Back to Feed
Threat IntelligenceJun 15, 2026

FBI: Fraudsters use couriers to steal money in crypto scams

FBI warns fraudsters use couriers to collect cash from crypto scam victims.

Summary

The FBI has issued a warning about a new tactic used by cryptocurrency investment scammers, also known as "pig butchering" or "romance baiting." Fraudsters are now employing couriers to collect cash directly from victims, especially after legitimate financial institutions block suspicious transfers. These couriers use specific passwords or serial numbers to identify themselves, and victims are often pressured to send more money for fabricated taxes and penalties.

Full text

FBI: Fraudsters use couriers to steal money in crypto scams By Sergiu Gatlan June 15, 2026 11:30 AM 0 The U.S. Federal Bureau of Investigation (FBI) warned that criminals are using couriers to collect money from victims of cryptocurrency investment scams, also known as pig butchering or romance baiting. Such scams usually start with the fraudsters reaching out to their targets via social media, dating sites, and messaging apps, building trust, and then luring victims into fake investment schemes. However, instead of investing their funds, the scammers will steal the money by moving it into accounts under their control. The warning came in the form of a public service announcement published on Monday, in which the law enforcement agency said that scammers are pushing targets toward in-person cash pickups (in some cases claiming a victim's account has been "flagged") after legitimate financial institutions block suspicious money transfers. The dispatched couriers identify themselves using an agreed-upon password or a specific dollar bill serial number. After the pickup, victims see a simulated increase in their virtual wallet balance and attempt to withdraw their winnings, but the scammers restart the cycle and demand even more cash for fraudulent taxes and penalties, again collected through couriers. "Once victims obtain cash and inform the primary scammer they have the funds, the scammer arranges to send couriers to retrieve the cash at victims' homes or public locations. Scammers provide victims with a U.S. dollar bill serial number or another form of code/password," the FBI said. "When the courier arrives, they show the victim the dollar bill or provide the agreed-upon password to authenticate the courier's affiliation with the scammer." The law enforcement agency advised people to research cryptocurrency platforms before investing, not to share their home addresses or deliver cash to unknown individuals, to stop all contact following unsolicited wrong-number communications, and to be alert to "love bombing," an extremely effective manipulation technique used to quickly build false trust with a target. Victims are urged to immediately file a complaint with the FBI and include as much information as possible, including the criminals' names, methods of communication, and bank accounts used in the scam. Two years ago, the FBI also warned that couriers were being used to collect cash in various other scams, including, but not limited to, tech support and government impersonation scams. The FBI's 2025 Internet Crime Report said that U.S. victims lost nearly $21 billion to cyber-enabled crimes last year, noting that investment scams accounted for 49% of all scam-related incidents and resulted in $8.6 billion in losses. Test every layer before attackers do Security teams log 54% of successful attacks and alert on just 14%. The rest move through your environment unseen.The Picus whitepaper shows how breach and attack simulation tests your SIEM and EDR rules so threats stop slipping by detection. Get the whitepaper Related Articles: FBI: Americans lost over $388 million to scams using crypto ATMs in 2025FBI: Americans lost a record $21 billion to cybercrime last yearTelegram Mini Apps abused for crypto scams, Android malware deliveryFBI links cybercriminals to sharp surge in cargo theft attacksPolice dismantles 9 crypto scam centers, arrests 276 suspects

Entities

Fraudsters (threat_actor)Scammers (threat_actor)