A prosecutor published the whole script, and it ends with a password at the door

Written By Matthew Delaney

On July 30, Ventura County District Attorney Erik Nasarenko filed felony charges against a Rosemead man accused of driving a cash courier to the home of a Thousand Oaks woman who had just withdrawn $14,000. The charges include conspiracy to commit theft from an elder or dependent adult, with a special allegation that the crime showed "planning, sophistication, and professionalism."

The unusual thing about the filing is not the arrest. It is that the DA's office published the sequence. She was deleting spam email and clicked a link. A message told her not to shut off her computer and to call the number on the screen. The person who answered said her machine was infected, then transferred her to a man claiming to be an officer of the Federal Trade Commission. That man told her she was a suspect in a money laundering investigation and had to withdraw cash to prove the funds were hers, and that the Treasury Department would freeze her accounts if she refused. He stayed on the line while she drove between banks. Somewhere in the middle of that drive he told her two people were watching her home. Then he told her to package the cash and wait for a courier named "Lisa," who would give a password before taking it.

That last detail is the one professionals should hold onto. The FBI described the same mechanic in an advisory issued June 15: the caller supplies the victim with a code word or a dollar bill serial number, and the person at the door repeats it back. It reads as verification. What it actually does is convert an unbearable decision into a procedure, for someone who has spent the past several hours being told she is under federal investigation.

The payment channel is the part that has shifted, and San Diego County District Attorney Summer Stephan explained why in May. Banks and retailers got measurably better at blocking wires, cryptocurrency and gift cards, so the networks began sending drivers. She called courier fraud the number one scam in her county, described couriers travelling in from Los Angeles, and noted crews now asking victims to convert cash into gold bars or hand over an ATM card outright. Sonoma County saw the same pattern in June, when an older couple lost roughly $28,000 to callers posing as federal officials.

For anyone who sits between an older adult and their money, the operational takeaway is narrow enough to use tomorrow. In each of these cases the victim was on a live phone call for the entire withdrawal, because the script requires real-time coaching to survive contact with a bank teller. That makes an active call during a large cash withdrawal the most detectable feature of the scheme — more detectable than the amount, and more detectable than anything a transaction monitoring system will flag after the fact.

The controls worked. The money went somewhere else.

Sources

Matthew Delaney
Next

The Fraud-Recovery Call Is the Second Scam