite you to a fake crypto exchange platform. If you search for it on Google or on the App Store, it won’t exist. That’s one way you can tell it’s fake – a real crypto exchange platform will show up on Google or the App Store.

This fake crypto exchange is completely manipulated by the people running the crypto romance scams. You’ll see huge returns fast. That’s because they’re not real returns. It’s just manipulation of which numbers show up on the site. The fake exchange also has 24/7 support, which is an indication that these aren’t just small-time scammers. As people in the industry do more investigations, it turns out these scammers are much more organized than we thought.

The Future of Scams

Deep fakes are no longer a far-future idea. Jane thinks they will be used in more scams soon. The technology is not quite there yet, but she estimates it’s more than halfway. When she was at Facebook working on misinformation, she saw that deep fakes were definitely out there. But it’s much easier to spend weeks developing a deep fake video than to do a deep fake video chat in real time.

Jane also anticipates companies increasing authentication for genuine users. Sift is pushing for more authentication with biometrics. There are tools to tell if a biometric ID is fake. But companies will have to balance the right amount of friction. They don’t want well-meaning users to feel violated or insulted, but they need to be able to filter out malicious actors.

Jane also predicts a rise in synthetic identity fraud. That is when fraudsters use components of real individuals, such as Social Security Numbers, to look like they’re a real person. The information actually belongs to you, but it’s in the hands of the wrong person. How do you verify that it’s the real Jane starting this profile and not an identity thief? That’s where fraud protection is going to go next.

For more information on “pig butchering,” Sift recently put out an article including a step-by-step process, examples, and screenshots. Sift also puts out a quarterly digital trust and safety index report – read the most recent one here. You can access all of Sift’s resources on sift.com. Jane Lee can be reached on LinkedIn. You can find Sift on LinkedIn or on Twitter @getsift.