How Transaction Monitoring Investigators can follow the money?

Pig butchering is not simply an online investment scam. From an AML perspective, it is a financial-crime ecosystem that can combine social engineering, romance or confidence fraud, fake investment platforms, virtual assets, money mules and professional money laundering networks.

For Transaction Monitoring (TM) investigators, this distinction matters. The alert may appear as an ordinary transfer to a virtual-asset exchange, an unusual international payment, or a sudden movement of a customer’s savings. The real investigative question is:

What story sits behind the transaction & where does the money ultimately go?

FATF’s work on cyber-enabled fraud identifies pig butchering as a combination of romance/confidence fraud and investment fraud, where criminals build trust before persuading victims to transfer funds into fraudulent cryptocurrency investments. FATF

What exactly is “Pig Butchering”?

The term comes from the idea of building trust with a victim over time before financially exploiting them.

A typical scheme may develop through several stages:

1. Initial contact The victim is approached through social media, messaging applications, dating platforms, professional networks or other online channels.

2. Trust building The fraudster develops a relationship with the victim—sometimes presenting themselves as a friend, romantic interest, successful investor or business contact.

3. Investment opportunity The victim is introduced to a supposedly profitable investment, frequently involving cryptocurrency or another digital asset.

4. Fake investment environment The victim may be directed to a fraudulent website or application showing apparently successful investments and fabricated profits.

5. Escalation The victim is encouraged to invest increasingly larger amounts. In some cases, a small withdrawal may initially be permitted to create confidence.

6. The “exit” stage When the victim attempts to withdraw the funds, the fraudster may demand additional payments described as taxes, fees, penalties or other charges. Eventually, communication stops and the funds disappear. FinCEN.gov

What Should a TM Investigator Look For?

The investigator should avoid treating a single transaction as the investigation.

Instead, examine customer + behaviour + transaction + counterparty + destination + subsequent movement.

1. Start with the Customer

Ask:

• What is the customer’s occupation/business?

• What is the expected source of funds?

• What was the customer’s historical transaction behaviour?

• Has the customer previously used virtual assets?

• Is there a sudden change in transaction behaviour?

• Is the customer liquidating savings or borrowing funds?

• Does the activity make sense in the context of the customer’s profile?

For example, a customer with no apparent history of cryptocurrency activity suddenly liquidating savings and sending substantial funds to a VASP should attract closer examination. FinCEN specifically identifies this type of behavioural and financial pattern as a potential indicator. FinCEN.gov

2. Follow the Money, Not Just the Alert

This is where an investigator can add real value.

Don’t stop at:

Customer → Crypto Exchange

Build the financial chain:

Customer → Bank Account → VASP/Payment Provider → Wallet → Other Wallets → Exchange/Off-ramp → Beneficiary

Where information is available, examine:

• multiple beneficiaries;

• repeated payments to the same VASP;

• rapid movement after receipt;

• common counterparties across apparently unrelated customers;

• multiple accounts sending funds to the same destination;

• movement through several virtual wallets;

• conversion between virtual assets;

• subsequent cash-outs or transfers.

FATF notes that cyber-enabled fraud proceeds can be rapidly moved through networks of accounts spanning multiple borders and financial institutions, with both individuals and legal entities appearing in laundering networks. FATF

3. Look for the Red-Flag Combination

Potential indicators can include:

Customer behaviour

• sudden interest in cryptocurrency investment;

• unusual urgency to transfer funds;

• customer appearing anxious about meeting an investment deadline;

• explanation involving a new online contact;

• unfamiliarity with the investment platform.

Financial behaviour

• liquidation of savings or investments;

• borrowing against property or other assets;

• sudden high-value transfers to VASPs;

• multiple small “test” transactions followed by larger transfers;

• dormant accounts becoming highly active;

• transfers described as “taxes”, “fees” or “penalties” associated with releasing investment funds. FinCEN.gov

Technical/digital indicators

• unusual device or IP activity;

• access from locations inconsistent with the customer’s normal behaviour;

• suspicious investment websites or applications;

• domains resembling legitimate financial or cryptocurrency platforms;

• movement between different virtual assets or wallets shortly after funds are received. FinCEN.gov

But remember: a red flag is not proof of pig butchering. FinCEN explicitly states that no single indicator is determinative; investigators should consider the customer’s history, circumstances and combination of indicators. FinCEN.gov

4. Investigate the Customer’s Explanation

Suppose a customer says:

“I am investing in cryptocurrency.”

That is an explanation—not an investigative conclusion.

The investigator should consider:

• Who introduced the customer to the investment?

• What is the investment platform?

• Who is the beneficiary/VASP?

• What is the stated investment purpose?

• Is the platform independently identifiable?

• Does the customer actually understand the transaction?

• Why is the customer transferring unusually large amounts?

• Are there repeated payments after supposed investment gains?

• Are “taxes” or “withdrawal fees” being requested?

• Is the customer potentially a victim rather than a willing participant?

That last question is particularly important.

A suspicious transaction does not necessarily mean “the customer is the criminal.”

The customer may be the victim whose account is being used to send funds to criminals.

5. Look Beyond the Individual Account

Pig-butchering investigations can reveal a much larger network.

Ask whether other customers are:

• sending funds to the same beneficiaries;

• using the same VASP or payment intermediary;

• interacting with common accounts;

• transferring funds within similar timeframes;

• receiving funds from apparently unrelated parties;

• showing similar transaction narratives or behavioural patterns.

This can transform an investigation from:

“Customer X made an unusual cryptocurrency transfer.”

into:

“Several apparently unrelated customers are transferring funds to interconnected beneficiaries associated with a suspected fraud network.”

That is a very different level of financial intelligence.

FATF’s 2026 work on cyber-enabled fraud emphasises the importance of information sharing, beneficial-ownership information, virtual-asset controls, rapid information exchange and cooperation between financial institutions and authorities. FATF

6. Don’t Ignore the Money-Laundering Side

For AML investigators, the investigation should not end when the victim sends the money.

The proceeds side is equally important.

Current FinCEN analysis published in September 2026 identified approximately $12.7 billion in financial activity associated with suspected digital-asset investment scams across 33,904 BSA reports filed between September 2023 and December 2025. FinCEN also identified the use of money mules, professional money launderers, shell companies and stablecoin transfers to overseas exchanges in laundering scam proceeds. FinCEN.gov

This means investigators should consider two connected questions:

Victim side: How was the victim induced to send the money?

Criminal side: How did the criminal network receive, move, conceal and ultimately cash out the proceeds?

How Should the Investigator Articulate the Case?

A strong investigation should tell the financial story, rather than simply listing red flags.

For example:

“The customer, historically maintaining limited digital-asset activity, liquidated substantial savings and subsequently initiated multiple transfers to a virtual-asset service provider. The activity commenced shortly after the customer established contact with an unidentified online investment contact. The customer subsequently made additional payments described as investment-related fees and attempted to transfer further funds despite the absence of independently verified investment returns. The transaction pattern, sudden behavioural change, stated purpose, counterparties and subsequent movement of funds collectively warrant further investigation for potential exposure to an investment fraud/pig-butchering scheme.”

The exact conclusion will depend on the evidence available and the applicable reporting framework.

The Investigator’s Golden Rule

Don’t investigate the transaction in isolation. Investigate the story behind the transaction.

For suspected pig-butchering activity:

Know the customer. Understand the behavioural change. Follow the money. Test the investment story. Identify the counterparties. Look for connected victims and accounts. Trace subsequent movement. Distinguish victim from perpetrator. Document the reasoning—not just the red flags.

The broader lesson for Transaction Monitoring is simple:

The strongest investigation is not the one that finds the most red flags. It is the one that explains how the facts connect.

Key references

• FATF – Cyber-Enabled Fraud: Digitalisation and ML/TF/PF Risks FATF

• FinCEN – Pig Butchering Alert FinCEN.gov

• FinCEN – September 2026 Digital Asset Investment Scam Analysis FinCEN.gov

#AML #TransactionMonitoring #AMLInvestigations #PigButchering #CyberEnabledFraud