The bank blocked the wire, so the courier came to her door

Linda was sixty-eight years old and she was counting hundred-dollar bills on her kitchen counter for the third time.

The kitchen was the one her husband had renovated in 2019. White cabinets. The faucet he had picked out because it had a sprayer. A magnet on the fridge from a cruise they took to Alaska before he got sick. She had not changed any of it since he died. The kitchen was where she still talked to him sometimes, out loud, when she was making coffee.

She was not making coffee this morning. She was counting cash.

Forty-two thousand dollars in hundreds, in a manila envelope she had bought at Staples on Monday. The teller at Wells Fargo had asked her three times what it was for. She had told the teller it was for a roof repair. She had told the teller it was a contractor who only took cash. She had told the teller it was none of the bank's business, finally, because the teller would not stop.

The bank had let her have her money. They had filed something. She did not know what. She knew because Marcus had told her they would, and Marcus had told her not to worry about it.

Marcus had also told her the car would be there at ten.

She looked out the window over the sink. A black sedan was already at the curb, engine idling, exhaust pluming in the cool Phoenix morning. The driver was a man in his thirties wearing a black polo. She could not quite see his face. He was looking at his phone.

She picked up the envelope.

This is the part the FBI wants you to see.

ii. The handoff

On July 15, 2026, the Federal Bureau of Investigation issued a Public Service Announcement warning that crypto investment scammers had started sending couriers to victims' homes to pick up cash in person. Not wires. Not ACH transfers. Not Zelle. Cash, in envelopes, handed to a stranger on a doorstep.

The reason is straightforward. The banks got better.

For years, the standard extraction method in a crypto investment scam was a wire transfer or a series of them. The victim, having been convinced they were earning extraordinary returns on a trading platform that did not exist, would be instructed to send funds to a bank account that would route the money offshore and into cryptocurrency. The banks, watching the same pattern repeat across thousands of customers, started flagging the transfers. They called the customers. They froze the accounts. They asked the questions the teller asked Linda.

So the scammers stopped using the wires.

The new method, according to the FBI's bulletin and corroborated in Bitdefender's 2026 Global Scam Intelligence Report released the week before, is hand-to-hand. A courier, often a gig worker who has been told they are picking up legal documents or jewelry or an inheritance payment, drives to the victim's home. The victim hands them an envelope. The courier delivers the envelope to an aggregator. The aggregator feeds the cash into crypto kiosks, those machines you see at gas stations and convenience stores, which the FBI separately warned about in May 2026. The kiosks convert the cash to Bitcoin or Tether. The Bitcoin or Tether moves to a wallet. The wallet moves offshore.

No wire. No bank. No flag.

The cash leaves the country the same way drugs used to. In a layered chain of people who each see only their piece.

iii. The platform that was not a platform

What Linda saw on her laptop was not a fabrication in the loose sense of the word. It was a fabrication in the precise sense. Someone had built it, on purpose, for her.

The platform was called something corporate. A name with "Capital" in it, or "Global," or "Asset." The login screen had a logo. The dashboard had charts that moved. Her account showed a balance that grew. At the moment she stood at the kitchen counter with the envelope, the dashboard said her account was worth $340,287.41.

That number is what scam researchers call a fictitious balance. It is a number on a screen that corresponds to no money anywhere. The screen is the lie. The screen is the entire product. A skilled developer can build a convincing one in a weekend. The chart data is randomized inside parameters that always trend up. The withdrawal button works, technically, but it triggers a customer service flow that ends in a request for fees.

The fees are where the second extraction happens.

Marcus, the man she had met in a Facebook widow support group eight months ago, had walked her through every step. He had been so patient. He had shared screenshots of his own account. He had explained that he had lost his wife to cancer too, three years ago in Denver, and that he had found this trading platform when he was at his lowest, and that it had given him his life back. He sent her flowers on her birthday. He called her every morning at 7:30.

He had told her, last week, that her account had hit a regulatory threshold. The Internal Revenue Service required her to pre-pay a compliance fee before she could withdraw her gains. The fee was forty-two thousand dollars. The platform could not accept the fee through normal channels because of the way it was structured. She would need to pay in cash. They would send a courier.

Read that again.

The IRS does not send couriers. No regulator does. No legitimate trading platform requires a cash compliance fee to withdraw funds. There is no version of finance in which a stranger in a black sedan shows up at your house to collect an envelope. Not one.

But Linda did not know that. Linda had been a pediatric nurse for thirty-one years. She knew how to read a fever curve. She had not been trained to read this.

iv. The math the FBI cannot fix

According to the FBI's 2025 Internet Crime Report, cryptocurrency investment scams cost American victims $7.2 billion last year. Investment fraud overall, the largest category of cybercrime, cost $8.6 billion across nearly 73,000 reported cases. Chainalysis estimated global crypto scam losses for 2025 could exceed $17 billion when including unreported cases. The average scam payment, according to that report, rose 253% year over year to $2,764.

In the United Kingdom, investment fraud accounted for £221.5 million (about $297M USD) in authorized push payment fraud in 2025, a 40% increase, across 14,893 cases.

These are the numbers the agencies can see.

The courier tactic exists specifically to make the numbers smaller. Cash that leaves a kitchen in an envelope does not show up in a Suspicious Activity Report. The bank's compliance department never sees it. The wire fraud algorithms do not catch it. The victim, often, does not report it for weeks or months because they still believe, on some level, that the money is somewhere recoverable. They believe Marcus will call. They believe the platform will release the funds. They believe the compliance fee was the last fee.

There is always one more fee.

v. The driver

The man in the black sedan was named something. He had a job through an app. He had been hired that morning to pick up a package from a residential address and deliver it to a parking lot near a Circle K on the other side of town. He had been told the package contained legal documents. He had been paid two hundred dollars for the run. He was twenty-six. He needed the money for rent.

He was not a criminal in any sense he would have understood. He was a courier. He had done dozens of these. He had stopped asking what was inside the envelopes a long time ago.

This is what an industrialized fraud machine looks like at the human layer. Most of the people in the chain do not know what they are doing. The scammer in another country knows. The aggregator who collects from multiple couriers knows. Everyone else is a contractor with a phone.

Linda did not see any of this. Linda saw a polite young man in a black polo who took the envelope from her hands, said "thank you, ma'am," and drove away.

vi. The kitchen, after

She watched the sedan turn the corner. She closed the door. She walked back to the kitchen.

The envelope was gone. Her hands felt empty in a way she could not place. She sat down at the table where she ate breakfast every morning. The laptop was open. The dashboard still showed $340,287.41.

She refreshed the page.

It still showed $340,287.41.

She felt, for the first time in eight months, something cold move through her chest. Not certainty yet. Not the knowledge of what had happened. Just the beginning of a question her body was asking before her mind would let it form.

She picked up her phone and called Marcus.

It went to voicemail.

She called again.

It went to voicemail.

She would call seventeen more times before the end of the day. By the third call, the number would be disconnected.

vii. The pattern, named

The FBI calls it a courier-collection scheme. The cybersecurity industry calls it the physical bypass layer. What it is, mechanically, is the place the scam touches the ground. Everything else, the platform, the relationship, the fictitious balance, the compliance fee, lives in software and in language. The courier is the only piece of the fraud that exists in the physical world.

That is why it works. The courier makes it real. A stranger drove to her house. He took the envelope. He said thank you, ma'am.

If you are reading this and you are about to hand cash to someone you have never met, for any reason connected to an investment, a fee, a tax, a fine, a regulatory threshold, a withdrawal, a verification, a compliance requirement, or a release of funds, stop. There is no version of the legitimate financial system that involves a courier at your door. Not one.

The FBI's advice, published July 15, 2026, is plain. Do not hand cash to couriers. Verify any platform through the SEC's EDGAR database or FINRA's BrokerCheck before sending money. Be skeptical of unsolicited contacts on dating apps and social media. Report suspected fraud to the Internet Crime Complaint Center at ic3.gov.

That is the official version. Here is the other version.

The machine is not going to stop because the FBI issued a bulletin. The machine adapted to wire detection. It will adapt to bulletins. The next iteration will use a different cover story. The courier will be told they are picking up a deceased relative's jewelry. The victim will be told the cash is going to a notary. The platform will have a new logo and a slightly different name. The math will be the same.

Linda sat at the kitchen table for a long time. The Alaska magnet was on the fridge. The faucet her husband picked out was over the sink. The laptop showed three hundred and forty thousand dollars she did not have and had never had.

She had handed the envelope to a stranger.

That was the part she would have to live with. Not that she had been fooled. That she had walked the cash to the door.