Crypto investment scam emails: pig butchering, fake platforms and recovery scams

Crypto investment fraud was the largest source of losses reported to the FBI in 2025, and it rarely starts with one dramatic email. It starts with a friendly message, builds trust for weeks, and uses email at specific moments: to make a fake platform look real, to demand a "tax" before a withdrawal, and later to offer a fake recovery. This guide explains the whole pattern, the red flags, and the second scam that follows the first.

How big is crypto investment fraud?

The FBI's 2025 IC3 Annual Report is direct: "Cryptocurrency investment fraud was the highest source of financial losses to Americans in 2025."

For context, IC3 recorded $20.877 billion in reported losses across all crime types that year. Investment fraud was the largest category, ahead of business email compromise. The report notes that recovery scam losses "may also include losses experienced from previous scams which prompted the contact with the recovery company."

The FBI says these scams are "largely perpetrated by organized criminal enterprises based in Southeast Asia using victims of human trafficking as forced labor to run the scam operations."

How does a pig butchering scam work?

"Pig butchering" is the criminals' own term. US regulators call it a relationship investment scam or relationship confidence fraud. The CFTC describes the crimes as "heinous crimes that leave victims with significant losses and broken-hearted" (CFTC, July 2024).

The FBI's description of the typical sequence:

1. First contact. Scammers "typically initiate contact through text messages, social media sites, advertisements, or dating applications."
2. Move the conversation. They "quickly move the conversation to a messaging platform."
3. Introduce the opportunity. Victims are introduced to investment groups claiming to be "knowledgeable industry insiders offering guidance on trading or investing in cryptocurrency or gold."
4. Fake profits. Victims send cryptocurrency to "fake investment scam platforms or apps" and "are shown fake profits and offered loans to encourage larger investments."
5. The exit. When victims try to withdraw, "they will be charged taxes and fees as a final attempt to exploit money from the victims before the scammers disappear with all the victim funds."
6. The second scam. "Victims are also targeted in recovery scams, claiming to help recover lost funds."

The joint SEC, CFTC, FINRA and NASAA investor alert adds that some scammers text a target "pretending to be an old friend," or send mass messages that look like they were meant for someone else. Others start on professional networking sites.

Where does email come into it?

Email is rarely the first touch in a pig butchering scam, but it plays a part at several stages, from the opening pitch to the recovery offer.

The FTC lists email among the channels crypto scammers use to impersonate companies, and is blunt about the payment side: "Only scammers demand payment in cryptocurrency," and "Only scammers will guarantee profits or big returns" (FTC). It also notes that celebrity endorsements and testimonials are "easily faked." The FBI's 2025 report says investment clubs use "AI-generated videos and voices of celebrities, CEOs, or trusted figures" to sell fraudulent opportunities.

The fee email is the moment many victims realize something is wrong, and it's the moment to stop. A real exchange takes fees out of your balance. It doesn't ask you to send new money before it will release your own.

What are the red flags?

The investor alert's warning signs, combined with the FBI's and FTC's:

1. Unsolicited contact from a stranger, especially a vague message or one that seems meant for someone else.
2. A quick move to WhatsApp, Telegram or another less monitored app.
3. Investment advice from someone you met online, or claims of insider knowledge.
4. Guaranteed or very high returns with little or no risk. The investor alert calls these "classic warning signs of fraud."
5. Screenshots of big profits, fake testimonials, or AI-generated images and videos.
6. Being steered to crypto, or required to pay with it, including at a crypto ATM.
7. Payments to an individual or an unrelated business, or an address that doesn't match a real office.
8. A small early withdrawal that works, followed by pressure to invest much more.
9. Fees, taxes or "loan repayments" demanded before you can withdraw.
10. Secrecy. You're told not to discuss the investment with your bank or family.

The CFTC's simplest rule covers most of these: "Never mix money with long-distance relationships."

How do recovery scams target victims afterwards?

Recovery scams are a second fraud aimed at people who have already lost money. The CFTC calls them "a form of advance-fee fraud," and says the same criminal groups often run both the original scam and the recovery scam.

Fake law firms

In August 2025 the FBI warned about fictitious law firms "exploiting victims' emotional state and financial need to recover funds from a previous scam." Red flags in that alert include:

• Fake letterhead and documents, sometimes impersonating real lawyers.
• Claims to be authorized partners of US or foreign agencies. The FBI notes no law firms hold that status with US Government agencies.
• Knowing the exact amounts and dates of your earlier transfers.
• Saying you're on a government list of scam victims and can recover funds through "legal channels."
• Asking for payment in cryptocurrency or prepaid gift cards. "The US Government does not request payment for law enforcement services provided."
• Sending you to register with a "foreign bank" whose website is fake, or adding you to a WhatsApp group of supposed bankers who demand verification fees.
• Refusing video meetings or to show a license.

People posing as the FBI's IC3

In April 2025 the FBI warned that scammers were impersonating IC3 employees, contacting victims by email or phone and claiming to have recovered their money. Its key statements:

• "The IC3 will never directly communicate with individuals via phone, email, social media, phone apps, or public forums."
• "The IC3 will not ask for payment to recover lost funds."

The same alert says some scammers create social media profiles and pose as fellow fraud victims in online groups. The rule is the same: anyone who asks you to pay to get scammed money back is very likely scamming you again.

What should you do if you've been scammed?

1. Stop sending money. That includes fees, taxes, "unlock" payments and recovery fees.
2. Collect the evidence. Wallet addresses, transaction IDs, platform URLs, usernames, emails with full headers, chat exports and screenshots.
3. Report to the FBI at ic3.gov, including every transaction detail.
4. Report to the exchange or app you used to send the cryptocurrency, and to your bank if money left your account. The FTC also lists ReportFraud.ftc.gov, the CFTC and the SEC.
5. Expect recovery offers, and ignore them. Verify anyone who claims to be from law enforcement by contacting that agency's local office yourself, as the FBI advises.
6. Get support. The FBI's Operation Level Up notified 3,780 crypto investment fraud victims in 2025; 78% were unaware they were being scammed. People aged 60 and over who need help filing a complaint can call the Justice Department's National Elder Fraud Hotline at 1-833-FRAUD-11 (1-833-372-8311).

If you clicked links or installed an app the scammers suggested, change your passwords from a clean device and follow what to do after clicking a phishing link.

How can businesses reduce the risk?

Crypto investment scams mostly target individuals, but they reach people through work accounts too: professional networking messages, contact forms and business email addresses that are public. A few steps help:

• Filter unsolicited investment and crypto mail. Bulk "trading signal" mail and fake platform notices are spam, and filters that weigh sender reputation, domain age and links catch much of it. Our guide to how spam filters work explains the signals.
• Watch for lookalike exchanges. Fake platforms copy real brands with lookalike domains.
• Warn finance staff about crypto payment requests. A request to pay a supplier or "fee" in crypto is a red flag in any context, and overlaps with business email compromise.
• Include investment scams in awareness training, especially for staff who might be targeted personally. Older employees and relatives are frequent targets. Our awareness training guide suggests a simple format.
• Make it easy to report. A one-click report button gets suspicious messages to IT quickly. See how to report a phishing email.

Other scams that ask for crypto, such as sextortion emails, use the same payment trick with a different story.

Next steps

1. Share the CFTC's rule with family and staff: never mix money with long-distance relationships.
2. Before investing, check that the person or firm is registered. The investor alert recommends FINRA BrokerCheck, and the CFTC suggests checking that a crypto platform is registered with FinCEN or a state as a money service business.
3. Treat any recovery offer as a scam until proven otherwise, and never pay upfront.
4. If you received a suspicious investment email at work, check where it came from with the Email Header Analyzer and report it.
5. Put filtering in front of your business mailboxes that catches spam, phishing and spoofed senders. iBlockSpam filters inbound mail at the MX for Microsoft 365, Google Workspace and cPanel; see how it works.

Browse our other phishing and threat guides.