The previous chapter mapped the structure of a fraud enterprise — the people, the roles, the hierarchy that makes industrial-scale criminal operations possible. But one function within that structure deserves considerably more attention than an org chart entry can provide.
The financial operation is not simply the back end of a fraud scheme. In the most sophisticated organizations, it is where the real expertise lives. Understanding it requires separating two distinct functions that are often discussed as though they were one: the intelligence work that happens before a target is ever contacted, and the money movement architecture that activates the moment proceeds are obtained.
Knowing the Target Before the Call
Not every fraud operation conducts advance research on its targets. Operations built around mass volume — war dialing phone numbers, blasting phishing emails across purchased lists, hoping that sheer quantity produces enough responses to be profitable — don’t need to know much about any individual target. The script handles everything. If this person doesn’t bite, the next one might.
But targeted fraud operations are different. When a criminal organization has identified a specific individual as a high-value target — an executive, a retiree with significant assets, a business owner who recently completed a liquidity event, a professional with a public financial profile — the approach changes. Research precedes contact. Sometimes by weeks.
What that research draws on is a combination of sources that would be familiar to anyone in legitimate financial intelligence work. Public records provide the foundation: property ownership and transaction history, business registrations and filings, court records, professional licenses, and in many jurisdictions, probate records that can reveal the financial dimensions of recent inheritances. Professional profiles on LinkedIn and similar platforms add employment history, career trajectory, and often a reasonably clear picture of compensation level. Social media fills in the personal dimensions — family structure, relationships, recent life events, expressed anxieties and interests.
Data obtained through breaches adds the layer that public sources cannot. Account numbers, Social Security numbers, credit histories, and the financial relationship maps that major breaches have exposed give criminal analysts a picture of a target’s financial life that the target’s own family may not fully have. The National Public Data breach alone — compromising an estimated 2.7 to 3 billion individual records including decades of address history and family relationship data — handed criminal organizations a genealogical and financial research tool of extraordinary reach.
The output of this research phase is a targeting profile: what the person has, where it is held, what approach they are most likely to find credible, and what emotional or financial circumstances might make them particularly susceptible right now. A recently widowed retiree. An executive who just announced a departure from a long-term role. A business owner whose company filings suggest recent financial stress. These are not random selections. They are the product of deliberate analysis.
Pig Butchering: Research, Relationship, and Ruin
No fraud category illustrates the integration of financial intelligence, relationship manipulation, and sophisticated money movement better than what has come to be known as pig butchering — a term derived from the Chinese phrase shā zhū pán, describing the practice of fattening a pig before slaughter.
The scheme works like this. A target is contacted — often through a wrong number text, a social media connection request, or a dating platform match — by someone who quickly establishes a warm, credible personal connection. The contact is patient. There is no immediate ask. Weeks or months may pass in which the relationship develops genuinely, or as genuinely as a manufactured persona can manage. Trust is built deliberately, at a pace calibrated to the target’s responsiveness.
Eventually, the conversation turns to investment. The contact mentions, almost incidentally, that they have been doing extraordinarily well with a particular cryptocurrency platform. They offer to show the target how it works — small amounts at first, with returns that appear immediately and feel real because the platform, which is entirely fraudulent, shows them as real. The target withdraws small amounts successfully, which builds confidence. Larger investments follow. Then larger still.
The moment the organization judges that the target has committed as much as they are likely to commit, the platform becomes inaccessible. Funds cannot be withdrawn. Customer service — itself staffed by the operation — cites taxes, fees, verification requirements, any explanation that might extract one final payment before the inevitable. Then contact ceases entirely.
The FBI reported that investment fraud — a category dominated by pig butchering variants — produced losses of $4.57 billion in 2023, making it the single highest-loss fraud category in the United States that year. Individual losses in the hundreds of thousands of dollars are not unusual. Losses exceeding a million dollars occur with enough frequency that they no longer surprise investigators.
Moving the Money
Once proceeds are obtained, the challenge for a fraud organization is transformation — converting money that is traceable to a crime into money that is not. The sophistication of this process varies with the scale and ambition of the operation, but the underlying logic is consistent across fraud types.
In simpler operations, proceeds move through a sequence of domestic bank accounts — often mule accounts, opened in the names of recruited or deceived individuals — before being withdrawn as cash or converted. Each transfer adds a layer of distance between the fraud and the funds.
In more sophisticated operations, the layering is considerably more complex. Cryptocurrency has become the preferred instrument for this phase of money movement, for reasons that are straightforward: transactions are pseudonymous, they cross borders without the friction of correspondent banking relationships, they can be processed at any hour without institutional oversight, and a growing ecosystem of mixing services exists specifically to obscure the transaction trail by pooling and redistributing funds across multiple wallets.
The $25 million Hong Kong deepfake case involved a payment instruction that moved funds through multiple accounts before investigators could begin tracing it. By the time the fraud was identified, the money had passed through enough layers that recovery was effectively impossible — which is the operational goal.
Shell companies in jurisdictions with permissive beneficial ownership disclosure requirements add another layer. A payment that originates in the United States, passes through a series of cryptocurrency wallets, converts to fiat currency through an exchange in a jurisdiction with limited regulatory oversight, and lands in a bank account held by a shell company registered in a secrecy haven has traveled a path that requires extraordinary investigative resources to follow.
The Compliance Mirror
There is a dark parallel worth naming explicitly. The financial operation inside a sophisticated fraud organization is, in functional terms, the inverse of a bank’s compliance department. Where a compliance team works to detect unusual transaction patterns, verify the legitimacy of fund sources, and flag activity that suggests money laundering, a criminal financial operation works to defeat those exact detection mechanisms — structuring transactions to stay below reporting thresholds, using account holders whose profiles don’t trigger suspicion, and routing funds through institutions and jurisdictions where scrutiny is lightest.
The people doing this work understand the systems they are defeating because those systems are not secret. Bank Secrecy Act requirements, SWIFT monitoring protocols, the transaction thresholds that trigger automatic reporting — this is documented, public, and studied by anyone motivated to understand it. Criminal financial specialists are motivated. Some of them learned what they know working inside the institutions they now work around.
That is not a comfortable observation. But it is an accurate one.