Block it, flag it, share it: frontline tactics for pig butchering and sextortion
Fraud and AML teams usually meet pig butchering and sextortion as a wire, an alert or a SAR. The closing session of The AI Files, Unit21's virtual summit on AI in fraud and AML, brought in two people who have spent years on the other side of those cases. Their message for financial institutions was direct: block sextortion payments, add up the small transfers in pig butchering cases, and write SARs that investigators can connect.
Erin West was a prosecutor for 26 years. In the last stretch of her career she worked high-tech crime and was flooded with victims who had lost every penny they had. She retired to found Operation Shamrock, a nonprofit that educates about, mobilizes against and disrupts transnational organized crime. Her work has taken her from victims' kitchen tables to the scam compounds on the Thai-Myanmar border.
Paul Raffile has been a cybercrime investigator for a decade, first on government projects and then in the private sector. When a friend became a victim of financial sextortion, he started tracing the networks behind it. Earlier this year, he and Erin set up a decoy Instagram profile, waited to be targeted, tracked the scammer to Nigeria through a fake gift card redemption site they controlled, and interviewed about a dozen scammers in person.
What they learned points straight back at financial institutions. Most of this money moves through mainstream payment rails, and the teams watching those rails can stop more of it than they think.
Two crimes, two clocks
Pig butchering and financial sextortion run on the same playbook: find someone lonely, make them feel seen, then turn that trust into money. What differs is the clock.
Pig butchering is the long con. One of the first cases Erin saw was a 30-year-old software engineer, not the elderly victim people expect. He believed he had met the woman he would marry. She introduced him to an investment strategy, and by the time he reached Erin's office his entire net worth was gone. These schemes don't stop at savings. Once an account is drained, victims are pushed to take out loans. For more on how these schemes work, see our earlier session recap, Chop Chop: Stopping Pig Butchering Scams.
Sextortion is the same con compressed into hours. Paul describes it as a romance scam on steroids. A scammer posing as an attractive young person builds trust over three or four hours, asks for intimate photos instead of money, and then threatens to send them to friends and family. Teenagers, mostly boys, are the main targets right now, but adults are hit too. Payments are often $50 or a few hundred dollars, and the demands keep coming. Paul estimates reported cases have roughly doubled in two years, from about 26,000 a year to more than 50,000.
Behind both crimes are organized operations. In Nigeria, the "Yahoo boys" work as a loose network that trades scripts and tactics in TikTok, Telegram and Facebook groups. Some work in "hustle kingdoms," where five or six scammers rent a room together and split the jobs: one handles the money, one the scripts, one the research. In Southeast Asia, Erin compares each scam compound to a mall full of companies, complete with HR, a morning song and victims referred to as "clients." When enforcement heats up in Cambodia, a company packs up and moves to Laos or Myanmar. Operations have since turned up in Madagascar, Sri Lanka, Pakistan and Timor-Leste. Many of the people typing the messages are trafficking victims themselves, lured by fake job offers and held behind armed gates.
As Erin put it, the pitch is always the same: you're seen, you're heard, you're appreciated.
8 tactics for fraud and AML teams
1. Block sextortion payments
The question Paul hears most often is whether a bank should block a payment it suspects is sextortion, since the scammer is threatening to leak the photos if the money doesn't arrive. His answer: block it, every time. That is the guidance from the National Center for Missing & Exploited Children and the FBI. Once the payments stop, the scammer usually moves on to the next target. The threat to publish is most often a bluff.
2. Watch for the sextortion pattern
No single signal proves sextortion, but together these narrow it down fast:
- Memo line language. Demands and threats often show up in payment notes and in-app messages.
- Customer profile. Young male account holders, roughly 14 to 22.
- Timing. Payments sent late at night or overnight.
- New payee. A first-time recipient the customer has never paid before.
- Risky payee. A receiving account with signs of recent compromise, money moving overseas or other suspicious activity.
Paul covered more of these red flags in an earlier session: Empowered, Not Extorted: Institutional Strategies for Protecting Consumers from Sextortion.
3. Look below your thresholds
Sextortion payments sit far below the $10,000 and $25,000 lines where extra review usually kicks in. Paul says almost all of them get through today. The rails he sees most are Cash App, Apple Pay and Apple Cash, gift cards and crypto. If your monitoring leans on amount, these payments will not show up.
4. Treat time as the control
The window to act in a sextortion case is hours, not weeks. In one case Paul described, a victim was first contacted at 11:01 PM and was dead by 11:28 PM. Detection that runs in a nightly batch or a weekly review queue arrives too late. Sextortion signals need to be caught while the payment is still in flight, which is the job of real-time payment monitoring.
5. Add up the small transfers in pig butchering cases
Pig butchering losses rarely show up as one big wire. Erin sees many smaller transactions that add up to a massive total, followed by new loans once savings are gone. Look at customer behavior over weeks: a steady run of transfers to a new investment platform or crypto exchange, rising amounts and fresh credit are the shape to look for.
6. Write SARs that investigators can connect
Erin's advice for SAR filers is simple:
- Use FinCEN's key terms so filings can be grouped. For pig butchering, that means FIN-2023-PIGBUTCHERING from FinCEN's September 2023 alert, and FIN-2026-SCAMCENTERS when you suspect a scam compound is involved, from the September 2026 scam center alert. For sextortion, use FIN-2025-SEXTORTION. FinCEN's newer guidance calls pig butchering a "digital asset investment scam," so use that term in the narrative too.
- Include every identifier you have: accounts, wallet addresses, phone numbers, emails, platforms and usernames.
Small cases become big ones when law enforcement can cross-reference them. Erin also had a message for the people who write these reports and never hear what happens next: they are used, and they matter. If narratives are the bottleneck on your team, see how to draft defensible SARs with AI without losing accountability.
7. Let your frontline speak up
Erin's clearest sign of progress is tellers and frontline staff who now feel empowered to tell a customer, with empathy, "I think this is what's happening to you." Those conversations stop transfers every day. Give branch and contact center teams the scripts, training and backing to have them.
8. Share what you can today, and teach customers in the app
Two years ago, few institutions talked about sharing scam intelligence. Now many say they want to. Erin's challenge is to act on it now: within privacy rules, who can you call today, and what trends can you share?
Customer education works best where customers already are. Paul pointed to Santander, which added a two-minute training on sextortion inside its mobile app covering how to spot it and what to do if it happens. He also recommends FinCEN's notice on financially motivated sextortion as required reading for compliance teams. For consumer-facing material, see Slam the Scam.
The alert has a person behind it
Erin's last point was about who gets hurt. It is rarely just one victim. She talks with adult children whose parents have stopped speaking to them because a scammer told them not to listen, and with spouses who lost a family's savings to conversations they never knew about. Paul's sextortion cases end, too often, with a young person who saw no way out.
Both crimes are growing despite more defenses than ever. The good news from the session is that the gaps are known, and many of them sit inside financial institutions: the payment that should have been blocked, the small transfers nobody added up, the SAR missing an identifier, the teller who wasn't sure they could speak up.
If you or someone you know is being targeted by sextortion, stop responding, don't pay, and report it to the NCMEC CyberTipline or the FBI. NCMEC's Take It Down can help remove images shared online. If you're in crisis, call or text 988 in the US.
Frequently asked questions
Should a bank block a payment it suspects is sextortion?
Yes. Guidance from the National Center for Missing & Exploited Children and the FBI is to block the payment. Once payments stop, scammers usually move on, and the threat to publish images is most often a bluff.
What are the red flags of a sextortion payment?
Threats or demands in the memo line, a young male account holder, payments sent late at night, a first-time payee, and a receiving account with signs of compromise or money moving overseas. No single signal proves it, but together they narrow it down quickly.
Which FinCEN key terms apply to pig butchering and sextortion SARs?
FIN-2023-PIGBUTCHERING for pig butchering, FIN-2026-SCAMCENTERS when a scam center may be involved, and FIN-2025-SEXTORTION for financially motivated sextortion. Include the key term in SAR field 2 and in the narrative.
Why do sextortion payments get past transaction monitoring?
They are small, often $50 to a few hundred dollars, well below the $10,000 and $25,000 thresholds where extra review usually starts, and they move through fast rails such as P2P apps, gift cards and crypto.
This session was part of The AI Files, Unit21's virtual summit on how fraud and AML teams are putting AI to work.
Gal Perelman is the Product Marketing Lead at Unit21, where she spearheads go-to-market strategies for AI-driven risk and compliance solutions. With over a decade of experience in the fintech and fraud sectors, she has led high-impact launches for products like Watchlist Screening and AI Rule Recommendations.
Previously, Gal held marketing leadership roles at Design Pickle, Sightfull, and Lusha. She holds a Master’s degree from American University and a Bachelor’s from UCLA, and is dedicated to helping banks and fintechs navigate complex regulatory landscapes through innovative technology.
