Romance Scam, Pig-Butchering Scam or Investment Fraud: What Should a Victim Do First?

Fraud does not always fit neatly into one category.

A person may believe they are experiencing romance fraud because the relationship began through a dating app. The same case may also involve a fabricated cryptocurrency platform, false investment returns and repeated demands for additional deposits.

This combination is often described as a pig-butchering scam: the offender builds trust over an extended period and then directs the victim towards a fraudulent investment. Police guidance describes this as a form of investment fraud with a romance or relationship-building element.

The exact label matters less in the first few hours than taking the correct practical steps.

The immediate priorities are to:

1. Stop further payments.
2. Contact the bank, card provider, exchange or payment platform.
3. Preserve the complete evidence trail.
4. Report the fraud through the appropriate official channel.
5. Secure affected accounts and devices.
6. Avoid anyone promising guaranteed recovery.

The key differences at a glance

Romance fraud

Romance fraud usually involves a false or misleading relationship created to obtain money, financial information or other assistance.

The offender may request funds for:

• Medical treatment;
• Travel;
• Customs charges;
• Legal problems;
• Family emergencies;
• Business difficulties;
• A planned meeting;
• A supposed investment.

Report Fraud describes romance fraud as the creation of a false online identity to gain trust and affection before exploiting the victim financially.

Pig-butchering fraud

Pig-butchering fraud usually combines prolonged trust-building with a false investment.

The relationship may appear romantic, friendly or professional. Once trust is established, the offender introduces a supposed opportunity involving cryptocurrency, foreign exchange, shares, commodities or another investment.

The victim may be shown:

• A professional-looking trading platform;
• False profits;
• Small early withdrawals;
• A supposed adviser or customer-service team;
• Increasingly urgent requests to deposit more;
• Taxes or fees required before withdrawal.

The platform may be entirely fabricated, or the victim may be directed to transfer cryptocurrency to wallets controlled by the fraud network.

Investment fraud

Investment fraud may begin without any romantic relationship.

The approach may come through:

• Social media;
• An online advert;
• A cold call;
• A messaging group;
• A fake celebrity endorsement;
• An impersonated adviser;
• A cloned financial firm;
• A referral from someone known online.

The central feature is a false or misleading financial opportunity.

A relationship may still be used to build credibility, but the investment itself remains the principal reason for the payments.

Why the categories overlap

Fraudsters adapt their story to the person being targeted.

A case may begin as a friendship or romantic relationship and later develop into investment fraud. It may also involve:

• Celebrity impersonation;
• Identity theft;
• Account takeover;
• Cryptocurrency fraud;
• Money-mule activity;
• Recovery fraud;
• Blackmail;
• False legal or tax demands.

The victim does not need to identify the precise legal category before contacting the bank or making a report.

Provide the facts in chronological order and include every payment method, profile, account and investment platform involved.

First step: Stop all further payments

Do not send additional money to:

• Unlock an account;
• Pay tax;
• Complete identity verification;
• Release profits;
• Meet a margin requirement;
• Cover insurance;
• Fund a final trade;
• Recover earlier losses;
• Prove loyalty to the person involved.

Fraudsters frequently claim that one final payment will release everything already deposited.

In reality, additional payments often increase the loss without improving the prospect of withdrawal.

Do not borrow money, release property funds or cash in investments to meet further demands.

Second step: Contact every relevant financial provider

Contact the organisation through which each payment was made.

This may include:

• Your bank;
• A credit-card provider;
• A cryptocurrency exchange;
• A digital-wallet provider;
• A money-transfer service;
• A payment platform;
• An investment firm;
• A pension provider.

Tell them that the payment is connected to suspected fraud.

Provide:

• The date of each payment;
• The amount;
• The recipient;
• The payment reference;
• The reason you now believe it was fraudulent;
• Any messages linked to the request;
• Any police or fraud-reporting reference already available.

Ask whether the organisation can:

• Recall a recent transfer;
• Notify the receiving institution;
• Freeze or restrict an account where legally possible;
• Review the transaction under applicable reimbursement rules;
• Preserve relevant records;
• Secure your account if details were compromised.

Do not wait for a private investigation before contacting the financial provider.

Third step: Preserve the full evidence trail

Preserve everything connected with the fraud.

This may include:

• Dating or social-media profiles;
• Usernames and profile URLs;
• Full message histories;
• Email messages and headers;
• Telephone numbers;
• Voice notes and video files;
• Photographs;
• Identity documents;
• Bank-account details;
• Card-payment records;
• Cryptocurrency wallet addresses;
• Transaction hashes;
• Exchange account information;
• Investment-platform screenshots;
• Website addresses and domains;
• Supposed contracts or certificates;
• Names of advisers or representatives;
• Withdrawal requests and error messages;
• Requests for tax, release or administration fees.

Where possible, export full conversations rather than retaining only selected screenshots.

Do not edit the original files. Keep a secure original copy and use a separate copy for review.

Fourth step: Report the fraud

In England, Wales and Northern Ireland, fraud and cybercrime can be reported through Report Fraud. In Scotland, reports should be made to Police Scotland on 101.

Contact the police directly where there is:

• An immediate threat;
• Harassment;
• Stalking;
• Blackmail;
• Threatened violence;
• An arranged in-person meeting that creates a safety concern;
• Evidence that another person may be in immediate danger.

When reporting, provide a clear timeline covering:

1. How contact began.
2. What identity the person used.
3. When money or investment was first discussed.
4. How payments were made.
5. Which accounts, wallets or platforms were involved.
6. Whether any money was withdrawn successfully.
7. What further demands were made.
8. Whether threats, pressure or secrecy were involved.
9. Whether other people or supposed advisers participated.

Fifth step: Secure your accounts and devices

Fraudsters may obtain more than money.

They may also have:

• Passwords;
• Security codes;
• Passport or driving-licence copies;
• Bank statements;
• Remote access to a computer or phone;
• Access to email or social-media accounts;
• Personal information useful for identity theft;
• Contact details for friends and relatives.

Take the following steps where relevant:

1. Change passwords from a trusted device.
2. Use unique passwords for important accounts.
3. Enable multi-factor authentication.
4. Review email forwarding and recovery settings.
5. Remove remote-access software you were instructed to install.
6. Contact the bank if online-banking details were shared.
7. Review social-media privacy settings.
8. Monitor credit files and financial accounts.
9. Tell trusted contacts if impersonation is possible.
10. Seek technical assistance where a device may have been compromised.

The FCA advises consumers not to provide passwords, install untrusted software or allow remote access to devices.

How to recognise a romance-fraud case

Romance fraud is more likely where the central deception involves a supposed emotional or romantic relationship.

Common features include:

• Rapid emotional intensity;
• Promises of marriage or a shared future;
• Repeated avoidance of meetings;
• Requests for secrecy;
• Medical, travel or family emergencies;
• Pressure to demonstrate love through money;
• A supposed professional or celebrity identity;
• Continued contact after payments stop;
• Emotional manipulation rather than a clearly presented investment.

For broader warning signs, read How to Spot a Romance Scam: Warning Signs and Practical Steps.

How to recognise pig-butchering fraud

Pig-butchering fraud often follows a recognisable progression.

The unsolicited or accidental approach

The contact may begin with:

• A wrong-number message;
• A dating-app match;
• A social-media message;
• A professional-networking connection;
• An invitation to a private investment group.

The trust-building period

The offender creates a relationship and may discuss:

• Their daily life;
• Family;
• Work;
• Previous relationships;
• Future plans;
• Financial success.

The investment introduction

The offender claims that they or a relative have expertise in:

• Cryptocurrency;
• Foreign exchange;
• Gold;
• Shares;
• Commodities;
• Artificial-intelligence trading;
• Short-term market movements.

The false-profit stage

The victim may see an account balance increasing.

A small withdrawal may be allowed to build confidence.

The escalation

The victim is encouraged to invest more, borrow money or move retirement savings.

The blocked withdrawal

When the victim attempts to withdraw a substantial sum, the platform demands:

• Tax;
• Insurance;
• A security deposit;
• Account verification;
• A liquidity fee;
• A penalty;
• Additional investment.

Paying these demands rarely releases the displayed funds.

How to recognise a conventional investment scam

Investment fraud is more likely where the central deception is the financial product or opportunity.

Warning signs include:

• Guaranteed or unusually consistent returns;
• Pressure to invest immediately;
• A firm that cannot be verified;
• A cloned or misleading website;
• Unsolicited contact;
• Celebrity endorsements;
• Requests to transfer cryptocurrency;
• Instructions to install remote-access software;
• Difficulty withdrawing funds;
• Additional fees before withdrawal;
• Returns that exist only on the platform screen.

Before investing, check whether the firm and relevant individuals appear on the FCA Register and whether warnings exist. Do not use contact details supplied solely by the person promoting the investment.

Does the exact fraud type affect recovery?

It can affect the investigative and legal approach, but several initial actions remain the same.

Romance fraud

The investigation may focus on:

• The false identity;
• Linked profiles;
• Payment recipients;
• The emotional manipulation;
• Other victims;
• Assets or companies linked to the subject.

Pig-butchering fraud

The investigation may focus on:

• The relationship profile;
• The false trading platform;
• Cryptocurrency transactions;
• Wallet networks;
• Exchanges and off-ramp services;
• Organised fraud infrastructure;
• Money mules and intermediaries.

Investment fraud

The investigation may focus on:

• The firm or cloned identity;
• Directors and beneficial owners;
• Websites and domains;
• Recipient accounts;
• Marketing and referral networks;
• Regulatory warnings;
• Assets connected to identified subjects.

Different labels may describe different parts of the same case. The investigation should follow the evidence rather than forcing the facts into one category.

Bank transfer, card payment or cryptocurrency?

The payment method affects the available response.

Bank transfer

Contact the bank immediately and ask whether the transfer can be recalled or the receiving institution notified.

Keep:

• Account names;
• Sort codes;
• Account numbers;
• Payment references;
• Dates and amounts;
• Messages explaining the payment.

Debit or credit card

Contact the card provider and explain that the payment relates to suspected fraud.

Ask about:

• Chargeback;
• Section 75 protection, where applicable;
• Cancellation of recurring payments;
• Replacement of compromised card details.

Eligibility depends on the type of payment and circumstances.

Cryptocurrency

Preserve:

• Wallet addresses;
• Transaction hashes;
• Network details;
• Exchange records;
• Deposit and withdrawal history;
• Screenshots of the platform;
• Communications directing the transfer.

Blockchain analysis may show how funds moved, but it does not automatically identify the person controlling a wallet or result in recovery.

Should you continue communicating with the fraudster?

In many cases, ending contact is the safest option.

Continued communication can expose the victim to:

• Further financial pressure;
• Threats;
• Blackmail;
• Manipulation;
• Malicious links or files;
• Attempts to obtain more identity information;
• Recovery fraud.

In some circumstances, police, solicitors or investigators may advise preserving contact for a limited purpose.

Do not make that decision alone where there is a safety risk or significant financial loss.

Never send more money simply to keep the person communicating.

Beware of recovery fraud

Victims of romance, pig-butchering and investment fraud are frequently targeted again.

A recovery scammer may claim to be:

• The FCA;
• A police officer;
• A bank investigator;
• A lawyer;
• A cryptocurrency-recovery specialist;
• A government department;
• An international agency;
• A representative of the original platform.

The FCA reported almost 5,000 fake-FCA scam reports in the first half of 2025 and has warned about criminals impersonating the regulator to offer recovery assistance.

Warning signs include:

• Unsolicited contact;
• Guaranteed recovery;
• Claims that funds have already been located;
• Requests for tax, release or court fees;
• Pressure to act immediately;
• Payment demanded in cryptocurrency;
• Requests for remote access;
• Use of unofficial email addresses;
• Instructions to keep the recovery confidential.

Independently verify anyone offering assistance.

What can a private investigation examine?

Depending on the available evidence, an investigation may include:

• Identity and alias enquiries;
• Social-media and profile analysis;
• Telephone and email research;
• Company and address checks;
• Domain and website examination;
• Recipient-account intelligence;
• Cryptocurrency tracing;
• Link analysis;
• Identification of possible intermediaries;
• Asset tracing;
• Evidence collation;
• Cross-border investigative enquiries.

A private investigator cannot compel banks, platforms or cryptocurrency exchanges to disclose confidential records without lawful authority.

An investigation cannot guarantee identification, account freezing, prosecution or financial recovery.

When legal advice may be needed

Legal advice may be appropriate where:

• The loss is substantial;
• An account holder or company has been identified;
• Urgent freezing action may be needed;
• Disclosure orders may be required;
• Assets exist in the UK or overseas;
• A civil claim is being considered;
• Several victims or defendants are involved;
• The case crosses multiple jurisdictions.

Before commencing expensive proceedings, consider:

• The strength of the evidence;
• The likely defendant;
• The location and value of assets;
• The cost of legal action;
• The risk of asset dissipation;
• The prospects of enforcement.

A simple triage checklist

Use this checklist immediately:

Financial response

• Stop payments.
• Contact every relevant financial provider.
• Ask about recalls, account security and reimbursement options.
• Preserve all transaction information.

Evidence

• Export complete conversations.
• Save profile URLs and usernames.
• Record every account, wallet and platform.
• Preserve documents and screenshots.
• Create a clear payment timeline.

Reporting

• Report the fraud through the relevant official service.
• Contact police directly where there is a safety risk.
• Notify the dating, social-media or investment platform.
• Record reference numbers.

Security

• Change passwords.
• Enable multi-factor authentication.
• Remove remote-access software.
• Monitor financial and credit accounts.
• Warn trusted contacts about possible impersonation.

Further advice

• Avoid guaranteed-recovery services.
• Consider legal advice for substantial losses.
• Consider proportionate investigation where identities, networks or assets need to be examined.
• Seek emotional support where the fraud involved a trusted relationship.

For detailed post-loss guidance, read Romance Fraud Investigation and Asset Recovery: What Victims Should Do.

Fraud-investigation support

Conflict International assists individuals, families and legal advisers with matters involving romance fraud, investment fraud, false online identities and cryptocurrency transactions.

Depending on the circumstances, our work may include:

• Identity and background enquiries;
• Open-source and digital investigation;
• Company and address research;
• Financial intelligence;
• Cryptocurrency analysis;
• Asset tracing;
• Link analysis;
• Evidence collation;
• International investigative support.

Learn more about our Fraud and Financial Investigation Services, or contact us in confidence to discuss the evidence, realistic options and appropriate next steps.

Where money has recently been sent, contact the financial provider and report the fraud before waiting for a private investigation.