In the sprawling metropolis of Beijing, a woman identified only as Zhao recently became a statistic in a sophisticated and devastating financial crime wave. In May, Zhao, a professional in her 30s, lost more than $100,000 to a romance scammer who masqueraded as a high-level researcher for Microsoft. The relationship began on Xiaohongshu, a popular Chinese social media and lifestyle platform often compared to Instagram. After a period of initial rapport, the perpetrator suggested moving their conversation to Microsoft Teams, a transition he facilitated by providing Zhao with a pre-configured account and password.
Zhao’s trust in the platform proved to be her undoing. Having used the software previously in a professional capacity, she associated the Microsoft brand with security and corporate legitimacy. Once the conversation shifted to Teams, the scammer pivoted from romantic overtures to financial solicitation. He proposed a future together, funded by a "high-yield" cryptocurrency investment project that he claimed outperformed traditional stock trading. Convinced by the professional environment and the apparent sincerity of her partner, Zhao took out multiple bank loans to maximize her investment. Shortly thereafter, the scammer vanished, and Zhao found herself locked out of the Teams account, unable to retrieve the chat logs necessary for a police investigation.
The Anatomy of the "Pig-Butchering" Scheme
The ordeal experienced by Zhao is a textbook example of a "pig-butchering" scam (known in Mandarin as sha zhu pan). This method involves "fattening" the victim through emotional manipulation and the appearance of a lucrative opportunity before "slaughtering" them by seizing their assets. While these scams have historically utilized platforms like WhatsApp or Telegram, a new trend has emerged where fraudsters exploit Western enterprise software to bypass the skepticism of educated, urban professionals.
According to victim accounts shared across Chinese social media platforms like Douyin and Xiaohongshu, the methodology is remarkably consistent. Scammers cast a wide net, posing as job recruiters, prospective tenants, or romantic interests on dating apps like Tinder. The goal is always to move the target away from domestic Chinese apps like WeChat, which employ aggressive anti-fraud filters, toward Western tools like Microsoft Teams, Cisco Webex, or Zoho Cliq.
The use of enterprise-level accounts provides a specific tactical advantage for the fraudster. By creating a sub-account for the victim within a controlled "organization," the scammer retains administrative privileges. When the scam reaches its conclusion, the administrator can simply deactivate the victim’s account. This effectively wipes the chat history and any shared documents from the victim’s device, leaving them with no digital trail to present to law enforcement. To justify this unusual setup, scammers often claim they are using restricted work devices or that they have created a "private, secure base" for the relationship.
Data Analysis: A Growing Epidemic in App Stores
The scale of this exploitation is reflected in the digital feedback loops of major app stores. An analysis of reviews for Microsoft Teams on Apple’s Chinese App Store over the past 18 months reveals a startling trend. Out of 500 reviewed entries, approximately 30 percent contained explicit warnings about scammers. Some reports of these activities date back as far as 2022, suggesting the tactic has been refined over several years.
One review from January 2024 detailed a loss of 1.48 million RMB (approximately $220,000), with the victim describing the experience as a "bitter and costly lesson." The sentiment is echoed across other Western platforms. For Cisco’s Webex, the data is even more alarming: since February 2025, 71 percent of the 150 reviews on the Chinese App Store referenced fraudulent activity.
Victims report losses ranging from a few thousand dollars to upwards of $300,000. In almost all cases, the recovery of funds is impossible due to the decentralized nature of cryptocurrency and the cross-border anonymity of the perpetrators. Only a handful of victims have reported success in freezing accounts, usually by acting within hours of the transfer and manually tracking bank account details before the money is laundered through secondary networks.
Corporate Responses and Mitigation Efforts
As the misuse of their platforms becomes more public, Western tech giants are beginning to implement region-specific safeguards. Microsoft has acknowledged that scammers frequently leverage trusted brands to conduct social engineering. Steven Masada, the global head of Microsoft’s digital crimes division, stated that the company is actively investigating reports of abuse and strengthening protections to disrupt fraudulent activity.
In a significant policy shift in June, Microsoft began displaying a general warning banner to Teams users in China, cautioning against sharing sensitive information or screen-sharing with unknown parties. Furthermore, Microsoft discontinued the "personal" version of Teams in China. The service is now only available in the country through enterprise accounts, a move intended to raise the barrier for entry for individual scammers, though it does not entirely prevent those operating under the guise of legitimate-looking shell companies.
Similarly, Zoho, the Indian software giant, has taken drastic measures regarding its communication app, Cliq. Sam Wunderl, a spokesperson for Zoho, confirmed that the company identified a number of instances where scammers used the platform for fraud. In response, Zoho disabled online payments for Cliq in China as of late August, suspended accounts linked to suspicious activity, and announced plans to discontinue the free version of the app in the Chinese market. Cisco, the parent company of Webex, has yet to provide a formal comment on the high percentage of fraud-related reviews on its platform.
Why Western Enterprise Apps Are Preferred
The migration of scammers to Western enterprise software is not accidental; it is a calculated response to the unique regulatory and technical environment of the Chinese internet. There are three primary reasons why apps like Teams and Webex have become the "perfect shield" for fraudsters:
- Accessibility and Legitimacy: Unlike WhatsApp, Telegram, or Signal, Microsoft Teams and Webex are not blocked by the Great Firewall of China. They are viewed as essential business tools. For a victim, downloading a "work app" feels safer and more professional than using a VPN to access a forbidden messaging service.
- The "Trust Gap": Chinese domestic apps like WeChat and Xiaohongshu have spent years developing sophisticated AI that flags keywords related to "investments," "loans," and "high returns." Western apps, designed for a global corporate audience, generally do not monitor private enterprise communications with the same level of granular scrutiny for fraud detection, particularly in non-English languages.
- Advanced Feature Sets: Enterprise tools offer features like remote screen sharing and administrative control. These tools, designed for IT support and collaboration, can be weaponized to help victims navigate complex cryptocurrency exchanges or to allow scammers to monitor the victim’s screen as they enter banking credentials.
Tan Chenxin, a software engineer who was targeted via Webex, noted that the professional reputation of Cisco initially lowered his guard. "I looked up Webex and found it was developed by Cisco, a world-leading cybersecurity provider," Tan said. He narrowly avoided a financial loss after a scammer, posing as a law enforcement official, requested a video call to discuss a fake investigation.
Chronology of the Scam Evolution
- 2021–2022: "Pig-butchering" scams gain global notoriety, primarily using dating apps and WhatsApp. Chinese authorities begin a massive crackdown on domestic fraud, leading syndicates to relocate to Southeast Asian hubs like Myanmar and Cambodia.
- Late 2022: First reports of scammers using Microsoft Teams begin to appear in Chinese app store reviews.
- 2023: Scammers refine the "enterprise account" tactic, providing victims with pre-made credentials to ensure control over data and chat logs.
- Early 2024: Local Chinese law enforcement bureaus, such as the one in Zhangjiagang, issue explicit warnings naming Teams as a tool for fraud. Maimai, a Chinese professional network, begins auto-warning users who mention "Teams" or "Skype" in private messages.
- June 2024: Microsoft introduces warning banners in China and restricts Teams to enterprise-only accounts in the region.
- August 2024: Zoho disables payments and free accounts for its Cliq platform in China following internal abuse discoveries.
Broader Implications for Global Business
the weaponization of enterprise software highlights a growing challenge for multinational corporations: the "dual-use" nature of collaboration tools. As these platforms become more integrated into daily life, the line between a professional workspace and a private communication channel blurs, creating vulnerabilities that social engineers are quick to exploit.
For Western companies, the reputational risk is significant. When a platform becomes synonymous with fraud in a specific market—as evidenced by the 71 percent "scam" review rate for Webex—it undermines the core value proposition of security and reliability. Furthermore, the necessity of removing "free" or "personal" versions of software to combat crime suggests a future where digital services in China are increasingly siloed and restricted compared to the rest of the world.
As Zhao and hundreds of others attempt to rebuild their lives after staggering financial losses, the burden of prevention is shifting. While corporate warnings and account restrictions are a start, the sophisticated psychological tactics used in pig-butchering suggest that as long as a platform carries the veneer of corporate respectability, it will remain a target for those looking to exploit the trust of the unwary.
About the Author
