If you suspect a cryptocurrency investment relationship is a pig-butchering scam, stop sending money, contact the bank, card issuer, payment service or crypto exchange involved through an independently verified official channel, and report the fraud promptly to the FBI’s Internet Crime Complaint Center (IC3). You can also contact your local FBI field office. Do not delay a report because a transaction record or other detail is missing.
This U.S.-focused guide explains what to record, how to preserve original evidence, what to submit to IC3, and how to recognize fraudulent “recovery” offers. Reporting may help investigators; it does not guarantee that funds will be recovered or that a particular investigation will follow.
What “pig-butchering” means in this guide
The FBI uses “pig butchering” for a form of cryptocurrency investment fraud in which a criminal builds a relationship with a target and then steers the person toward a fraudulent investment opportunity. The FBI’s victim guidance covers this scam and directs suspected victims to stop payments and report to IC3. Read the FBI’s cryptocurrency-investment-fraud guidance.
The procedures below are based on U.S. FBI and IC3 guidance. They are not legal advice, a promise of a case outcome, or a guarantee that a bank, exchange or payment provider can reverse a transfer.
Take these actions first
1. Stop sending money
Do not send another transfer, “tax,” “fee,” verification payment or deposit requested by the suspected scammer. The FBI’s direct instruction is: “If you believe you’ve been a victim of this scam, stop sending money to the scammers. Visit ic3.gov, the FBI’s Internet Crime Complaint Center (IC3), to file a report.” FBI victim guidance.
2. Contact the service that handled the payment
If a payment or transfer was recent, promptly contact the bank, card issuer, payment service or cryptocurrency exchange used. Use a telephone number, website or in-app support path that you locate independently, rather than a link or contact supplied by the suspected scammer. Tell the provider that you believe the transaction is fraudulent and ask what action is still available. The FBI and IC3 materials identify exchanges and financial institutions as relevant reporting information, but they do not promise that a transfer can be reversed.
3. Report promptly
Submit a complaint through the FBI’s Internet Crime Complaint Center (IC3). The FBI also identifies a local FBI field office as a contact route. File as soon as you can; do not wait until you have reconstructed every message or located every transaction hash.
Choose the FBI reporting route
IC3 and a local field office are complementary routes, not competing services. The cited FBI guidance does not establish a guaranteed difference in response time or investigative outcome.
| Route | Role | What to provide |
|---|---|---|
| IC3 online complaint | The FBI’s online channel for an Internet-crime report | Your account of the contact, identities, platforms, communications, financial institutions and transaction details you have |
| Local FBI field office | An additional FBI contact route identified for victims | The same organized facts and records, including the timeline and transaction identifiers when available |
Use the official FBI and IC3 websites above to begin. Avoid search advertisements, unsolicited messages or social-media accounts claiming to file a report on your behalf.
Build a clear evidence file before you submit
A chronological, readable file helps you describe what happened without guessing. Start with a short timeline, then attach or list the underlying records. The FBI asks for details about the people involved, the platforms used, communications and each transaction. Its checklist is on the cryptocurrency-investment-fraud page, and IC3’s transaction guidance appears in its August 24, 2023 public service announcement.
Start with a one-page timeline
List events in order, using the date and time shown on the original record when possible. Include:
- When and where the first contact occurred, such as a messaging service, dating platform, social network, email or telephone call.
- How the person presented themselves and when the conversation shifted toward investing or cryptocurrency.
- Every request for money, the reason given, and the platform or wallet you were told to use.
- When an account was opened, a deposit was made, a withdrawal was requested, or a fee or tax was demanded.
- Each transfer and the related message, confirmation or account screen.
- When you stopped communicating, discovered that a balance or withdrawal was unavailable, or recognized other warning signs.
Keep the timeline factual. Distinguish what you personally observed from what the other person claimed. If a time is approximate, label it as approximate rather than silently converting it into an exact time.
Recommended Free Tools
Record every identifier used by the suspected scammer
Capture the identity and contact details the person used, even if you think they were fabricated:
- Names, aliases and usernames.
- Telephone numbers, email addresses and physical or mailing addresses.
- Profile links, account handles and sender identifiers attached to texts or emails.
- Cryptocurrency wallet addresses and any other account or payment identifiers shown in the records.
Do not discard an identifier because it appeared only once. A changed username, new phone number or second email address can be important when the events are compared.
Make a transaction ledger
For each transfer, create one entry with the fields below. Copy values exactly as displayed by the bank, exchange, wallet or payment service; do not retype a long address from memory.
| Field | What to record |
|---|---|
| Date and time | The transaction date and time, including the time zone if the record shows it |
| Asset | The cryptocurrency type or other asset involved |
| Amount | The amount sent and, where shown, the corresponding currency value |
| Sending address | The cryptocurrency address from which the asset was sent |
| Receiving address | The address that received the asset |
| Transaction ID or hash | The blockchain transaction identifier exactly as displayed |
| Provider or exchange | The bank, exchange, wallet service or other financial institution used |
| Receiving institution | The name and address of the receiving financial institution, when known |
Keep a separate entry for each transfer, including small test payments and transfers made after a promise of a withdrawal. If several transactions appear in one account statement, do not collapse them into a single total when the individual records are available.
Preserve the platform trail
List every website, domain, investment platform and application the person directed you to use. Record the URL or domain exactly as it appeared, the account name, and what the page claimed to show. Include exchanges used to buy, sell, send or receive cryptocurrency. If a site later disappears, retain the saved page, screenshot or message that identified it.
Save communications and sender information
Keep emails, text messages, direct messages, chat histories, voice-mail records, account notices and transaction confirmations. Preserve the associated sender address, phone number, username or account handle with each item. Messages that appear ordinary can establish when trust was built or when the investment request began, so do not save only the final demand for money.
Include relevant authentication details
IC3 and the FBI checklist include relevant two-factor-authentication or one-time-passcode information. Note when a code was requested, how it was delivered, what account or transaction it related to, and whether you entered or disclosed it. Put this information in your secure report and do not provide active codes to a new caller, texter or supposed recovery agent.
Identify the financial institutions involved
For each payment, name the bank, card issuer, payment service, exchange or other institution used. Add the institution’s address and the receiving institution’s name and address when known. Include account or case references shown on statements or support messages, but do not invent a reference number that you cannot verify.
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Repair Windows errors before they cause bigger problems3Scan for outdated or missing drivers - takes under a minuteMark uncertainty instead of filling gaps with guesses
The FBI says to include a detail if it may be relevant, even when you are uncertain. Label an item as approximate, disputed or unconfirmed and explain why. If you do not have a transaction record, say that plainly and provide the amount, date range, asset, platform and wallet information you do have.
Preserve original records without altering them
Keep the available records together: original emails, message exports, account notices, transaction confirmations and screenshots. Retain original files and records where possible. Make a separate working copy if you need to redact personal information for your own notes, add annotations or arrange documents in timeline order.
This is a practical documentation method, not a specialized forensic protocol. The reviewed FBI guidance asks for communications, identifiers and transaction information but does not prescribe a particular evidence-collection method, storage product or file format. Do not delete a conversation because it contains embarrassing details or because the sender later removes their account; preserve what you already have.
Use descriptive filenames and keep the relationship between a record and its timeline entry clear. For example, a transaction confirmation should be identifiable by its date, asset and transaction ID in your index. Keep a copy of the submitted narrative and attachments for your own records.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallSubmit the IC3 complaint even if information is missing
IC3 specifically says not to withhold a report because transaction information is unavailable: “If you do not have transaction information, please still submit a report to the FBI IC3 and provide as much information as you have.” The statement appears in the FBI’s August 24, 2023 public service announcement. Read the full IC3 guidance.
- Open the official IC3 website and begin the complaint form.
- Describe how contact began, how the relationship developed, and when the investment request appeared.
- Enter the suspected scammer’s names, usernames, phone numbers, email addresses, addresses and other identifiers.
- List every website, domain, application, investment platform and exchange involved.
- Provide the transaction ledger: dates and times, asset type, amounts, sending and receiving addresses, and transaction IDs or hashes.
- Name the financial institutions and exchanges involved, including the receiving institution’s name and address when known.
- Include relevant email and text communications, sender identifiers and one-time-passcode details.
- Explain uncertainty honestly and submit the report with the information available, even if a field cannot be completed.
Use the same factual timeline you prepared for the form. Avoid speculation about the criminal’s identity or promises about what investigators will do; identify claims as claims and attach the record that shows them.
If the transfer was just made
Speed matters for your own contact with the payment provider, but do not assume a reversal is possible. Call the bank, card issuer, payment service or exchange through an independently verified official channel, report the suspected fraud and ask what protective or dispute steps are available for that specific transaction. Keep the provider’s instructions and any case reference with your evidence file. Separately submit the IC3 complaint; contacting a provider does not replace reporting to the FBI.
Recognize a second “recovery” scam
The FBI warns that people who claim they can recover cryptocurrency-investment losses may be running another scam. A confident promise, a request for an advance fee, or a demand for additional cryptocurrency is not proof that the person is legitimate. Do not send a new payment or disclose account credentials, authentication codes or wallet-control information because someone says it is required to recover your money.
Free tools Windows power users keep installed
One-click scans. No signup required.
The FBI’s Operation Level Up resource provides warnings and guidance for cryptocurrency-investment-fraud victims, including filing IC3 reports when appropriate. Criminals impersonate FBI employees, government officials and the operation itself. Independently verify any contact through official FBI websites; an unsolicited message using an agency name is not authentication.
Common mistakes that weaken a report
- Continuing to pay to unlock a withdrawal: stop sending money and preserve the request as evidence.
- Waiting for a perfect file: IC3 accepts a report with the information you have, even when transaction information is missing.
- Saving only screenshots: retain original emails, messages, confirmations and files where possible, then use screenshots as supporting copies.
- Leaving out contact history: the first contact, relationship-building messages and platform invitations can connect the identity to the investment request.
- Omitting small or failed transfers: record each transaction and attempted payment that appears in the available records.
- Guessing at addresses or times: copy exact values and label uncertain details rather than creating false precision.
- Trusting a new “investigator” who found you: recovery claims and impersonation are documented risks; verify independently before responding.
- Editing the only copy: preserve originals and make a separate working copy for notes or redactions.
What a complete submission should contain
Before submitting, check that your file covers the following categories:
- A concise chronological timeline from first contact through the latest payment or demand.
- All names, usernames, phone numbers, email addresses, addresses and other identifiers used.
- Every website, domain, application, investment platform and exchange involved.
- Emails, texts and other communications with their sender identifiers.
- For each transaction: date and time, amount, cryptocurrency type, sending and receiving addresses, and transaction ID or hash.
- The banks, card issuers, payment services, exchanges and financial institutions involved, including receiving-institution details when known.
- Relevant two-factor-authentication or one-time-passcode information.
- A clear note identifying missing, approximate or uncertain facts.
Submit promptly rather than waiting for a missing hash, a reply from the scammer or a promised withdrawal. Preserve the remaining records and add accurate information if you later locate it through the appropriate official reporting channel.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →
Say something about this film