The Dead Drop
FRAUD · POWER · PSYOPS
The newest scams go after the wealth that sits outside your bank.
|

In April, a popup on a 78-year-old woman's computer in Marion, Illinois, told her the machine had been compromised and gave her a number to call. The man who answered said he was Mike Williams from Microsoft. Once she let him into her computer he could see her Edward Jones investment account, and he passed her to a colleague, Kevin Jones, who said he worked fraud prevention at Edward Jones and that her money was in danger.
Over the next two months, according to the federal case, Jones had her sign a nondisclosure agreement, text him "good morning" and "good night" every day, and carry a "tracker phone" he could monitor. She moved nearly $1.8 million into a money market account and bought more than $823,000 in gold.
On June 8, she drove to the Walmart parking lot in Marion. She and a man she believed was a U.S. Treasury agent exchanged the code word, "black bug," before she handed him 26 gold bars worth $318,459, gold that has never been recovered.
After the handoff, Jones sent her paperwork with a federal seal that didn't look real to her, and she called the Marion police. This time real federal agents got involved, from Homeland Security Investigations and the U.S. Postal Inspection Service. On July 7, with officers watching, she made a second drop outside a church near the Marion Sam's Club. The courier exchanged the code word "poker queen" with her and took a box that was supposed to hold two 1kg gold bars worth about $272,000. It held sandbags.
Ruoyu Lian, 30, of Flushing, New York, was arrested on the spot. On September 24, appearing by Zoom before the federal court in Benton, he pleaded guilty to wire fraud and conspiracy to commit wire fraud; he'll be sentenced in January. He's the only person charged so far, and I doubt Mike Williams or Kevin Jones was ever anyone's real name.
| GM, WELCOME BACK TO THE DEAD DROP. |
Last week a fake Chicago detective called a reader and asked for nothing except the names of the companies where he kept his money. I said that list was a map. This week you can see where the map leads: to a parking lot in southern Illinois and a stranger with a code word.
This issue has two stories that turn out to be one. The first is gold and the second is the deed to your land, and the people in this issue want both for the same reason: they sit outside the bank, where no fraud department is watching. The gold scam has been working its way through Arizona all year, here in my backyard, and you'll meet some of the people it reached.
The Safekeeping Script
Marion wasn't a one-off, and the people running this don't improvise. On September 25 the Pennsylvania State Police described the same script almost step for step: a popup on the victim's computer, then a caller claiming to be with a federal law enforcement agency, who says the victim's identity or Social Security number has been tied to a crime. The fix is always to withdraw the money, buy gold bars or coins, and hand them to a courier for "safekeeping." Troopers tie about $6.5 million in losses across Pennsylvania, Maryland, and Washington State to their case, and on September 10 they stopped a car on Interstate 80 and took two people into custody. They haven't released names.
Each step answers the fear the one before it created. The popup makes her afraid for her computer, and the man from "Microsoft" turns that into fear for her savings. The "fraud department" confirms the danger and raises it, and the federal agent arrives as the one person who can make it stop. By the time anyone says the word gold, she believes she's helping with an investigation.
The rest of the script is control. The nondisclosure agreement turns silence into an obligation, so the victim keeps quiet even with her family and her own branch, and the tracker phone and daily texts make sure she's never out of contact long enough to talk it through with anyone. Real operations use code words, and these crews use them for effect, because a person who's been handed a code word believes she's on the inside. In Marion the words were "black bug" and "poker queen."
|
"No legitimate law enforcement officer will instruct you to purchase gold or give cash or gold to a courier." Pennsylvania State Police · September 25, 2026
|
|
◆ THE OPERATIVE'S OBSERVATION
Banks spent the last decade learning to stop a customer from wiring money to a stranger, and today a fraud team will flag a new payee and call the customer before the money moves. The crews noticed, and they took the stranger out of the transaction. The only purchase the bank sees is a retiree buying gold with her own money. That's legal and it's her right, and almost nobody along the way has a reason to question it. The theft happens later, in a parking lot, where nobody is watching and nothing can be reversed. In a case announced September 4, prosecutors in Tarrant County, Texas, say the gold their suspects collected went to a Florida refinery, was melted down, and was turned into cryptocurrency. A melted bar has no serial number. |
The Arizona Run
The FBI's Internet Crime Complaint Center, where victims report online and phone fraud, counted about 725 gold courier complaints in 2025 and $311.8 million in losses, or about $430,000 per complaint. The average loss for victims over 60 was $38,500, so a gold courier victim lost about 11 times what the typical older victim did. Plenty of victims never file a complaint, so treat these numbers as a floor.
Arizona ranked 5th in the country for losses reported by people over 60, about $344 million. The report doesn't say how much of that was gold, but the cases aren't hard to find.
In April, according to federal prosecutors, an elderly Phoenix woman was told she was an identity theft victim, and someone posing as a former United States Attorney told her to buy gold to protect her money. She had already lost more than $400,000. On April 10, FBI agents arrested Gary Christopher, 59, of Port Saint Lucie, Florida, as he arrived at her home to collect $600,000 more in gold. He's charged with conspiracy to launder money and hasn't been convicted.
In Payson, AZ, a woman who'd handed gold to couriers in January grew suspicious, and in February detectives used a second exchange to arrest a 20-year-old and a teenager from Fresno, California. Police said they had no evidence either one made the calls.
In August, the Maricopa County Attorney's Office indicted Andre Hart, 22, of Miami, for collecting more than $65,000 from county seniors over three trips in July. Callers posing as the victims' banks told them to hand their cash to "an undercover investigator," and Uber drivers who had no idea what they were carrying delivered each package to Hart. In intelligence work, a middleman like that is called a cutout. When police arrested Hart on his third trip, another Uber driver walked up to the officers with another "package." Hart hasn't been convicted either.
Not every Arizona story ends at the curb. In August, staff at a Tucson gold dealer noticed a large purchase that didn't look right and called the Pima County Sheriff's fraud line. The woman buying had already wired $25,000, but that phone call stopped another $270,000.
The Only One Holding the Box
Look at who got arrested in every case above: a 30-year-old with a restaurant job, a 20-year-old and a teenager from Fresno, a 22-year-old from Miami, and a 59-year-old who walked up to a door in Phoenix. They're the people standing in the parking lot, because somebody has to, and they're paid like it. Lian's lawyer, Joe Cervantez, says his client earned about two weeks of his restaurant pay for the job. "Lian is expendable to them," Cervantez said of the people running the ring.
|
"At the end of the day, everybody in the scheme is still on to the next one." Joe Cervantez · Attorney for courier Ruoyu Lian · September 2026
|
He's right, and that's the second fraud in this story. The first is the call. The second is a system where the only person anyone can reach is the one carrying the box. The voices on the phone use borrowed names and the gold comes out the other end as crypto, so the courier is the one who gets the federal charge. Lian faces 40 to 52 months under the sentencing guidelines, by his lawyer's count, and he'll be required to pay more than $318,000 in restitution.
Police are getting better at the bait. In June a sheriff's detective in Kent County, Michigan, posed as a 79-year-old victim in a strip mall parking lot, pretended to be on the phone with the scammer, and handed a courier a box that was supposed to hold $700,000 in gold coins and actually held the foil-wrapped chocolate kind. Deputies arrested a 20-year-old from Elmhurst, Illinois. "It's a nationwide trend," Sgt. Scott Dietrich told reporters. I'd like to know who in that office got sent to buy the chocolate.
Once in a while a case climbs higher. On September 4, the Tarrant County District Attorney announced the arrest of Muzamil Ahmed, 35, of New Jersey, at JFK airport, in a network prosecutors tie to more than 40 indictments, more than 200 elderly victims, and more than $250 million in losses, with couriers who posed as federal agents. Ahmed hasn't been convicted. "If you are participating in this scam, know this: We are dismantling your network," District Attorney Phil Sorrells said. I hope he's right.
Then They Come for the Deed
Gold in a closet is one kind of wealth that sits outside the bank. Land is the other, and the thieves never have to touch it.
In July, federal prosecutors in Boston charged three men with selling vacant, mortgage-free lots in Massachusetts, Georgia, Indiana, and Tennessee that belonged to out-of-state owners. Prosecutors say the men posed as the owners with fake email accounts, internet phone numbers, driver's licenses, and passports, and took in about $1.5 million. Local reporting ties the case to a Concord, Massachusetts, lot that sold for about $500,000 in May 2024, using fake IDs with the real owners' birthdates and addresses under other women's photos. None of the three has been convicted.
In June, New York's Attorney General charged a Brooklyn man with forging a deed that moved a 92-year-old woman's house, worth about $950,000, into his own company and then collecting rent on it.
The thief picks a property with no mortgage and nobody living on it, so no lender is watching and no neighbor knows the owner. He poses as the owner by email and text, asks a local agent for a fast sale, and closes remotely with a fake ID shown to a notary or a forged notary stamp. The money leaves by wire, and the owner usually finds out months later, from a missing tax bill or a construction crew on the lot.
The American Land Title Association surveyed 245 title and settlement companies, the firms that run closings, and published the results last month. 59% had seen a seller impersonation attempt in the prior year, up from 28% in ALTA's 2024 survey, and the properties they named most often as targets were vacant land (82%), absentee owners' property (72%), property with no mortgage (68%), and property whose owner has died (55%). The survey counts attempts the firms saw, not owners who lost land, but it tells you which owners get picked.
The second fraud here is the recording system. In most counties the recorder's office checks that a deed meets the filing rules, not that the person who signed it owns the land. A forged deed with a notary stamp goes into the public record like any other. In most states a forged deed legally transfers nothing, but undoing one takes a lawsuit, and until a court rules, the record says someone else owns your land.
Arizona changed its law this year. SB 1479, signed April 9, makes recording a forged or false real property document a class 5 felony instead of a misdemeanor. People who record documents in person now have to show photo ID, notaries have to take a thumbprint for deeds and other real property documents, and by January 1, 2027, every county assessor has to offer owners an alert when the ownership or mailing address on a property changes.
In Maricopa County you don't have to wait. The Recorder's office already runs a free Title Alert that emails or texts you when a document is recorded under your name, and more than 92,900 accounts have signed up. It only covers documents recorded after you sign up, and it warns rather than blocks, so act the day it arrives. Many counties offer the same kind of alert, and the FBI's June 16 warning on this scheme tells owners to ask their county about one.
What the Justice Department Is Hunting
On October 1, the Justice Department told its new fraud prosecutors which corporate cases matter most. Directive 26-12, from Colin M. McDonald, who runs the department's National Fraud Enforcement Division, names four priorities: health care fraud, fraud against government programs and contracts, major tax and revenue evasion, and tariff evasion and forced labor. It then lists 10 factors prosecutors must give "great weight" when they decide whether to charge a company.
Count them and 5 of the 10 turn on taxpayer-funded programs, the safety of Americans and military readiness, money flowing to foreign adversaries, or immigration offenses. Victims show up once, in factor 8, as a threshold: 25 or more of them, or $25 million in losses. The directive doesn't mention elder fraud, consumer fraud, or investment fraud. The Criminal Division's white-collar enforcement plan from May 2025 did; it named investment fraud, including schemes aimed at the elderly, among its priorities.
I want to be fair about what this is. It's a memo about charging companies, not people, it calls its own list non-exhaustive, and U.S. Attorneys still bring elder fraud cases, two of which are in this issue. I don't know yet how it changes which cases get brought. But when the government writes down what it's hunting, it also tells you what it isn't. Americans over 60 reported $7.7 billion in losses to the FBI last year, up 59%. The gold in the Texas case went through a refinery on its way to becoming crypto, and the new directive doesn't name that kind of business.
|
◆ WATCH THIS MONTH · THE $90 FROM MEDICARE
CMS says about 20.8 million people in Original Medicare will get a one-time $90 rebate on their Part B premium this month. Most will see a direct deposit from Social Security on or around October 8. The rest will get a paper check from the Treasury in late October, marked "Medicare Improvement Fund Payment; $90 Payment to Offset October Premium." People in Medicare Advantage don't get it, and nobody has to apply. The fact sheet carries no scam warning, so I'll add one: the money arrives on its own, and anyone who contacts you offering to help you claim or verify it is running a scam. With the 2027 Social Security raise due after the October 14 inflation report and open enrollment starting October 15, expect the calls to keep coming into December. CMS's fact sheet says President Trump is the first president to use the Medicare Improvement Fund to lower costs for enrollees. The deposits arrive 26 days before the midterms. |
Field Manual
Four controls for the gold, and two for the deed.
| 01 | No agency, bank, or tech company will ever ask you to buy gold. Not the FBI, the Treasury, the FTC, Homeland Security, Microsoft, the Fraudfather, or your brokerage. Anyone who tells you to turn savings into gold, cash, or crypto for "safekeeping," or to hand anything to a courier, is stealing it. This rule has no exceptions. |
| 02 | Treat a popup with a phone number as the attack itself. Microsoft says its error and warning messages never include phone numbers. Close the browser or restart the computer, and if the warning comes back, take the machine to someone you know. Never let a caller onto your computer; that's how the Marion crew saw her accounts. |
| 03 | A real fraud department never asks for secrecy. No legitimate investigator will ask you to sign a nondisclosure agreement, carry a second phone, check in every morning and night, or keep anything from your own bank. When the caller insists on secrecy, you've found the scam. Hang up and call your bank or broker on the number printed on your statement. |
| 04 | Name a trusted contact on every investment account. FINRA rules require brokerage firms to ask you for one. It's a person the firm can call if it sees signs of exploitation, and naming one gives that person no access to your money. If your parents have brokerage accounts, help them name one this month. |
| 05 | Turn on your county's property alert for every parcel you own. In Maricopa County it's the Recorder's free Title Alert. Start with vacant land and any house a late parent left you, because those are the properties thieves pick first. The alert comes after a document is recorded, so act on it the same day. |
| 06 | Check the record yourself twice a year. Look up each property on your county recorder's or assessor's website and make sure the last recorded owner is still you. Read your title insurance policy for coverage after the purchase, as the FBI recommends. If something's wrong, call the recorder and a real estate attorney that day. |
|
◆ THE FRAUDFATHER BOTTOM LINE
Everyone in this issue went after wealth that sits outside the bank. The gold crews had the victims buy it themselves, so every record looked like a careful retiree protecting her savings, and then they collected it in a parking lot where nobody was watching. The land thieves counted on a recording system that files whatever is signed and stamped. The couriers get caught because somebody has to hold the box, and the callers keep calling. |
|
QUICK REFERENCE · THE SAFEKEEPING SCRIPT
When you hear it, it's the script:
✗ A pop-up warning with a phone number to call.
✗ A "fraud department" that says your accounts are compromised and you need to act today.
✗ A federal "agent" from the Treasury, the FTC, the FBI, or Homeland Security who wants to protect your money.
✗ Any instruction to buy gold, withdraw cash, or move savings "for safekeeping."
✗ A nondisclosure agreement, a second phone, or daily check-in texts.
✗ A code word for a handoff at your door or in a parking lot.
The protocol:
✓ Hang up and call your bank or broker on the number on your statement.
✓ Tell one person you trust before you move a large sum.
✓ Name a trusted contact on every investment account.
✓ Turn on your county's property alert for every parcel you own.
✓ Report it at ic3.gov and to your local police on a number you looked up.
|
|
◆ SPREAD THE SIGNAL
Somebody you love has a brokerage account and would never hang up on a federal agent.Forward this to them, and to anyone in your family who owns land they don't live on. SEND THEM THE DEAD DROPEYES ONLY.
FORWARD WITH CARE. |
|
Sources
Capitol News Illinois, "Marion woman duped out of $318K in elaborate gold bar scheme," September 30, 2026; CBS News Chicago.
Pennsylvania State Police, gold bar scam warning, September 25, 2026. FBI Internet Crime Complaint Center, 2025 Internet Crime Report. U.S. Attorney's Office, District of Arizona, April 16, 2026; Maricopa County Attorney's Office, August 2026; Payson Roundup and azfamily, February 2026; KVOA, August 19, 2026. Tarrant County Criminal District Attorney, September 4, 2026; NewsNation and KTLA on the Kent County, Michigan sting. U.S. Attorney's Office, District of Massachusetts, July 23, 2026; Concord Bridge, July 31, 2026; New York State Attorney General, June 25, 2026. American Land Title Association, Seller Impersonation Fraud Study, September 2026; FBI PSA I-061626-PSA, June 16, 2026; HousingWire, October 5, 2026. Arizona Laws 2026, Chapter 31 (SB 1479); Maricopa County Recorder, Title Alert. U.S. Department of Justice, National Fraud Enforcement Division, Directive 26-12, "Corporate Enforcement in the Fight Against Fraud," October 1, 2026; DOJ Criminal Division memorandum, May 12, 2025; Wilson Sonsini, October 5, 2026. Centers for Medicare & Medicaid Services, "Medicare Improvement Fund Premium Rebate: Frequently Asked Questions," October 3, 2026; Bureau of Labor Statistics release schedule. FINRA Rule 4512; Microsoft, "Protect yourself from tech support scams." DOJ Office of the Pardon Attorney, clemency grants page, updated September 9, 2026; House Judiciary Committee Democrats, "Pardons, Inc.," August 2026; FOX 29 Philadelphia on the Dougherty commutation; ABC News, October 1, 2026. |
|
◆ CLASSIFICATION · EYES ONLY ◆
Disclaimer
The material contained in these newsletters examines techniques developed for high-stakes environments, including intelligence operations, law enforcement, investigations, negotiation, and human-source engagement. Such methods do not exist outside the law. Their legitimate use is constrained by professional ethics, established safeguards, human rights protections, and the legal authorities governing the person who employs them. Knowledge is not authorization. Nothing contained here should be interpreted as permission to manipulate, coerce, deceive, intimidate, exploit, or harm another person. Psychological influence techniques can produce consequences far beyond the intention of the person who applies them. Misuse may result in civil liability, criminal exposure, professional sanction, reputational ruin, or consequences that cannot be reversed once set in motion. This material is provided solely for education, ethical analysis, professional awareness, and baseline reference. Allegations in civil complaints and indictments are allegations until proven. The author and publisher accept no responsibility for actions taken, omitted, improvised, or rationalized by the reader. Some doors are described so that you may recognize them. That does not mean you should open them. |

