Cyber Coach

Social engineering

Romance and pig-butchering scams

Relationships built over months that turn into a 'safe investment'. The platform is fake, so is the profile.

12 min readIntermediate

Red flags to recognize

  • Beautiful profile, perfect photos, textbook bio (doctor, military, engineer abroad)
  • Quick move from dating app to WhatsApp/Telegram
  • No real video calls: only short clips or 'connection issues'
  • After weeks of affection, a crypto/forex investment with guaranteed returns appears
  • Platform on an unknown domain, app not in official stores
  • First 'profits' are real and withdrawable, then larger withdrawals get blocked
  • Taxes, fees or 'unlocks' demanded to withdraw funds
  • Emotional pressure: 'if you loved me you would invest'

What to do now

  • Reverse-image search the profile photos (Google Lens, TinEye, Yandex)
  • Insist on a real-time video call before any financial exchange
  • Never invest on advice from someone you have never met in person
  • Talk to a trusted friend or family member: isolation is the main weapon
  • Preserve every message, screenshot, IBAN, wallet address
  • Never pay 'unlock taxes': they do not exist, they are the second-layer scam

Real case

Telegram-USDT pig butchering, Veneto 2025

A 54-year-old woman meets 'Marco', a self-styled offshore petroleum engineer, on a dating app. Over four affectionate months Marco introduces her to an 'exclusive oil-trading platform' on a .xyz domain.

She gradually deposits 87,000 EUR in USDT into different wallets. The dashboard shows 340% profit. On her first withdrawal attempt she is asked for a 12,000 EUR 'liquidity fee'. When she refuses, Marco vanishes and the platform becomes unreachable.

Mythos traced the USDT wallets: all converged in 48h into a known mixer and then onto an Asian exchange. Reverse image search linked 'Marco's' photos to a Brazilian actor with 230 public Instagram posts. The dossier supported a complaint with international cluster mapping.

What Mythos can do on this case

  • Parallel reverse image search across multiple engines
  • Forensic analysis of trading-platform URLs and recipient wallets
  • On-chain tracing of funds (USDT/USDC) through mixers and exchanges
  • Message linguistic analysis: known pig-butchering scripts
  • Telegram/WhatsApp username cross-check with known-profile datasets

Next steps