Learning from Financial Fraud Series Episode 7: Understanding “Pig Butchering”

Announcer  00:04

Welcome to the Treasury Update Podcast presented by Strategic Treasurer, your source for interesting treasury news, analysis, and insights in your car, at the gym, or wherever you decide to tune in.

Jonathan Jeffery  00:18

Welcome back to the learning from financial fraud series on the Treasury Update Podcast. In this series, we explore multiple major fraud cases, we dissect how each one occurred and was kept hidden for a period of time, and we’ll dissect how it was eventually discovered, and get insight and guidance on how to prevent this type of situation from happening to you, and your organization. I’m Jonathan media production specialist here at Strategic Treasurer, and your host for this podcast and I’m here with Craig Jeffery. Welcome, Craig.

Craig Jeffery  00:47

Jon, thanks for having me on. I’m excited to talk on the fraud series. Again, this one has one of the most interesting names for this type of fraud.

Jonathan Jeffery  00:56

So this week, we won’t be talking about a specific example of someone who got defrauded or a criminal but we are talking about a type of fraud, called pig butchering. It’s got a very interesting name. But before we get into that, let’s do a recap of the past six episodes in this series. We’ve covered the Parmalat fraud scandal Satyam scandal, the Wirecard fraud scandal, the FTX trading scandal, the Enron accounting scandal, and the scandal with Bernie Madoff and his Ponzi scheme. Do you want to share some something interesting from one of those episodes? If the listeners want to go back and hear one of them? What are your thoughts?

Craig Jeffery  01:36

Each of those examples of the fraud cases even though they span up to 20 years, are quite instructive. Parmalot, it’s an Italian dairy. One of the things I find most interesting about that is it’s a fraud case about creating fake fake balances in bank accounts. They fooled the auditors that created, you know, multi multi billions of dollars of loss, and was was significant and that there’s learning from each of these that is still applicable to today. I wouldn’t say that everyone has solved the issue of how you track and manage bank accounts and have visibility to them. So that’s one that I would I would point out is particularly interesting. And that that’s from a pretty long time ago.

Jonathan Jeffery  02:20

Yeah, it’s interesting. You chose that one because we’re moving from dairy over into pig butchery. So it’s all about farm, farm stuff, right? Farming and treasury. This is a type of fraud that targets individuals. Can you describe what it is and why we’re talking about it today?

Craig Jeffery  02:37

Yeah, well, it has been has been targeting individuals. That’s where the key thrust has been. But some of the techniques they’re using, we do expect them to leverage these techniques and learnings into the corporate space for corporate fraud, just like we’ve seen. Every type of fraud, it expands, their their criminal playbook expands. But so what is pig butchering, besides being one of the coolest names for fraud, where to come from, it’s the criminals who do this call their victims pigs. And the butchering is also related to fattening up. And so there’s a there’s a process, they identify a victim, they call pigs, and they fatten them up, which means they’re trying to exfiltrate money as much as they can. And then the slaughtering is when they cut them off and make it so that they can’t locate their money or gain access to it. So that’s where the the farm language comes from. This type of fraud has received announcements and alerts from FinCEN because of how extensive it’s been. So there are some there are some cases that are described, where you know, a group of let’s say seven individuals lost over $10 million through a series of different URLs and websites where this occurred. So there’s not as much details individuals aren’t sharing the information on how they got scammed. But this is a very significant deal. It’s, it’s a lot of money that’s been scammed through this process.

Jonathan Jeffery  04:08

I don’t think this is necessarily new. But it’s been in the news a lot lately, and people are starting to talk about it. And recently this is this kind of happened with one of my friends, someone used their name. Instead of building a relationship with someone to make this happen. They use their name to get in with people that trusted them, and basically doing this whole scheme. But jumping through it without having to build the relationship. They just access someone else’s relationship. Can you walk us through some examples of how you might see this happen to you?

Craig Jeffery  04:42

There’s a few things we’ll understanding that usually requires understanding how the criminals approach things right? First, they’re trying to build trust with the target of the victim. They oftentimes use fictional identities, potential relationships, or they pretend they’re getting back in contact with some law. long lost friend. And so it’s like a mistaken connection, they build a relationship, they usually have some kind of complex storyline get out of debt example. And they eventually work it to the point where the victims put some money into a virtual currency, or at some FX screen scheme, and they, they use the to take over control of the person’s computer, or they run it through different fictional websites, so that people can see Oh, my returns are awesome, they’re great. And then they will continue the process of expanding that usually with increased urgency. There’s always a sense of urgency that leverages this activity, we see that in corporate frauds, for, hey, you got to make this payment, the CEO wants this done quickly. And this is done on the individual level as well. And so it’s that’s a aspect or technique that’s used here as well. So the too good to be true. It was serendipity that this person contacted me he thought he was contacting his long lost friend, and oh, wait, there’s a, there’s a there’s a huge opportunity. And then yeah, you should get your friends and family involved in this too. So there’s a way of getting people hooked in for them to move funds in a way that the scammers and the criminals can control it. And they’ll put some pressure on at the end to try to exfiltrate the most amount of funds at the end before they butcher them, cut them free. And with all their money gone.

Jonathan Jeffery  06:27

The conversations that you can read about pig by training where they show you examples. They’re so bad. Like if I got messages like that, I would, I wouldn’t fall for it. But people do. Why are why are people responding to these messages? And why? Why does this work?

Craig Jeffery  06:43

It’s hard to say why certain things work, just like the old messages that would come in that say, you know, I’ve, I work at a bank, we got this huge account, here’s a here’s a news article about someone who died in a plane crash, they left all this money, and I want to split it with you where you get 40%, I just need to ship it to you. And you need to fill out this paperwork, that information used to be written very, very poorly and horribly. It’s gotten much better the frauds gotten better. And so it’s hard to say why some people fall for certain types of crimes, could be they’re distracted, something comes up and all of a sudden, something seems credible to them. And they’re moving forward in the process. Today I’m contacting a person who went through their Facebook pages has people standing there with a sign that says, you know, they got their debt free, they got rid of, you know, $75,000, $85,000 worth of debt. And then in the comments, it talks about they were using, you know, digital virtual currency. And I know the person who’s, whose site that’s on, and I, I would say I’m, if not 99% sure, I’m 100% sure they’re not posting though someone has gained control their account. And the person is, you know, a well respected person, they’re probably not looking at their Facebook. And so it has all this stuff. So if someone’s like, wow, they got out of debt in a short, in months. And why why can’t I do that? And it mentions the digital currency already there. So it that’s in my mind, that’s extremely likely that that is another example of how I can spoof people, I leverage a position of trust, right, because it’s going to the people in their, their Facebook group or their their social media connections. And it’s like, oh, there’s already people that are doing that. I want some of that I want to be able to change my financial condition very, very rapidly. Get rich quick is always attractive to people in different ways. How do you get past people’s inhibitions on certain things? I’m not the right person to ask that. But there’s always people who fall for that. And, and it’s also a target to, they also target elderly people. So we’ll put some stuff in the show notes about like in the US the national elder fraud hotline. And there’s also ways to report to IC3.gov When you see this, but yeah, so there could be a different range of why people fall prey to those.

Jonathan Jeffery  09:03

Getting into someone’s account and leveraging their reputation seems much more effective. And like the situation I was talking about earlier, someone created a Venmo account with my friend’s name, and a picture that was his not from his Venmo but from like Facebook or something, and then requested money and said, I’m at the grocery store can I’ll pay you back? Like that’s a much smaller scale because I think it was like 200 bucks. But it’s still like, that’s enough where they’re not going to pay the groceries with Venmo. So it was weird, but that’s gonna get people to go okay, yeah, I know this person. I trust them. But that’s not what pig butchering is because pig butchering is reaching out anonymously and saying, like, I get texts all the time that say, Hey, Wilbur, are you still looking for this type of loan? We can get it for you interest free. Like I get stuff like that. They are Wilbur, Tom if they just make up a name, and then I’m assuming that if I reply, they’ll say oh, Well, hey, Jonathan, we’re actually offering this rate to anybody. How do people trust that? I mean, that’s that’s my question I don’t understand yet. But.

Craig Jeffery  10:08

Well, you know, if you read if you read Charlotte’s Web, Wilbur, I think was the pig.

Jonathan Jeffery  10:12

Yeah, and he got butchered.

Craig Jeffery  10:14

He got butchered.  At some point.  I can’t remember that part of the story or is like, but you know, Charlotte Webb like some pig get butchered? I can’t remember.

Jonathan Jeffery  10:23

No, I think he I think he made it out from his talent. But let’s get into some more details on the process. Do you want to go through mistaking contact the pitch? You’ve got, you’ve got a whole list of fund, invest, expand, amplify and adapt? What what can we learn from these?

Craig Jeffery  10:38

I was ready. I know you asked me lots of detailed questions. And, and this is what this is targeting consumers more at the moment, the principle, the principles that the criminals are using their playbook, that’s going to continue to impact corporations. But you know, there’s the initial mistake in contact with a person to establish a relationship, there’s a pitch on the investment side, how they’re trying to convince people to, to get into it, and then expand that. And then there’s a amplification process at the end, usually, and then there’s the butchering process. That concludes it. So we already talked about some of those items for social media sites, or dating sites, gaining control of a Facebook account, sending texts or other methods. Here’s a, I’m trying to establish a connection with an old friend, Let’s reconnect. It’s like, oh, yeah, cuz this is opportunity, I can only share with some friends. Oh, wait, you’re not. You’re not Wilbur, the pig in the book, you’re somebody else? Oh, well, it’s available to you, too. There’s some way of making this contact, either known or unknown, but oftentimes, it’s some mistaken contact. So that it’s like this is very fortuitous that they contacted me and I can, I can reap these benefits. But the pitch is some type of making investment in this. And it’s going to be quite lucrative. And oftentimes, it’s in virtual currency, or it’s in some type of FX trading, you know, hey, there’s, there’s differences that you can take advantage of. And so what they do, though, is not just say, send money, he’ll do great. They also manipulate screens, they create fake websites, they have plugins to be able to falsify information, they insert plugins into the browser of the user. And then they can show hey, here’s your balance, you made a trade and now the value is up. And so they’re looking on the screen and say, I see it, this is what I see, I can recognize that the rates moved in my favor, I’ve made money, or this is how you can make money. Part of that is they’re showing them that information. There’s also or oftentimes getting someone to register with a virtual asset service providers to someone who manages virtual currency. So get them to register, sometimes they’ll register for them if they gain control their PC, and then work with them to transfer funds into it. So there’s the registering, and then moving funds, by wire transfer, prepaid cards, or they’re buying virtual currency, somehow they’re buying virtual currency, moving out of their banking system, their banking accounts into provider of of this virtual currency, they’ll use that virtual currency to invest into other purported assets that will give generate a high yield. So they’re, they’ve converted to digital currency, and now they’re investing into some type of account that’s controlled by the scam, or, Hey, this is an investment, and then they can see their investments grow. And so it’s either controlled by them individually or through other other parties that are referred to by, you know, FinCEN and law enforcement as co-conspirators. They get to show that they’ll let people see that there’s a return, they’ll usually let people pull some funds out today. It’s like, Hey, I’m not I’m not so confident, well, take some funds out, just to see how it works. Oh, yeah, you can take funds out. It’s, it’s a legitimate, legitimate process. And they’ll expand it, hey, you’re earning quite a bit of return on this. Why? Why wouldn’t you share this with family and friends, you’re earning massive, you know, you’re not, you’re not earning 5% a year, 10% a year, you’re earning massive returns on this? Don’t you want other family members to participate? So that’s a way of expanding the market. They’ll do another process to John like, trying to amplify the urgency because they’re trying to really fatten up the pigs to the maximum level before their butcher. Right? When you bring the pigs to market, you want them to weigh the most, I’ve never brought pigs to market, but I assume you want them. I know you I know. You want them to be fattened up for market you want them to be to get a good yield on them. So how do I do that? We create time sensitive situations, you’re gonna miss out. There’s just high pressure, the sense of urgency, those the sense of urgency, is that part of that answer to your question about how do they get people to do it, it’s like, here’s a big opportunity. You’re gonna miss out there’s a closing window, make a decision quickly. They also are adapting. So some of these scammers are setting up virtual gaming sites that they can use to steal virtual currency from players like they’ll let them register. They’ll plug in some information like, here’s a setup for access to my virtual currency account. Because when I want to buy, you know, some dance move or whatever the thing is that, that they’re buying on those sites that they can then pull the money out and do that.

Jonathan Jeffery  15:24

So don’t give your kids your credit card when they’re playing video games.

Craig Jeffery  15:28

Yeah, that would be a that would be a takeaway from another podcast, but like, certainly don’t give your kids a credit card, don’t let them use your computer. But that whole promise of greater returns, really is what helps amplify the losses that occur. They invest more, and you’re earning more, put more, and you can really amplify what you’re doing. And then finally, John, the butchering is once they start running out of funds that they can invest, it slows or it stops. It’s like, how can I get the last bit out? So this is part of their playbook? How can I get the last bit of money out of them, I don’t want to leave money on the table, I don’t want to be embarrassed by my other scammers and criminal friends, like you left a lot of money on the table, they’ll push for, you know, hey, you have a loss, you got to make a make of that loss for the deposit. Like why don’t have money, it’s like, well, you’re gonna have, you’re gonna have fees and taxes. And then if someone tries to withdraw funds, it’s like, you can’t get those out without paying fees and taxes. So to get the, let’s say you have 500,000, or whatever, it’s like, you’re gonna have to pay fees and taxes to pull that money out. And so you’re like, Well, I’m gonna pay that to get the last bit out, well, you don’t get it out, you put more money in. And then they transfer the funds out through numerous private wallets with all kinds of coding and activities about what they’re doing. And then they’re butchered, they have no money, they can’t find the people. It’s been converted to digital and moved all around, and they’re gone. Their funds are gone. They’re still there, but their funds are gone.

Jonathan Jeffery  16:57

There’s a lot of parallels here to the Bernie Madoff scandal. He didn’t have to build trust, though. He had trust. But it seems like there’s a lot of parallels. See, he had people put money in, show them reports of their interest, let them take money out, let them deposit more to get better gains. And then at the end, there was no money. It’s very similar.

Craig Jeffery  17:19

Yeah, I mean, there’s a huge trust factor. And like you said, there’s, there’s these fictitious statements instead of mailing statements or sending them as PDFs. It’s allowing people to see them on the screen. So it’s it is it’s just a slightly different media. But the same, the same process. Bernie Madoff did a pretty good job about setting up feeder funds where other people would be recruiting assets to put into the Madoff on so he he expanded that more than the pig butchering process so that they have a they can probably learn from his criminal activities. Because basically, if you say, Can you can you get your family and friends to do that, that’s not so big. But if you get brokers to distribute it to their list, now you can get serious 10s of millions billions rather rapidly. But they’re, they’re doing things quite successfully.

Jonathan Jeffery  18:10

One, one direction I see this going is them using the trust of a company that instead of being a personal attack, going towards companies and attacking them with the name of another company, like they may say that they’re in the Treasury Department of XYZ company, and they’re reaching out to you about, they heard about your company, they heard about what you can provide, and they build a relationship that way, but the person reaching out to you has nothing to do with that company. But that’d be similar how to how do you protect against that kind of thing?

Craig Jeffery  18:45

You know, from a company standpoint, reaching that I would suspect that might be a little bit harder, because you’d have to say, well, we’ve got we’re issuing these bonds at above market rate, and it’s available to some individuals, right, break, you know, so that that would be not trying to give criminals ideas, but that would be how I would think they could operate. I think the other one would be purporting to be from a brokerage or a bank, where it might be more expected to place investments with them and say, Hey, we’ve got the deal. What a deal we have for you. And it’s taking advantage of you know, volatility and the volatility in the digital currency markets or FX we’ve got we found in efficiencies, we can take advantage of it. It’s, it’s not without any risk, but it’s it’s kind of like printing money. And so, you know, letting someone get in on that type of deal. could certainly work but it’s you would definitely have that that position of trust people, people invest with those that they they trust, either from a large institution perspective or from people that they trust.

Jonathan Jeffery  19:49

Yeah, we got to watch out for verifying that people are who they say they are. Don’t trust people easily.

Craig Jeffery  19:55

Well, there’s, there’s, you know, the thing too, is about that. It’s like how do people fall for this? There’s that But there’s the trust, but verify, you might trust that someone’s giving you information or that you’re actually dealing with the person you think you are. So there’s validating on that and say, what what due diligence you have, how do you know that that’s, that that’s the case. And then there’s the verification was why these people verified by looking at the screens? Like I see it. While you were on, you were on websites that were showing stuff. And this is good. It’s legitimate. I’m verifying it. Well, I’m verifying they set up a fake or fictitious site that showed you what you needed to so you were verifying it. But it wasn’t a sufficient verification because someone set up a fictitious site. Those are some of the challenges like okay, now I’m going to be paranoid about how I validate and verify things.

Jonathan Jeffery  20:44

We don’t have any specific examples, do we?

Craig Jeffery  20:47

No, there there’s a there’s a case on the FinCEN site where they give the example of a total of seven individuals, you fell for this this scheme in the scam, there was I think there was 10, or there’s a handful of websites that were set up fictitious websites that that the law enforcement authority shut down, that were supporting this scam activity. So you think about seven people losing 10 million, so people were pulling money out of 401k is are you selling or taking loans out of their houses to fund and invest in this because the great returns they’re gonna have. So it’s not just like, hey, I had extra cash, I’m, I can get such a huge return, I can sell anything and make it back doing this. And then they find out that there’s a loss. So that’s a concern for for elders, those that might be older that are oftentimes preyed on by the scammers, but it’s easy to fall prey to some of these items when they’re done. Well, and properly, all it takes is like you miss something. And then oh, I’ve already verified it. I’ve seen this now I’m a victim. And it’s it’s much easier to laugh and think that someone else has fallen prey to this that they shouldn’t have. Because we see dozens and dozens. But so often there’s something that happens where it’s like a there’s a senior person talks to the CFO, I got that transfer done for you. What transfer all the monthly transfer to pay for blah, blah, blah, to pay for whatever and they’re like, What are you talking about, and then you know that there’s been there’s been a fraud, they’ve been paying this for a long time. And so they’re, they were not, I’m sending money to a fraudulent person is like, I’m helping the CEO or the CFO, accomplish what we need to in the business. And so it’s all it takes is you miss something you miss, you miss some elements. And then the other elements that their activities that you do to be comfortable, are forgotten. And I think that’s the, I guess the second guess yourself is is probably a good technique, there’s the verify, but make sure you’re verifying properly. I don’t have answers for all the ways you need to verify things properly. But whether you’re making payments for AP Treasury settlements, or, or you’re doing investments, just make sure you’re doing the right type of due diligence. And being careful.

Jonathan Jeffery  23:13

You were talking about being risk for older people who have their retirements, mostly funded, and I’m stealing that. But there’s also a risk for a younger crowd where they’re seeing everybody on social media live a successful life because of Dogecoin, or whatever type of coin. And so then something else gets promoted. That’s a crypto that’s not even a crypto, it’s just a way for someone to take their money. And they might not have as much starting out, but they could fall for something like that as well.

Craig Jeffery  23:47

Yeah, I mean, it’s how can I steal your money? I steal it directly? I have you put it in accounts that I can control? I convinced you to send it somewhere two ways that I control it. You know, the criminals have have a number of pages in their playbook.

Jonathan Jeffery  24:03

I will keep an eye out for this. What What kind of red flags do we need to be aware of?

Craig Jeffery  24:06

Yeah, you know, FinCEN has, we’ll put it we should put it in the show notes of an article on the FinCEN site, but they identify three primary types of red flags. One is behavioral, one is financial, one is technical. So there’s a there’s a number of warnings that they give are red flags to say look at these things. Do these are these characteristics what you’re seeing he should they should trigger a fly? The flag may not mean that it’s you know, it’s fraud, but it warrants more caution. You know, be careful when you see a red flag, you need to be careful. So flags on behavior, financial, like why should you Why should someone be able to get outsized returns above the market perpetually, that’s just not not something that that’s likely right things will revert to the mean or enough people would be in it so quickly that it would other there’d be other options too. To keep it in some normal range, and then the technology how how are people providing information that might you might be using as a way of confirming, so if I can, you know, there’s there’s all kinds of examples of, you know, if you have a method that provides out of bound validation for certain activity, and I can compromise that other channel, you’re going to be very confident because you have, here’s the channel we communicated, and then the confirmation which uses a different channel, I email you, you call me, if I’m compromised, the calling and the email channel, not compromise two channels, you’re gonna be very confident in that. And so I gain control of your email, I can see what’s in your email. And then I take your voice and I do a confirmation that way. So, you know, same thing with, you know, looking at a portal that shows investments or value or return, oh, your values going up? Hey, there’s another activity gonna happen and we’re looking for another big, big gains, you know, whatever the phrase might be.

Jonathan Jeffery  26:01

Yeah. Okay. Well, this has been interesting. Well, thanks for sharing a little bit about pig butchering today.

Craig Jeffery  26:07

Yeah, you are welcome. And I think the best part was you talking about Woolworths over Uber and Wilbur the pig, so? Yeah, don’t.

Jonathan Jeffery  26:18

Be like Wilbur, don’t get butchered.

Craig Jeffery  26:20

Yeah, have a good spider as a friend, right?

Jonathan Jeffery  26:23

Well, this has been fun. And if you guys want to go back and listen to those six other fraud examples, if you haven’t heard them already, they’re back on our podcast channel. So check them out. Alright, thanks. Have a good day.

Announcer  26:38

You’ve reached the end of another episode of the Treasury Update Podcast. Be sure to follow Strategic Treasurer on LinkedIn. Just search for Strategic Treasurer. This podcast is provided for informational purposes only, and statements made by Strategic Treasurer LLC on this podcast are not intended as legal, business, consulting, or tax advice. For more information, visit and bookmark StrategicTreasurer.com.