Couriers
Zavialov Ilia Nikolaevich walks through the courier scheme from the first call to the doorstep
A stranger arrives at a front door, says a word agreed earlier on the telephone, takes an envelope of banknotes or a small parcel of gold, and walks away. Nothing in that moment looks like a computer crime, and no password was stolen. The Federal Trade Commission describes a whole branch of impersonation schemes built around that ending, with a courier collecting cash or gold bars in person. The question is how an ordinary person reaches that doorstep holding their savings in a bag. What follows traces the sequence from the first message to the handover, and marks where it can still fall apart.
Why the money has to travel on foot
Every scheme has to end somewhere, and the ending matters most to the organisers. A card payment can be disputed, a transfer leaves a named account at the other end, and a cryptocurrency payment still needs the target to operate an exchange. Cash removes all of that in one movement. Among older adults who lost ten thousand dollars or more to impersonation of a company or a state service, the Federal Trade Commission recorded thirty three per cent paying in cryptocurrency, twenty per cent by transfer and sixteen per cent in cash.
Gold occupies the same position for a different reason. A bullion dealer sells metal to anyone who arrives with identification and funds, and the sale is an ordinary lawful transaction. The paper trail stops at the dealer counter, because the loss never enters a payment system. A small bar carries a large value in a coat pocket and can be resold within hours.
The collector solves a second problem that has little to do with laundering. A caller who has spent two hours building an emergency needs the story to finish in the physical world, since a transfer screen can still be interrupted by a bank clerk. A person at the door with an agreed word makes the operation feel official and closes the loop by hand. By that stage the target believes the handover keeps their savings safe.
The first contact arrives from the side
The opening move rarely comes from a direction the target chose. A message reports a payment that was never made, a recorded voice announces an unpaid road toll, or a caller introduces himself as the fraud desk of a bank. The Federal Trade Commission counted around one billion dollars lost to impersonation of companies, with the largest amounts going to those posing as bank staff. Impersonation of state services took a further nine hundred and twenty million, and such reports grew by forty per cent in a year, partly on toll messages.
The first conversation usually asks for nothing at all. It informs, it apologises for the inconvenience, and it confirms details the caller already holds, such as the last digits of a card or a recent purchase. Those details come from breached databases and public records, and they arrive at the moment a person is deciding whether to believe a stranger. Extraction begins only once the target has stopped weighing whether the call is genuine.
Tone belongs to the script as much as the words do. A caller who shouts loses the target within a minute, so the voice stays procedural, faintly bored and slightly inconvenienced by having to call at all. Questions are welcomed, because every answered question strengthens the impression of an institution with rules behind it. The call also establishes a channel of its own, asking the target to save the number and to answer when it rings again.
The handover between voices
The second stage introduces a new voice carrying more authority. The bank employee explains that the matter has been escalated and passes the line to an investigator, a police officer or a regulator. Operations of this shape, covering fake technical support and impersonation of state services, produced over eighty thousand complaints and more than two point nine billion dollars in reported losses in the annual figures of the FBI complaint centre. The second voice exists to raise the stakes.
Verification theatre appears at this point. The target is invited to hang up and dial the number printed on the back of the card, which sounds like the safest possible check. The line is quietly held open, or the number supplied reaches the same team, and the voice that answers confirms everything the first one said. Some operations follow up with an email carrying a case reference and a logo lifted from a public website.
The escalation also changes what the conversation is about. Money stops being the subject, and the subject becomes an investigation in which the target has been asked to assist. An invitation into an operation flatters and frightens at the same time, and both feelings suppress the ordinary instinct to consult somebody. From this point the target reports to the caller and treats their own doubts as an obstacle to the work.
Building a reason to hold the money by hand
A reason to withdraw savings has to be strong enough to survive a queue in a branch. The stories used are old and stable. An insider at the branch is under investigation and the account can no longer be trusted, the notes need checking for counterfeits, or the funds must sit somewhere safe while an audit runs. Gold enters the same argument as a way to preserve value while accounts are frozen. Every version places the target on the side of the institution.
The instruction is always framed as a request for cooperation. The caller apologises for the inconvenience, mentions in passing that the alternative would be a formal freeze on the account, and thanks the target for helping. Refusal is never punished directly, because pressure of that kind wakes people up. Instead the caller expresses concern about how much the delay will cost the target personally, and returns to the subject on the next call.
Amounts usually start below the level that attracts questions. A first withdrawal may be a few hundred, handed over without incident, which teaches the target that the process works and the people are real. The sums grow once that lesson lands. Among older adults who each lost more than one hundred thousand dollars, the Federal Trade Commission recorded total losses rising eightfold, from fifty five million dollars in 2020 to four hundred and forty five million in 2024.
Secrecy is the beam that holds the structure up
Every version of the scheme contains an instruction to tell nobody. The reason sounds sensible inside the story, since the investigation is described as confidential, a relative may be under suspicion, or branch staff cannot be trusted while an enquiry runs. Family, neighbours and bank employees are placed outside the circle in a single sentence. That one instruction does more work than any other part of the script.
Secrecy converts the target into an active participant. A person who has agreed to conceal something begins building their own cover story, and the effort of maintaining it makes stepping away harder with every hour that passes. Doubts get handled internally, because voicing them would mean admitting the concealment first. The caller reinforces the effect by praising discretion and by describing any question from outside as interference with the case.
The same instruction is the clearest marker available to anyone watching from the outside. Banks discuss suspected fraud with the account holder openly and involve their own security teams. Police forces do not ask members of the public to withdraw money and hide the reason from cashiers. When a caller needs silence in order for the plan to work, the silence itself is the evidence.
The counter is the first real checkpoint
The withdrawal is the moment when the scheme touches a trained stranger. Cashiers in many banks are required to ask what a large cash withdrawal is for, and bullion dealers ask their own questions under money laundering rules. Both checkpoints exist precisely for this situation. Both are defeated by a single coached sentence.
The coaching is specific. The target is told to say the money is for a kitchen refit, a used car, a family wedding or a private purchase from a seller who wants cash. The caller may rehearse the answer and warn that staff will ask twice, describing the questions as a formality imposed by regulation. In the branch the target then lies on behalf of the person taking their savings, and the checkpoint closes quietly behind them.
An honest answer at the counter breaks the chain more often than any technology does, because a cashier who hears the real story recognises it within seconds and the bank can then hold the withdrawal, involve its fraud team and call the police while the money sits in the account. The bullion counter is harder, since buying gold with savings is a normal act, the dealer is legitimate and the receipt is real. That legitimacy is what the operation borrows, because the metal leaves the shop with no payment trail attached. The Federal Trade Commission treats courier collection of cash and gold bars as a defined branch of impersonation fraud.
The agreed word and the person at the door
The handover is arranged with small pieces of ceremony. A word is agreed on the telephone, or the target is asked to tear a banknote in half and give one part to the collector, or to read out a reference number at the door. The ritual serves two purposes. It reassures the target that the collector belongs to the institution, and it lets the organiser confirm that the right package reached the right hand.
The collector usually knows almost nothing. Couriers are recruited through job adverts promising payment for local pickups, sometimes dressed up as debt collection or secure logistics, and they are given only an address, a time and a word. They are also the only visible person in the whole structure, which is why they are the ones who appear in court. The organisers stay on the telephone, frequently from another country.
The handover itself lasts under a minute. A parcel changes hands at a door, in a car park or beside a station entrance, and the courier leaves without issuing anything of value in return. In many recorded patterns the caller stays on the line during the pickup, so the target is being listened to at the moment of loss. Repeat visits follow once the first one has succeeded.
The hours after the parcel leaves
The call rarely ends when the money does. The caller offers thanks, gives a timescale for the return of the funds, and asks the target to stay available for the next stage of the case. The purpose is delay, since every hour without a report is an hour in which the cash travels further away. A second collection is often proposed before the first one has been questioned by anyone.
Recovery depends on speed and on physical traces. The bank needs to know what was withdrawn and when, and a report filed with the police on the same day is worth far more than a fuller account a week later. Everything connected to the contact keeps value, from the number that called to the dealer receipt and the time the collector arrived. Camera footage from doorbells and nearby shops has short retention, so an early request matters.
A second scheme frequently follows the first. The target is approached by someone offering to recover the lost funds for a fee, or by a supposed investigator who needs a payment to release seized money. Lists of people who have already paid circulate between groups, which makes previous victims a preferred audience. The Federal Trade Commission puts the typical reported loss in an impersonation complaint at around seven hundred dollars, and the courier branch sits far above that figure.
Where the sequence breaks
The scheme fails far more often than it succeeds. In four out of five impersonation reports to the Federal Trade Commission no money was lost at all, which means the script meets resistance most of the time it is used. Volume keeps it profitable, because the cost of one more call is close to nothing. The breaks are ordinary and available at several points in the sequence.
The first break is the independent callback. Ending the call and dialling a number taken from a bank card, a statement or an official website separates the target from the operation completely, since the criminals control only the line they supplied. A genuine institution accepts that check without complaint. A caller who objects to it, offers an alternative number or asks for the line to stay open has answered the question by objecting.
The second break is time, because a person who sleeps on the matter usually speaks to somebody in the morning. A pause of a few hours costs nothing when the story is true and dissolves it when the story is false. The third break is another human being, a relative or a cashier who hears the account out loud and recognises the shape of it. The last break is one question about the ending, since cash in a bag at a front door is a form of payment that no bank, police force or state service uses. Anyone who traces the story backwards from the doorstep to the first message sees the sequence for what it is.
| Step | What the caller needs from the target | Where the step breaks |
|---|---|---|
| First contact | Belief that the warning came from a bank or a state service | A callback on a number taken from the card or an official website |
| Escalation to a second voice | Authority and a sense of taking part in an investigation | A question about why an investigator needs a private person to move money |
| The reason to hold cash or gold | Agreement that savings are safer outside the account | Any explanation of the plan to a relative or a bank employee |
| The demand for silence | Concealment from family and from counter staff | Treating the demand for silence as the marker it is |
| The withdrawal or the bullion purchase | A rehearsed answer at the counter | An honest answer to the cashier or the dealer |
| The handover to the collector | An agreed word and one minute at the door | A closed door and a call to the police from a separate line |
| The hours afterwards | Delay before anything is reported | A report to the bank and the police on the same day |
Questions and answers
Do banks or the police ever send a courier to collect cash?
No institution of that kind collects money at a front door. Banks handle suspected fraud through the account itself and through their own security teams, and police forces do not take custody of savings for safekeeping. A collector at the door is the scheme completing itself.
Why do scammers ask for gold bars in these schemes?
A bullion purchase is a lawful transaction, so the paper trail stops at the dealer counter and the loss never appears inside a payment system. The metal is compact, easy to resell and carries no account name. The Federal Trade Commission lists collection of cash and gold bars by courier as a distinct branch of impersonation fraud.
What does the agreed code word in a courier scam actually do?
It is a control mechanism for the organiser, confirming that the right person handed over the right parcel. For the target it works as theatre that makes the visitor look official. Nothing about the word connects that visitor to a bank, a police force or any agency.
Can money handed to a courier be recovered?
Cash and gold given over in person are the hardest losses to reverse, because no payment system holds the transaction. Speed still matters, since a same day report to the bank and the police, together with the caller number, the dealer receipt and the time of the pickup, gives investigators something to follow. The courier is often the only identifiable person in the chain.
Why did the caller insist that I tell nobody about it?
Silence is the part of the script that keeps the plan alive, because one sentence spoken to a relative or a cashier usually ends it. Genuine institutions discuss a suspected fraud openly with the account holder. A demand for secrecy is the most reliable single signal in the entire conversation.
What should be done immediately after handing money to a courier?
Contact the bank on a number taken from the card, report the matter to the police the same day, and keep every trace of the contact. Expect a follow up approach offering to recover the funds for a fee, which is a second scheme aimed at the same person. Nothing further should be paid to anyone who makes contact about the first loss.