That simple 'hi' text from a stranger could be the start of a scam that ends up costing you millions

The road to Kaimi's ruin started in December, with an Instagram message about a Japanese monkey from a handsome stranger who called himself Mike. Over the coming months "Mike" and Kaimi would develop a friendship that quickly evolved into a romance.

Kaimi had no idea he had become ensnared in a romance scam known as "pig butchering," from the Chinese phrase sha zhu pan — the name coming from the idea that scammers must "fatten up" victims first with flattery and fake bonding before stealing their money.

Experts told CNBC it's easy to dismiss victims of these scams as ignorant or foolish but doing so discounts how manipulative the scammers are.

Matt Friedman is the CEO of the Mekong Club, a Hong Kong-based organization that works with corporations to fight modern slavery. "Ten scams come by, and they're very clearly a scam," Friedman told CNBC. "But the 11th one, I may even fall for it."

The scam often starts with a simple text message: "Hi!"

Many people disregard the messages that scammers send. But if they respond, the scammers move quickly to establish a rapport. The mystery texter might say they're a wealthy executive. They'll share images of their lavish lifestyle. Eventually, they'll try to make a meaningful romantic bond with the victim. It can take anywhere from a few weeks to a few months.

At the third stage, the scammers offer to "teach" the victim how to trade cryptocurrencies or foreign currencies. The scammer networks operate fake trading platforms that look "exactly the way they should look," Friedman told CNBC. Victims are "taught" how to trade by their scammer, and the fake exchanges are engineered to show nonexistent profits of 15% to 20%.

When victims try to withdraw money or have run out of fresh funds, the fake exchanges shut down the accounts and demand payment. Panicked and encouraged by their so-called friend, the victims wire what little money they have left. The exchange and their "friend" block the victim shortly after.

It can take weeks before victims understand they've been scammed and even longer to admit what has happened to them.

Experts told CNBC that the scammers on the phone aren't the real beneficiaries of the scam, although they do sometimes get a cut of the proceeds. Most often, they've been trafficked to Cambodia, Laos or Myanmar to work for organized scamming networks, according to extensive reporting from ProPublica and Vice.

Law enforcement and prosecutors acknowledge pig butchering is a problem but tell victims they're largely unable to help. Reported U.S. losses from investment scams totaled $3.31 billion last year, according to the FBI, but experts say many victims are too embarrassed to report their losses.

The U.S. manages to recover relatively little. The Justice Department's only public action seized just $112 million. Federal prosecutors in New York and Virginia have also been pursuing domain names and individuals linked to the scams.

Dennis, a small business owner in Maryland, told CNBC his scammer "Sarah" reached out to him on Facebook around the same time that Mike first reached out to Kaimi.

CNBC has altered the names of the victims in this story to protect their identities, as both Dennis and Kaimi shared personally identifiable information and identity documents with their scammers, and as Kaimi has not disclosed his sexual orientation to everyone in his life.

Kaimi lost more than $120,000 to his scammer. Dennis lost around $500,000.

Mike first messaged Kaimi in late December, cracking a joke about a Japanese monkey that Kaimi had posted.

"When I was looking at who had messaged, I was like, 'I don't know if this person is real,'" Kaimi told CNBC. After a few days, Kaimi sent back a perfunctory message. Mike promptly responded and engaged enthusiastically with Kaimi, before suggesting they move to a messaging app called Line.

CNBC reviewed thousands of messages between Kaimi and Mike running through April 2023.

They bonded over their shared love of travel, and Mike eventually invited Kaimi to visit him in Seoul. They'd go shopping, Mike said.

Kaimi told Mike that his schedule as a teacher didn't let him just jet around the world, and he'd have to save money for an international trip. When pressed, Kaimi told Mike about his financial difficulties, stemming from past credit card debt.

Mike suggested he teach Kaimi how to trade in foreign currencies so he could travel to Seoul and pay off his debt.

Mike alternated between talking about making Kaimi rich and sending him what Kaimi described as "flowery" messages.

"My love for you will last forever," Mike told him.

Kaimi acquiesced in January, and created an account on the forex platform Mike claimed he used, called DPEX.

DPEX wasn't a real exchange, but a front controlled by the same scamming group that Mike belonged to.

Over the following weeks, Kaimi wired thousands of dollars from his bank to Crypto.com, a centralized exchange. He used it to buy ether and send it to DPEX's wallets.

His transfers started small — the first was worth just $140. DPEX claimed it converted his ether transfers into Tether, a U.S. dollar stablecoin.

Mike and Kaimi's first trade together was a bet against the Japanese yen falling in value. When Kaimi saw he'd made $20 on a $100 trade, he was sold.

Mike offered to help Kaimi structure a plan to use profits from DPEX to pay off $300,000 in student loans, mortgage and credit cards. In February, Mike even "sent" $30,000 from his own DPEX account to Kaimi's to help him move closer to his debt-free goal.

"I want to repay you as soon as possible, shrink down most of the debt, then plan a trip to Korea to see you," Kaimi told Mike. Mike pressed Kaimi to add more to his account and join him in bigger bets. He grilled Kaimi about how else he could raise money, from friends or through loans.

In all, Kaimi sent DPEX more than $100,000 worth of ether. His paper profits grew handsomely: In one week in March, Kaimi's balance went from $100,000 to $310,000.

"I thought I was someone who knew when they were being scammed, was able to discern things," Kaimi told CNBC.

But when Kaimi told Mike he was planning to withdraw his funds, the penny dropped. DPEX froze Kaimi's account, claiming that Mike's generous $30,000 "gift" was a suspicious transaction.

Mike claimed his account was frozen too. "OMG," Mike said, "we are the same."

DPEX asked that Kaimi pay back that gift to unlock his full account balance. Kaimi had planned to do so anyway, but sent DPEX nearly $30,000 to settle the "debt."

The scammers settled into a predictable pattern, pumping Kaimi for more and more fees and taxes. Kaimi paid $64,000 in apparent penalties, urged on by Mike. When the scamming operation asked him for another $65,000, Kaimi realized there was no chance he was getting his money back.

When Mike pressed him to pay DPEX's "fees," Kaimi snapped. "I've filed a report to the FBI and the SEC," he told Mike.

Dennis didn't have any reason to be suspicious when his first scammer, Sarah, messaged him on Facebook.

"I just said hi and bye," Dennis told CNBC. "But she keeps approaching me," he said. "We became friends."

Sarah claimed she was a wealthy executive at a Chinese electric-vehicle manufacturer. She showed him photos of her "uncle" with Alibaba's Jack Ma. She sent him photos and videos from luxurious stores and apartments.

But it was her show of affection and care more than her material wealth that drew Dennis close, he said.

"They talk to you and manipulate you," Dennis told CNBC. He was in the midst of separating from his wife. They shared a child together, and in his messages with Sarah, he shared his feelings of inadequacy as a father.

Sarah offered Dennis comfort. They talked for hours every day, and it was weeks before she first offered to teach him how to trade crypto.

Sarah said her powerful uncle ran a trading syndicate large enough to influence crypto prices and guarantee a profit. Experts say that scammers will often cite a well-connected relative as part of their fictitious success.

Sarah pointed him to an "exchange" called Bigone-Eth, that could only be accessed through a iOS app called Trust Wallet. Dennis sent thousands of dollars from Coinbase to Trust Wallet and gave the fake exchange permission to control the crypto in his Trust Wallet.

Sarah guided him through trades that predictably returned 20%. From late December through January, Dennis bought nearly $160,000 worth of bitcoin for his "Bigone-Eth" account and invested $100,000 worth of his cousin's bitcoin with Bigone-Eth as well.

It wasn't enough for Sarah, who told Dennis he needed to invest at least $500,000. Otherwise, she suggested, Dennis' son would "suffer" because of Dennis' laziness.

But like Kaimi, Dennis felt he'd made enough. The hammer fell when he went to withdraw his winnings: Bigone-Eth froze him out and demanded $180,000 to release his $1.2 million balance.

The demand made Dennis suspect that the broker was trying to scam him out of his money. It was only in March, months after he began talking with Sarah, that he began to investigate romance scams and fake crypto brokerages.

Along the way, he conducted an internet search and found a company called Financial Fund Recovery, or FFR, which said it specialized in crypto asset recovery.

In late March, Dennis spoke with a person claiming to be an FFR employee, John Seth, who told Dennis that Sarah and the exchange were part of the same scam. Seth also promised he could recover Dennis' assets, something Dennis now believes was a lie.

Just a few days after Dennis spoke with Seth, he got an unsolicited call from someone identifying himself as Benjamin Grey. He claimed he worked at Bigone-Eth and told Dennis that he could recover his money for $100,000. Dennis never provided Bigone-Eth or Sarah with his phone number, and now suspects Grey was working with Seth to scam him out of more money.

But Dennis, more alone than ever, trusted Seth. Seth urged Dennis to pay the fee but keep it secret from Sarah and the Bigone-Eth scammers. He borrowed $100,000 from his parents and sent it to Grey through Coinbase.

Dennis didn't notice that Grey's wallet address was different from the original scammers, nor that Grey's email address had a slight misspelling of Bigone-Eth's name. Dennis thought he was on the verge of getting his money back, of repaying his parents and his cousin and moving on with his life.

Dennis was out another $242,000 by the time Seth told him to stop talking with Grey.

Seth suggested suing Grey and Bigone-Eth for the lost money. He sent Dennis an invoice detailing how FFR would put a "lien" on Dennis' Bigone-Eth account — which, in fact, was a fictitious account at a fictitious exchange. Dennis would simply have to wire $42,000 to an Abu Dhabi bank account to get started.

This time, Dennis realized he was being "scammed out of his mind" and blocked both Seth and Grey.

CNBC spoke with Seth, who strongly denied that FFR was running a scam. He implied that Dennis was lying to CNBC and said that FFR did not have an employee named Benjamin Grey.

CNBC has reviewed financial documents, emails, blockchain transactions, and recordings of calls between Dennis, Grey, and Seth. Despite his claims to the contrary, the recordings show Seth encouraging Dennis to send money to Grey. Both Seth and Grey contacted Dennis using VoIP numbers from the same issuer. Both numbers were disconnected after CNBC reached out to them.

Other attempts to reach FFR were not successful. In a text conversation with the number Dennis offered for Grey, the person on the other end denied knowing anything about the interaction with Dennis. A customer service representative at FFR's Abu Dhabi-based bank confirmed that company had an account there but declined to provide further information.

FFR used an address of a coworking space in the state of Georgia to register as a limited liability company in Georgia. Over the phone, a receptionist at that coworking space told CNBC that FFR was not a tenant there and that the mailbox used on the registration form did not exist at that space.

But the receptionist said that a visitor had been looking for FFR's office just a few weeks prior and had told the receptionist that FFR had made off with a scam victim's money.

In the U.S., law enforcement is still grappling with how to seize and restore victims' funds. In California, Santa Clara county prosecutor Erin West is pushing regulators and law enforcement to better understand how these scams work.

West has had some success at a local level in seizing a few million dollars for a handful of victims. But she says without federal intervention and private-sector support, putting a meaningful dent in scamming operations will be difficult if not impossible.

"I wish I could save them all," she told CNBC. Both Dennis and Kaimi reached out to West, who did what she could to connect them with the right people.

But Dennis' and Kaimi's losses form just a small fraction of the billions of dollars lost to scammers from thousands of victims. In 2022, the Department of Homeland Security estimated scam-related losses at over $3.3 billion.

Kaimi has considered filing for bankruptcy. His local Hawaiian bank has closed his checking and savings accounts, according to a letter from the bank shared with CNBC. Kaimi said a bank employee told him his Crypto.com wire transfers were the reason for the closure but didn't offer any more information to him.

He's filed multiple complaints, with the FBI, Secret Service and regulatory agencies but hasn't heard back from any of them.

Dennis said he's been in regular contact with the FBI about the scam. CNBC traced Dennis' bitcoin to a wallet that's received more than 59,000 bitcoin, worth about $1.6 billion, since 2019. The trail ends after that wallet, which regularly transfers its contents to the crypto exchange Binance.

Crypto exchanges such as Binance, Crypto.com and Coinbase are convenient waypoints for scammers because they have a trusted reputation and massive trading volume. All three exchanges have warned of the dangers of crypto scammers, but for some, that isn't enough.

When he reached out to Crypto.com, the exchange told Kaimi they couldn't help him get his money back.

"I'm not asking you to take responsibility of getting my money back," he said. But he pointed out that his scammers had used the same wallet for months.

West said that while private partners in the banking and crypto industry often are conduits for these kinds of scamming operations, they are also ideally positioned to cut off the supply of fresh money to pig butchering networks.

"We are essentially fleecing our entire middle class of their generational wealth, and handing it to bad actors overseas, and nobody's stopping this," West told CNBC.

Shortly before publication of this story, Cloudflare shut down Bigone-Eth's domain name and flagged it as a suspected phishing site. Neither Cloudflare nor the FBI responded to CNBC's request for comment.

Within hours, Dennis' scammer sent him the new domain name and begged him to respond to her. Dennis ignored her.

"Disappointing men with no sense of responsibility," she wrote the next day.