Her name was Michelle. She lived in Hong Kong, ran her own business, travelled frequently, and had parents in Wollongong.
She had dyed silvery blonde hair and hazel eyes. She wore a small cross-shaped pendant. She liked cooking, exercising and reading.
She'd been single for three years.
Anthony met her in November 2021, when she messaged his Instagram to compliment his landscape photos. Soon Michelle and the 48-year-old single dad from Sydney were flirting on WhatsApp.
Michelle never existed — she was a persona created by a criminal syndicate, probably located in south-east Asia. Her handlers were shift workers operating from a "boiler room" and basing their conversations on a script expertly designed to manipulate.
For the next two months, they messaged every day. He sent photos setting up the Christmas tree with his daughter. She sent gym selfies. He sent beach pics. Often they exchanged photos of their evening meals. Their messages added up to tens of thousands of words.
Anthony: It's very attractive to meet someone who is not just attractive but is kind and also is smart and intelligent.
Michelle: Haha I'm actually not as good as you said
Only months after she slid into his DMs, Anthony had been scammed two-thirds of his savings, or $240,850.
Share your story
Are you a young person who has been affected by an investment scam? We want to hear from you.
Follow the link to our scam callout.
Dive deeper
Age-old scams dressed up as crypto opportunities
Australians are being scammed of more money than ever before and there's one category that's really driving the total upwards.
"The major category of scams that we're seeing across the community are about business opportunity or investment scams," said Warren Day, chief operating officer of ASIC.
"It's a huge increase."
Many of these investment scams, Mr Day said, have a "crypto flavour".
That doesn't mean all crypto is a scam, but that a lot of scams mention crypto. Scammers are using the perception of easy riches associated with cryptocurrency to sell age-old scams to their victims.
The group most likely to fall for these scams were young people, Mr Day said.
"The predominant group is about 18 to 24."
"And these are predominantly first time investors, probably people who don't have other investments."
These scams include "rug pulls" where a developer promotes a new coin or NFT release and then disappears with investor money; "pump and dump" schemes where fraudsters spread false information to create a buying frenzy, then "dump" the cryptocurrency by selling their own coins at the inflated price; and crypto-themed pyramid schemes.
The scam Anthony fell for was none of these. Relatively new in the English-speaking world, the method is estimated to have netted tens of billions of US dollars worldwide in recent years.
It's become known as the "pig butchering" scam.
Hook, line, and sinker
The name is a reference to the victim's wallet being fattened before the slaughter.
The first stage involves the perpetrator building a relationship, often romantic, with the victim over months, before convincing them to invest money into a fake venture. Once they've invested a large-enough amount (which can take more months), their money is taken.
The fake venture can be anything where the promise of huge returns and sudden riches are remotely plausible.
For Anthony, it was crypto mining: investing money in the process of computers solving cryptographic puzzles to create new Ethereum.
On Boxing Day 2021, Michelle mentioned the mining scheme for the first time. It was a throwaway comment and the conversation moved on, but on New Years Eve the subject came up again.
Michelle: I just finished discussing investment strategies with my uncle in the United States.
Anthony: Oh wow. Did he give you any good tips?
Michelle: My uncle asked me to put all the funds of other investment products into the Coinbase wallet for mining.
The conversation moved on again and then circled back four days later.
And this time, Anthony took the bait.
Michelle: Uncle works in New York. Because the uncle's team had a cooperative relationship with Coinbase before, they got some node mining certificates.
Anthony: What coins is coin base mining?
They talked more on the topic. Later that day, she forwarded him the "uncle's" 42-page investment scheme "white paper".
Four days later, Anthony messaged, "I'd love to talk to you today about crypto".
Michelle: If you want to invest, I can teach you.
Anthony: Yes I want to. I'd love you to teach me.
Download a persona for $4
All this — the casual mention of investment, the rich uncle, the food pics — was straight from the script.
We know this because for the past year, an international collective of romance investment scam victims, the Global Anti-Scam Organisation (GASO), has been investigating the scammers's tactics.
And they literally have the script.
A March 2019 training manual obtained after a police raid states the three steps to "killing pigs" are packaging (ie creating the persona), chatting (building trust) and fishing (luring them to invest).
The persona's backstory should involve regular hobbies, good parents, romantic disappointment and a past trauma to be later used to justify why they can't meet on video chats.
Photos and videos for personas are sold on sites that list packages for sale under categories like beautiful young women, students, handsome men, middle-aged men, and "bosses". The packages have hundreds of photos and dozens of videos of the same person (usually ripped from an innocent person's social media) and cost 20-80 Chinese Yuan ($4-$17).
Common tactics include:
- Greeting the target "good morning" and "good night" every day
- Asking for and sharing pictures of food
- Casually talking about spending hundreds of thousands of dollars
- Bringing up an investment/trading website by the second or third week of talking everyday
- Having an uncle/aunt/brother or professor who taught them crypto trading
GASO has helped nearly 1,500 victims worldwide who have suffered $256 million in losses.
In Australia, it's been contacted by 21 victims with total losses of just under $3 million, although the true figure is certainly far higher.
Those who have lost money aren't the only victims. Many of the people carrying out the scam — the people that Anthony would have been talking to every day — are being held against their will.
Some are victims of human trafficking, lured across borders and then locked in basements and instructed in the techniques of scamming people online, said Vanessa, an Australian volunteer with GASO.
"Some of these people are not willingly in these roles. Their working conditions are really bad, like sweatshop conditions.
"The only way out of it is if you scam enough people. The only way that they can escape is to rip people off."
'Killing the pig'
Michelle guided Anthony through the process of setting up a wallet with the widely used and legitimate cryptocurrency exchange Coinbase.
She also introduced him to what seemed like an affiliate website, complete with Coinbase logos, that would handle the mining.
To get him started, she sent his Coinbase wallet a small amount of Ethereum, then worth $US49. It developed trust.
Weeks later, when he knew he had been scammed, he found that Michelle's wallet had transferred $US49 to 250 other accounts — probably these were other scam targets like Anthony.
Anthony's first investment was $7,000 — and that day he made about $30.
The scammers were paying real money into his Coinbase wallet — money that they'd scammed off other people — to give the impression the investment was profitable. Anthony's wallet was being fattened up.
Over the next six weeks, he increased his investment to $240,850.
He didn't yet realise, but he'd already lost everything. During the process of investing he had signed a smart contract (a simple program stored on the blockchain) by clicking on a link. It contained a line of computer code that gave the scammers access to his money.
And as you may have guessed, that Coinbase-themed mining website wasn't being run by Coinbase.
"And that's when I got locked out of my account," Anthony said.
When he threatened the fraudulent mining website with legal action and going to the authorities, Michelle messaged him, extremely upset.
She claimed she had heard, via her uncle, that he had been making threats.
"Which then made me realise, categorically, that she was linked with the group and in communication with whoever was doing all of this.
"And I went straight into the vengeful wanting revenge part of the cycle."
'They're still operating'
But months later, Anthony still hasn't recovered his money.
And at least according to cybercrime private investigators, he almost certainly never will.
"To get money back from some of those countries [where scammers operate] can be quite difficult," said Dan Halpin, CEO of the investigations company Cybertrace.
"It's almost impossible to find out who's behind it."
ASIC's Warren Day agreed.
"It's very hard to do much about them," he said.
""There can be efforts to deter them, to block them, but what we know is that probably by the time that that's been reported and actioned, they've made a significant amount of money."
But victims like Anthony would like to see a more determined effort from federal authorities to track and shut down these criminal syndicates. When he reported his loss, the Australian Cyber Security Centre directed Anthony to NSW Police, which he said didn't have the resources at the local detective level to mount an international investigation.
The recent federal Budget includes $9.9 million over four years for a National Anti-Scam Centre to co-ordinate the work of different agencies.
"What we expect through the work and the cooperation that will come through that National Anti Scam Centre is that we are going to start to see these things go down," Mr Day said.
"It's certainly not the case that anyone's throwing their hands up in the air."
In the meantime, the scammers are still active. Australians should be suspicious of any "get rick quick" scheme, Mr Day said.
"If you get unexpectedly contacted out of the blue through WhatsApp or social media platforms and they ultimately ask you about lending them money or that they've had a great opportunity to do something, I can guarantee you you're being scammed.
"If you're guaranteed a huge return, that's a big red flag because no-one can guarantee you things like that."
Anthony has spent the last few months trying to track down his scammers, through a combination of reverse-image searches, crypto transactions analysis, and studying the photos Michelle sent for clues, like street signs. He suspects that some of the photos were genuine.
So far, he's had no luck. He's stuck between moving on and getting revenge.
"You can't dwell on the past," he said.
The persona Michelle has vanished. Anthony has been blocked from messaging her number. Her social media has been taken down. All that remains is their chat history and a handful of short voice messages. Her photos have shown up on dating sites around the world.
