"Once victims obtain cash and inform the primary scammer they have the funds, the scammer arranges to send couriers to retrieve the cash at victims' homes or public locations," the FBI warned in a public service announcement published on Monday.
Courier collection: passwords and dollar-serial authentication
The FBI's advisory describes a straightforward, low‑tech step added to contemporary cryptocurrency investment scams: dispatched couriers who physically collect cash from victims. To authenticate the pickup, couriers present an agreed‑upon password or a specific U.S. dollar bill serial number. Victims are given that serial number or code in advance; when the courier presents the matching bill or repeats the password, the victim is meant to accept the courier as part of the operation and hand over cash.
Pig butchering and romance baiting: the fraud arc
According to the FBI, these courier pickups are embedded in larger schemes commonly labeled "pig butchering" or "romance baiting." Scammers initiate contact over social media, dating sites, and messaging apps, then build trust through repeated communication. Victims are lured into fake investment schemes and encouraged to move funds into what they believe are legitimate cryptocurrency platforms. Rather than investing, the scammers move the victims' money into accounts the criminals control and then pressure victims into further action when transfers are blocked.
Simulated gains and repeated extraction
The FBI says the scam often uses a cycle of apparent wins and escalating demands. After a courier collects cash, victims are shown a simulated increase in their virtual wallet balance and attempt to withdraw winnings. At that point, the fraudsters restart the scheme: they demand additional cash to pay bogus "taxes" or "penalties," again instructing victims to hand over funds through couriers. In some cases, the push toward an in‑person cash pickup occurs after legitimate financial institutions block suspicious transfers; scammers may tell victims an account has been "flagged" to explain why cash must be supplied directly.
FBI guidance for victims and the public
The law enforcement agency offered clear behavioral advice: research cryptocurrency platforms before investing; do not share home addresses or deliver cash to unknown individuals; stop all contact after unsolicited wrong‑number communications; and be alert to "love bombing," which the FBI calls an extremely effective manipulation technique used to quickly build false trust with a target. Victims are urged to immediately file a complaint with the FBI and to include as much information as possible — specifically the criminals' names, methods of communication, and bank accounts used in the scam.
What this means for end users, financial institutions, and law enforcement
- End users: The advisory names concrete warning signs — requests for in‑person cash delivery, serial‑number authentication, and rapid pressure to hand over more funds after a purported win — and recommends stopping contact and reporting the incident to the FBI with the identifying details the agency requests.
- Financial institutions: The FBI notes that couriers often appear after legitimate banks or platforms block suspicious transfers; institutions can expect customers to report follow‑on requests for cash pickups when normal channels fail, and that those reports may include claims that accounts were "flagged."
- Law enforcement: The FBI links this pattern to a broader, recurring tactic: two years ago the agency warned couriers were also being used to collect cash in tech support and government impersonation scams, indicating couriers are a persistent tool for off‑ramping stolen funds across multiple fraud types.
The FBI also placed these courier‑enabled schemes in a larger statistical frame: its 2025 Internet Crime Report found U.S. victims lost nearly $21 billion to cyber‑enabled crimes last year, and investment scams alone accounted for 49% of all scam‑related incidents, producing $8.6 billion in losses. That tally underscores why the agency is pressing the public to recognize the specific markers the advisory describes — and to document and report incidents with as much detail as possible.
Couriers add a physical, face‑to‑face link to otherwise online frauds, turning virtual deception into real‑world theft. The FBI's bulletin makes clear that the handoff — the password, the dollar bill, the street corner — is as much a red flag as the initial unsolicited message that begins the scheme.
