Register
Sign in
Menu
.jpg)
.jpg)
A customer sends money to a new recipient after weeks of messages with someone they believe is a romantic interest, friend or investment adviser.
Their bank sees an unusual transfer. A crypto company may see a deposit or withdrawal involving the receiving wallet. A local investigator may later receive a victim report naming the same platform, phone number, account or wallet.
Each organization has a piece of the incident. None necessarily has the full picture.
That is the operational challenge behind many pig-butchering scams. The fraud begins as a personal interaction but the response quickly becomes a problem of financial intelligence, digital-asset movement, victim evidence and coordination across organizations.
The question is not only whether an institution can identify suspicious activity. It is whether the people reviewing that activity can establish when their separate concerns belong to the same criminal operation.
On September 3, 2026, the Financial Crimes Enforcement Network published an alert and financial trend analysis focused on digital asset investment scams operated by overseas scam centers.
FinCEN analyzed 33,904 Bank Secrecy Act reports filed between September 8, 2023, and December 31, 2025. Those reports involved approximately $12.7 billion in financial activity tied to suspected digital asset investment scams.
That figure is important but it needs to be read accurately. It reflects reported financial activity associated with suspected scams. It is not a confirmed measure of total victim losses.
The reports involved victims of all ages across all 50 states and several U.S. territories. They also point to the scale of the networks behind these scams. FinCEN describes transnational criminal organizations, predominantly based in Southeast Asia, using false identities, fraudulent investment platforms, money mules, shell companies, professional money launderers and digital-asset transfers to extract and move funds.
The fraud may feel personal to the victim. The machinery behind it is often not.
“Pig butchering” is widely used to describe a type of relationship investment fraud. FinCEN uses the term ‘digital asset investment scam’, while other organizations use terms such as romance baiting or cryptocurrency confidence scam.
The language varies but the pattern is consistent. A scammer begins contact through a social-media platform, dating app, messaging service, text message or an apparent wrong-number conversation. They build familiarity over time, then introduce an investment opportunity that appears credible.
The victim may be directed to a fraudulent website or mobile application that displays fabricated investment gains. Early withdrawals may be allowed to build trust. Later, the victim is encouraged to send larger amounts, pay supposed taxes or fees or make another transfer to unlock their account.
By the time a bank or crypto company sees the payment, the fraud may already have developed over weeks or months.
This is why a transaction review can be difficult at this point. The customer may not believe they are being defrauded. They may describe the recipient as a trusted contact or the payment as a legitimate investment. The underlying relationship, the messages received and the website or app used can be as important as the transaction itself.
Transaction monitoring can identify activity that deserves review. It may flag increasingly large payments, transfers to new recipients, rapid movement of funds, activity inconsistent with a customer profile or payments connected to known scam typologies.
Blockchain analytics can add another important layer. It can help teams trace a wallet, examine transaction flows, identify service exposure and understand how value moved after a victim sent funds.
Both are essential. However, neither can answer every question an analyst or investigator needs to resolve.
A bank may see the outgoing payment. A second institution may be reviewing the receiving account. A crypto company may have information about the wallet activity. A law-enforcement agency may hold a victim report involving the same recipient or infrastructure. Those facts do not automatically meet.
Consider a customer who sends money to an account connected to a purported investment platform. The platform may see an unusual transfer pattern. The receiving platform may see a newly opened account collecting payments from multiple individuals. A detective in another state may be investigating a complaint involving the same platform name and phone number.
Each team has a reason to investigate. However, if they do not know the others are looking at related activity, they may develop separate fragments of the same case.
The missing piece is not another alert. It is relevant context.
Scam centers are designed to separate the parts of a fraud operation. One group may manage victim communications. Another may create websites or fake applications. Money mules may open or control accounts used to receive payments. Digital-asset services may be used to convert, transfer or obscure the proceeds. Professional money launderers may move funds through shell companies, exchange accounts, stablecoins or other payment infrastructure.
This structure makes it difficult for any one institution or agency to see the full operation.
The victim knows the story they were told. The crypto company knows the wallet or account interaction. Law enforcement may have the broader pattern, a related victim report or an active investigation.
Fraud networks benefit when those views remain separate.
The answer to this is not unrestricted access to customer records or agency case files. That would be neither appropriate nor necessary.
A better model starts with a narrower question: Does another authorized participant already hold relevant context on the identifier under review?
That identifier may be a wallet, account, phone number, email address, domain, beneficiary, entity or other artifact connected to the case.
A more effective response to pig-butchering scams has three stages.
Financial institutions should continue to use transaction monitoring, fraud controls, customer outreach, sanctions screening, blockchain analytics and case-management processes to identify activity requiring review.
The record should capture more than the payment itself. Where relevant and available, it may include the customer’s explanation, the supposed investment platform, the recipient details, related wallet addresses, communications evidence, and the timeline of events.
An alert or a suspicious transaction does not prove that an outside investigation exists. It also does not mean the activity is isolated.
This is where deconfliction matters. It helps authorized participants determine whether another verified agency or institution is examining the same identifier or related matter.
A confirmed overlap is investigative context, not proof of criminal conduct. The bank or agency still evaluates the facts, applies its own policies, and follows the appropriate legal process.
When the overlap is relevant, authorized parties can decide whether additional coordination is appropriate.
That might involve preserving records, prioritizing a review, identifying the correct law-enforcement counterpart or responding through established legal processes. It may also involve voluntary information sharing between eligible financial institutions under Section 314(b) of the USA PATRIOT Act, subject to the program’s requirements and safeguards.
The purpose is not to make every participant share more information by default. It is to give the right people a clearer route to act when a connection matters.
Deconflict is built for the gap between a suspicious signal and a meaningful next step.
Signal helps authorized financial institutions assess whether the wallet, account, counterparty or other identifier already under review has verified law-enforcement relevance. It adds a separate source of context alongside the institution’s existing transaction-monitoring, fraud, sanctions-screening, blockchain-analytics and case-management workflows.
Nexus supports secure, attributable coordination between authorized financial-institution and law-enforcement participants when follow-up is appropriate.
Neither product replaces the institution’s own investigation, transaction monitoring, legal judgment or lawful process. A match does not determine that an account should be closed, that funds should be frozen or that a person has committed a crime.
The value is more focused. It helps the people responsible for the review understand whether an alert may have wider investigative significance and identify the appropriate counterpart before fragmented reports become separate missed opportunities.
Pig-butchering scams expose a difficult reality of modern financial crime.
The fraud begins with trust. The proceeds move through a network. The intelligence arrives in separate places.
Banks, crypto companies, and law-enforcement agencies each play a different role in the response. Their work becomes stronger when they can recognize a relevant connection early enough to preserve evidence, protect victims and act on the facts they hold.
A suspicious transfer is a starting point. The real question is whether it is part of a story someone else has already begun to understand.
Pig-butchering scams are relationship-based investment frauds in which criminals build trust with a victim before directing them to a fraudulent investment opportunity. FinCEN refers to this typology as digital asset investment scams.
The fraud often unfolds across several systems. A victim may communicate through one platform, fund the payment through a bank, purchase digital assets through another service and send them to a wallet connected to a wider criminal network.
Relevant information can include payment details, account and wallet identifiers, transaction hashes, recipient information, websites or applications used, messages with the scammer, customer explanations and the timeline of the suspected fraud.
Deconfliction is the process of determining whether another authorized organization is already examining the same wallet, account, phone number, domain, person, entity or related identifier. It helps teams recognize relevant overlap without automatically sharing sensitive case information.
Deconflict adds verified law-enforcement context to the identifiers financial institutions already review. Signal supports alert and counterparty review, while Nexus provides a secure and documented route for appropriate coordination with verified law-enforcement counterparts.