‘Pig Butchering’ Scams Are Now a $3 Billion Threat
For seven years, the FBI's Internet Crime Complaint Center (IC3) has tallied the reports the United States law enforcement agency receives about all different types of digital crime and found that business email compromise scams resulted in the highest total losses each year. But in its annual “Internet Crime Report,” released today for incidents in 2022, “investment” scams have overtaken all others as the biggest digital threat, with $3.3 billion in losses last year.
IC3 reported that BEC—in which attackers trick businesses into making bogus payments or intercept legitimate payments—resulted in nearly $2.4 billion worth of losses in 2021 and $2.7 billion in 2022. In other words, the attacks are still a significant and rising threat. But investment scams, particularly those that claim to offer a path for cryptocurrency investment, have exploded over the last 18 months. They have been particularly fueled by so-called “pig butchering” scams, in which attackers cold-contact targets via texts or other messaging platforms, start a conversation to build trust, and then introduce the idea that they can help victims get in the door on a lucrative investment deal.
The $3.31 billion of overall investment scam losses in 2022 compares with $1.45 billion in 2021, an increase of 127 percent. And the FBI notes that cryptocurrency investment scams specifically caused losses of $2.57 billion in 2022, up from $907 million in 2021—an increase of 183 percent.
IC3 tracked pig butchering attacks by that name and categorized them under the umbrella of romance scams rather than cryptocurrency scams in 2021, citing $429 million in losses related to pig butchering that year. In the new report, IC3 doesn't mention the phrase “pig butchering” but says in an appendix that “One complaint may have multiple crime types.”
All the facts and figures seem to reflect IC3's efforts to quickly recategorize and recalibrate its understanding of how these scams are operating amidst pig butchering's meteoric rise. But there are no absolute numbers to compare to, so it is complicated to get a definitive picture depending on how you break down the different types of scams. For example, romance scams (also called “confidence fraud”) dropped from 24,299 complaints and nearly $956 million in losses in the 2021 IC3 report to 19,021 complaints and about $736 million in losses in 2022. Meanwhile, last month, the US Federal Trade Commission said it had received reports of close to 70,000 romance scams in 2022 and reported losses of $1.3 billion.
“Crypto-investment scams saw unprecedented increases in the number of victims and the dollar losses to these investors,” the FBI wrote in the 2022 Internet Crime Report. “Many victims have assumed massive debt to cover losses from these fraudulent investments.”
Researchers who have been tracking pig butchering say that the trend has been unmistakable. In recent research by the security firm Sophos, for example, senior threat researcher Sean Gallagher tracked one criminal campaign that originally appeared to have amassed about $500,000 worth of stolen cryptocurrency in one month. After continuing to investigate and identify more wallets linked to the attackers, though, Gallagher concluded that the gang had stolen about $3 million over five months.
Gloss