Inside the LinkedIn Pig-Butchering Playbook: How Scammers Groom Professional Victims

The operation begins with a LinkedIn profile designed to pass casual inspection. FBI case files show that sophisticated pig-butchering operations use AI-generated headshots — faces that do not belong to any real person and therefore return no results in reverse face search. The employment history is fabricated but plausible: a mid-level role at a real company the scammer has no connection to, followed by a current position at a convincingly named but unverifiable firm.

The profile accumulates connections from a network of other fake accounts operated by the same criminal organisation. This gives the profile a surface appearance of legitimacy — several hundred connections, some mutual with the target.

The target receives a connection request accompanied by a brief, professional message. Common openers include references to shared industry, shared educational background (gleaned from the target's own LinkedIn profile), or a generic professional compliment. The message is warm but not romantic — the goal is a professional connection, not a date.

FBI analysts note that the initial message is often sent by an automated system to thousands of targets simultaneously. Only those who respond receive continued attention from a human operator.

Once a target responds, the operation shifts to a human operator who maintains the conversation. This phase can last anywhere from two weeks to three months. The operator discusses professional topics, shares career advice, expresses interest in the target's work, and often mentions personal details designed to build rapport — a shared hobby, a relatable life situation.

The conversation moves off LinkedIn to WhatsApp or Telegram, where message history is less visible to platform moderation and the operator can maintain more intensive contact.

The investment topic is introduced gradually, usually as the scammer sharing their own supposed success. They mention a cryptocurrency trading platform they use, show fabricated screenshots of returns, and offer to help the target set up an account. The platform is entirely controlled by the criminal organisation.

Initial investments are small — $500 to $2,000 — and the victim sees rapid, convincing returns. This phase, the "fattening," can last several weeks. The victim is encouraged to reinvest profits and recruit family members. Losses at this stage average zero; the platform shows positive balances.

When the victim attempts to withdraw funds — usually after the scammer has encouraged a large deposit — the platform imposes a tax, compliance fee, or verification requirement. Each fee is framed as a bureaucratic hurdle rather than a red flag. Victims who have already invested significant sums often pay the fee, only to face another one.

The platform eventually becomes unreachable. The scammer's profile is deleted. Funds are unrecoverable. The average reported loss in cases reported to the FBI IC3 exceeds $200,000.

The most reliable intervention is at Step 1: verify the profile photo before engaging. A face that returns no results in reverse face search — or returns results under a different name — is the clearest early warning. Independently verify the claimed employer before the conversation moves off-platform. Any mention of cryptocurrency investment before a face-to-face video call should end the interaction immediately.