Lesson 2 — Pig-butchering in depth: the six-stage operational script

**Stage 1 — Contact.** The opening is almost always a 'wrong number' text, a misdirected LinkedIn message, a friendly DM in a crypto Telegram group, or a Bumble / Tinder / Hinge match. The contact is engineered to feel accidental and friendly. There is no investment pitch yet. The attacker is testing whether you respond. Documented contact-volume per operator is in the tens of thousands per week — they are running a funnel, and you are one prospect in it.

**Stage 2 — Rapport.** Days to weeks of warm conversation. The attacker invests significant time appearing to be a real human with a real life. They will share photos (often AI-generated, often borrowed from real social-media accounts elsewhere), discuss family or work, and ask questions about your life. The investment topic does not come up. The attacker is building the relationship that will later be used to extract funds. This stage is the longest and the cheapest to disrupt — if you treat unsolicited rapport from strangers as the marketing top-of-funnel that it is, the script ends here.

**Stage 3 — Reveal.** The attacker 'casually' mentions that they have been making good returns on a crypto platform. They are not asking you to do anything yet. They might mention that their uncle or aunt is a quant who tipped them off, or that they work in finance and have access to an unusual opportunity. They will mention specific numbers — 'I made 12 percent last quarter, my friend made 30' — designed to anchor your expectations. The crucial defensive cue is that no genuine investment opportunity ever arrives via unsolicited personal contact. The reveal is the moment to disengage if you have missed every earlier signal.

**Stage 4 — Demonstration.** You're invited to look at the platform. It's a fake, but it's a sophisticated fake — a clone of a real exchange UI, sometimes with a working app, sometimes with a real-time-looking price ticker. You're encouraged to deposit a small amount — say $200 — and shown a fake 8 percent return within days. You may even be allowed to withdraw the small amount, because the goal of stage 4 is to convince you the platform is real. This 'proof' deposit is the trap's load-bearing element.

**Stage 5 — Escalation.** Now you're encouraged to deposit progressively larger amounts. The script ramps quickly: $200, then $2,000, then $20,000, then your savings. The attacker may invent reasons for urgency — a closing window, a tax deadline, a regulatory event. They may simulate small market dips followed by recoveries to make the platform feel responsive. They will be loving, attentive, and emotionally invested at every escalation. By the time the target has deposited five or six figures, the rapport built in stage 2 makes withdrawal feel like betraying a partner.

**Stage 6 — Closure.** When you try to withdraw a larger amount — typically after escalation has plateaued — the platform begins inventing reasons you cannot. Withdrawal fees that must be pre-paid. Tax holds that require additional deposits. Regulator KYC fees. Each new demand is plausible-sounding and small relative to what's already on the platform. Many victims pay several of these 'unlock' fees before realising they will never see the original deposit. By the time closure is acknowledged, the attacker has typically run for weeks past the optimal point of disengagement.

How to talk to a victim: do not lead with 'this was obvious.' It wasn't obvious to them at the time, and shame is the single biggest blocker to filing the IC3 report, freezing residual accounts, and warning their bank. Lead with the script — pig-butchering operations target tens of thousands of people simultaneously, the operators are professionals, the victim was selected because they responded warmly to the opening, not because they were 'gullible.' Then move to action: file the report tonight, contact the bank tomorrow, do not respond to any 'recovery service' that contacts them in the next 30 days.