The Password Came From Them

The case

In or about March 2024, a woman of 82 began getting calls from people who said they were “a computer software support team.” Over “multiple conversations,” the federal indictment says, they told her that her financial accounts “had been compromised,” and that she needed to “pay money to prevent her funds from being stolen.”

Then came the instructions. Open new bank accounts. Move her money into them. Send “a wire transfer of funds to an account held overseas.” Withdraw cash, and buy about $250,000 in gold. Someone, they told her, would come to her home to retrieve it. The U.S. Attorney’s office, describing the plea agreements in the case, puts it the same way: the callers “told her to buy about $250,000 worth of gold bars.”

On 1 May 2024, the indictment says, a courier flew in. A handler had rented a car. He drove the courier to a parking lot near the woman’s home, and from there the courier took an Uber to her door, to pick up the gold.

At the woman’s home, the indictment says, the courier was “intercepted by law enforcement agents.” The courier sent the conspirators a WhatsApp message. One word: “police.”

This article follows the chain that ended at that door: the callers who made the case, the handlers who drove and shipped, the couriers who knocked, and the password that, the indictment says, was meant to make a stranger at the door feel safe. In the scheme’s pickups, the indictment says, that password came from the same people taking the gold. This is a case study, not a guide to the scheme.

How to read it. The documents in this case speak with different voices, and every sentence here says which one it uses:

• The indictment says / prosecutors say — an allegation by the grand jury or by the prosecutors. In the U.S. Attorney’s own words, charges in an indictment “are merely accusations and do not constitute proof of guilt.”
• Admitted — all five people charged pleaded guilty to one count. Their plea agreements are not in the public court records we could read; what they say reaches us through the U.S. Attorney’s description.
• Ordered — a sentence or a restitution order, as reported by the U.S. Attorney’s office.
• Her lawyer wrote — one sentencing memo, filed by the defense for the courier who flew in. It is her side, told by her side.

No victim or defendant is named. The defendants’ names are in the public record. We leave them out, along with where the woman lives. This channel follows the method, not the people.

How did the callers get an 82-year-old woman to buy gold?

By describing a security problem, the indictment says, and presenting every step that followed as the fix. The callers told her the money had to move “in order to prevent the funds from being stolen.”

She was not the only one. According to the indictment, the conspirators “contacted elderly victims through telephone calls and electronic messages” and talked them into using savings and retirement funds to buy gold bars and gold coins, which the victims then handed to couriers working for the conspiracy. The pitch was account security. The conspirators, it says, told victims they needed to transfer funds “in order to maintain account security, transfers that sometimes took the form of liquidating accounts in order to purchase gold.”

Read the instructions given to the woman in order and they share a direction. New accounts. A wire overseas. Cash. Gold. Each one was described as protection, and each one put her money one step closer to a stranger’s hands. Every one was a step she was told to take herself.

Software support is an odd messenger for a banking problem. People expect a call like that to be about a slow computer. This one was about her financial accounts, and the problem it described had only one cure: moving her money. We covered the screen-and-phone-number version of fake support in our piece on fake Microsoft security alerts, and we will not repeat it here. This case is about what happens when the “fix” ends in gold.

Gold matters for one plain reason. It is something a stranger can carry out a front door. Our article on fake bank fraud alerts quotes the Federal Trade Commission listing, among the things victims are told to do with their money, “hand off stacks of cash or gold to couriers.” There it was one line on a list. This case is what that line looks like when it reaches someone’s door.

Why did couriers in this scheme carry a password?

Because, the indictment says, the conspirators handed one to both sides of the door. In its words: “Conspirators gave both the victims and the couriers a password to exchange during the gold pickups, steps which were intended to provide the victims with a false sense of security regarding the transaction.”

The password came with a package of other details. Conspirators, the indictment says, “provided couriers with detailed information regarding the victims, including names, residential addresses, and driver’s license images.” And they “instructed couriers to provide victims with a false name.”

Put those pieces together from the side of the door where the victim stands. A support team that calls about your accounts. Instructions that all sound like protection. A stranger who arrives already knowing your name and address. And a password, so it feels like the right stranger.

That is why, in this scheme, a password proved nothing about safety. It only proved who had sent the courier. Everything that made a pickup like this feel safe — the support team, the password, the courier’s false name — came from the same people taking the gold.

The indictment describes the password as part of the method, in pickups like this. It does not say what was said at the woman’s door on 1 May 2024, and we do not suggest it.

What happened at the door on 1 May 2024?

The courier was intercepted, and the handler left the state. The indictment lays out the day in one paragraph. Weeks after the first calls, the courier flew in, and a handler drove her most of the way. From there she took an Uber to the woman’s residence, “for the purpose of retrieving the $250,000 in gold”.

The next paragraph is one sentence. When the courier “was intercepted by law enforcement agents” at the woman’s home, the indictment says, she “sent a WhatsApp message to the conspirators, saying ‘police.’”

Not a name. Not an explanation. One word, sent to the people who had sent her. In the moment it mattered, that is who she reported to.

The handler who had driven her got the warning. In a detention motion, prosecutors wrote that when he “was alerted by his co-defendant” that she “had been apprehended by the police,” he fled, “driving in a rental vehicle.” He left the state.

For the courier, the story in the indictment ends with that one typed word. Her own lawyer adds what came after: in May 2024, the memo says, she was questioned, then released, and the next month she was arrested on the federal warrant for this case.

What do the court records not say?

Three things this article cannot tell you, because none of the records we could read does:

• How agents came to be at the woman’s home. The indictment says the courier was intercepted. It does not say how law enforcement knew.
• Whether the wire went out. The indictment says she was told to wire money to an account held overseas. It does not say whether that wire was sent, or how much was in it.
• What she lost. None of the court records we could read says. So we won’t guess.

The records we could read don’t follow the woman past her front door. In this article she stays a victim. No name, no city.

What did each person in the chain do?

Each link had one job, and in the method the indictment describes, the courier was the one sent to the door. This is the structure the court records describe, told at the level that lets you recognize it, not run it.

The callers made the case. The U.S. Attorney’s office says “the conspiracy originated overseas, with scammers who contacted elderly victims.” They are the voices that told the woman her accounts were compromised. Everyone charged in this case was a courier or a handler; the indictment speaks of conspirators “known and unknown to the Grand Jury,” and none of the callers is named in these papers. In the press releases, the people who called are a single word: overseas.

The couriers went to the doors. Two of the five people charged worked as couriers, the indictment says, and travelled to victims’ homes to collect the gold. In the method the indictment describes, the courier is the one person in the chain a victim sees face to face. And the courier was the one carrying the details the conspirators had handed over: a name, an address, a license photo, a false name to give, and the password.

The handlers drove, paid and shipped. Three of the five worked as handlers. They “rented vehicles that they then used to transport couriers to complete gold bar pickups,” the indictment says. After a pickup, the conspirators “would instruct the handler to pay” the couriers in cash. Even the courier’s pay was ordered from above.

The gold kept moving. The courier delivered the gold to the handler, “who would subsequently ship the gold to other conspirators.” One handler, the indictment says, “received three separate FedEx packages containing gold” taken from a single victim. In a detention motion, prosecutors called him “a higher-level operative.” So the gold did not stop in a rented car. It went into boxes, and on up the chain.

And they talked it through on WhatsApp. The five charged, the indictment says, communicated about the scheme “via WhatsApp” — the same app that carried that one word from the door.

Three brand names appear in this story — WhatsApp, Uber and FedEx. None of those companies is accused of anything in these records. They appear only as the way the messages, a courier and the boxes moved.

Where did the money go?

To scammers overseas, the government believes, though the court records follow only the part that moved on American roads. Remember the account the woman was told to wire money to: it was “held overseas.” The conspiracy, the government says, started overseas too.

There are two big numbers in the case, and they come from different stages:

• More than $8 million — the grand jury alleged in October 2024 that the conspirators defrauded victims in numerous states “in an amount exceeding $8,000,000.00.”
• $9.3 million — after the guilty pleas, the U.S. Attorney’s office wrote: “The government believes that the overseas scammers netted $9.3 million from victims.”

Neither one says how much any single victim lost, and neither should be added to the other.

The geography is wide. The government says the scheme stole from elderly victims in “at least ten states.” The indictment’s list includes Arizona and California, Texas and Tennessee, Wisconsin, Florida and more, and its record of individual pickups names at least twelve states in all. The method was the same at each door.

Prosecutors also wrote down what this kind of scheme did to the people it reached. In a detention motion they described “a complex, elaborate conspiracy victimizing elderly individuals, often resulting in the victims’ total financial destruction.” That is the prosecutors’ description, written before any plea.

How did the courier get the job?

According to her own lawyer, through a friend’s photos. In a sentencing memo filed before the judge decided her sentence, the lawyer for the courier who flew in wrote that she noticed a friend posting on social media: pictures from different cities, “driving in nice rental cars and enjoying meals out at restaurants.” She asked what the work was. The friend is not one of the five people charged in this case.

Then came an offer, her lawyer wrote: “picking up packages from people around the country in exchange for immediate payment via banking apps.” She was promised “all-expenses paid travel, transportation, and future opportunities in ‘the company.’”

Look at how, in her lawyer’s telling, it reached her. Not a cold call. A friend’s photos. Rental cars, restaurants, new cities. The job sold itself before anyone described it. Travel, fast money, a company with a future. What the offer left out is who was waiting on the other side of each package.

Packages. That is the word in the offer, as her lawyer describes it. Not gold. Not elderly victims. Packages. Our article on scam scripts follows a different job advertisement, one that led a worker into a scam compound overseas. This one led to strangers’ front doors.

Then the memo says something plainly. By then, her lawyer wrote, she “suspected that her activity with the organization was illegal because of the amount of money she was being paid and due to the secretive nature of the transactions and deliveries involved.” And: “Knowing that she was likely engaging in illegal activity, she continued to make the deliveries for 3 and a half months, and she is guilty of the instant offense.”

Her lawyer’s argument is that she “did not know the full objective or scope of the conspiracy” — that she was “a mere blind courier on the lowest rung.” That is the defense talking. The court did not have to agree, and the sentence is below. What the indictment describes that rung carrying to the door is specific: a stranger’s name and address, an image of a stranger’s driver’s license, a false name to give, and a password.

Why is it wire fraud when the gold changed hands at a door?

Because, the indictment says, the scheme ran on interstate wire communications — the messages and bookings that got the courier there. The charge in the superseding indictment, returned by a federal grand jury in October 2024, was one count of conspiracy to commit wire fraud. The indictment’s answer to “where are the wires?” is a list: the defendants and other conspirators caused interstate wire communications, “including WhatsApp messages, flight reservations, hotel reservations, and car rental reservations, in furtherance of the scheme.”

The handoff happened on a doorstep. The scheme around it ran on messages and bookings. The charge carries a penalty of up to 30 years in prison, according to the U.S. Attorney’s office.

What happened to the five people charged?

All five pleaded guilty, and all five were sentenced. By late September 2025, the U.S. Attorney’s office said, all five had pleaded guilty to that one count of conspiracy to commit wire fraud. The story at the top of this article, about the woman and the gold bars, is one the office says the plea agreements tell.

By March 2026, all five had been sentenced:

• Four years in prison for each of the three handlers.
• Two years in prison for the courier who flew in. Her lawyer had asked for a sentence of probation.
• Eighteen months in prison for the other courier.

The ones who drove and shipped got the longest terms. The ones who went to the doors got less.

Is anyone being paid back?

The records we could read give one restitution figure and no payments. Restitution is money a court orders paid back to the victims. The judge ordered one handler to pay $6.6 million of it, and all five were ordered to pay restitution. The release does not say how much the others owe. And none of the records we could read says how much has actually been paid back.

Owed is not the same as returned.

How to spot it

These are the signals the court records describe. Each comes with a question to ask yourself — not the caller, and not the person at the door.

Software support calling about your bank accounts. Counter-test: ask yourself what software has to do with your savings. Real software support fixes software. It doesn’t tell you to open new accounts, wire money overseas, or buy gold.

Instructions to move money “to keep it safe.” Counter-test: notice who benefits from each step. In this case every instruction was described as protection, and every one moved the money closer to a stranger. No real company or agency needs your savings turned into gold and handed to a stranger.

Someone will come to your home to pick something up. Counter-test: ask yourself who arranged the visit. If the answer is the person on the phone, that is the method in this case. In this scheme, the indictment says, conspirators directed couriers to meet victims in person to retrieve the gold.

A stranger who already knows your name and address. Counter-test: ask yourself how a stranger would know. In this scheme, the indictment says, couriers were given victims’ names, addresses and driver’s license images by the conspirators, and told to give a false name of their own.

A password at the door. Counter-test: ask yourself who gave you the password. In this scheme, the indictment says, victims and couriers both got one, to give victims a false sense of security. So if a pickup comes with a password, the password came from them. A code word your family agreed on is yours. A password a stranger brings to your door is theirs.

What to do if it is happening to someone you love

Report it to the FBI. Each of the three U.S. Attorney’s releases on this case that we read ends the same way: “If someone you know is a victim of a cyber scam, report it to the FBI. You can file the complaint online with the FBI’s Internet Crime Complaint Center at www.ic3.gov or use 1-800-CALL-FBI.” The complaint site is ic3.gov; the phone line is 1-800-CALL-FBI.

Don’t wait. The same records show what this scheme cost other families. One couple in their nineties, the FBI says, “lost all the money they had saved to ensure their disabled adult child would be taken care of for life.” So if someone you love mentions software support, a compromised account, or gold, call them. Then call the FBI.

Know what a restitution order means. In this case one handler was ordered to pay $6.6 million and all five were ordered to pay restitution, but no record we read shows what has been paid. A court order is a debt, not a refund.

How to not be next

The chain in this case had many hands — callers overseas, handlers in rented cars, boxes moving on — and in the method the indictment describes, the courier was the one sent to the door. That is also where the chain is easiest to see. Every piece of it that felt like reassurance was supplied by the people taking the gold: the support team, the instructions that sounded like protection, the stranger who knew the victim’s name and address, the courier’s false name, and the password.

That’s the part you can use. Not her name. The pattern.

Everything here comes from the public record of case No. 4:24-cr-00299 in the U.S. District Court for the Eastern District of Missouri: the redacted superseding indictment, two government detention motions, the defense sentencing memo for one courier and the docket, plus the U.S. Attorney’s releases on the indictment (October 2024), the guilty pleas (September 2025) and the sentences (March 2026). No victim or defendant is named. What the indictment and the prosecutors say is allegation; what the defense says is the defense’s argument; the guilty pleas, sentences and restitution orders are as the U.S. Attorney’s office reported them.