ELDER FRAUD - FBI + NY ATTORNEY GENERAL

The story is always the gold. Read the chain backwards and it starts in a browser.

A stranger collecting gold bars from a doorstep is what makes the news. The step nobody reports is the first one, weeks earlier, and it is the only one anything can be done about.

SB

SafeBrowz Threat Research Security Research · 15 September 2026 · 9 min read

The chain, as the Attorney General set it out

New York Attorney General Letitia James published a warning about this on 7 August 2026, and the value of it is that she wrote down the whole sequence rather than just the ending. It runs like this.

1. A fraudulent pop-up appears on the computer, built to look like a legitimate security warning.
2. It claims the machine or the financial accounts have been compromised or linked to criminal activity.
3. The victim is persuaded to grant remote access.
4. With that access, the scammers fabricate hacking activity on the device, so the victim watches proof of the thing they were just told.
5. They are handed to someone posing as law enforcement or a government investigator.
6. That person says the accounts are compromised and instructs them to withdraw their savings and buy gold bars from legitimate dealers.
7. They are told to keep it secret, and to hand the gold to couriers who will come to them.

Two things in that list deserve more attention than they usually get. Step four is not decoration: the victim is shown manufactured evidence on their own screen, which converts a claim into something they have personally witnessed. And step six routes the money through a legitimate dealer, so the transaction itself is real and lawful. Nothing illegal happens until the doorstep.

NYPD has investigated over 100 such cases in two years, with losses passing $100 million. The Attorney General's own words on it: "Targeting older adults with seemingly legitimate claims that their life savings are in immediate danger is flat-out cruel."

What the federal numbers say, and what they imply

The FBI's 2025 Internet Crime Report gives gold couriers a category box of their own, under a heading worth quoting because it names the entry point too: "Scammers Use Couriers to Retrieve Cash and Precious Metals from Victims of Tech Support and Government Impersonation Scams."

• Approximately 725 complaints, $311.8 million in reported losses, in 2025.
• Work that out per complaint and it is roughly $430,000.
• The same report records 201,266 complaints from people aged 60 and over, totalling $7.7 billion, an average near $38,000.

So a gold courier case costs its victim around eleven times what a typical older-adult fraud case costs. Set it against government impersonation as a whole, about 32,000 complaints and $798 million, and the gap is wider still, roughly seventeen times the per-case average.

That is not a scam that is merely larger. It is a scam engineered to take everything, once, from a small number of people. Seven hundred and twenty-five complaints is a tiny number by IC3 standards. The money is not.

Why gold, and not a wire

This is the question worth sitting with, and the answer says something uncomfortable about how fraud adapts.

Consider what the old endings ran into. A large cash withdrawal now draws questions at the counter, and bank staff in many places are trained specifically to ask them. A wire transfer leaves a record and can sometimes be recalled if it is reported fast enough. Gift cards became so notorious that retailers put warning signs by the rack. Each of those interventions was built because the fraud was happening.

Gold walks past all of it. Buying bullion from a licensed dealer is an ordinary, lawful investment decision, and a person doing it is not behaving suspiciously by any measure a bank or a shop would apply. Once a bar is handed over at a front door, there is no payment rail to reverse, no chargeback, no intermediary holding the funds for a few hours, and frequently nothing to trace.

So the gold is not theatre. It is the point. The scheme moved to a physical asset precisely because the financial system got better at catching the alternatives, which is the same adaptation logic behind couriers collecting cash from investment-fraud victims, a related pattern the FBI has warned about separately.

The instruction that does the most damage

Of all seven steps, the one most likely to decide the outcome is the quietest: tell nobody.

And the Attorney General's wording is more specific than "keep it quiet". Victims are instructed to keep the matter confidential and not discuss it with bank employees or family members.

Read that list again, because it is not a general warning. It names the exact two people who would end this. The bank teller processing an unusual withdrawal, and the adult child who would hear the story and say the obvious thing. Neither needs to be an expert. They only need to be outside the pressure and react normally.

So the secrecy is not a precaution attached to a fake investigation. It is a targeted removal of the two defences that actually work, which is also why these cases run for weeks instead of hours.

Which makes the Attorney General's advice better than it first sounds: "a scam is effective because the scammer creates a false sense of urgency, pressuring the victim into life-altering decisions on the spot and swearing them to secrecy. The best way to combat this is to hang up and contact someone you trust and let them know your situation." Note that she puts the secrecy and the urgency together, as two halves of one mechanism. Hanging up is not rudeness here. It is the countermeasure.

The one rule that needs no judgement

Most scam advice asks you to assess something. This one does not, which makes it worth memorising and worth repeating to a parent.

No government agency will ever ask you to buy gold, cash, cryptocurrency or gift cards to protect your own money, and none of them will send anyone to your home to collect it. There is no protective custody arrangement for a private citizen's savings. It does not exist.

That rule holds no matter how good the rest of it looks, and the rest of it does look good: a badge number, a case reference, a caller ID showing a real agency, a website that matches. None of that has to be evaluated, because a genuine agency never makes the request in the first place. The same single-rule test applies to Social Security impersonation calls, where no real agency threatens to suspend your number.

Where a browser tool fits, and where it plainly does not

This one needs an unusually honest scope, because most of this scam is somewhere we cannot reach.

We cannot hear a phone call. We cannot tell whether the man claiming to be a federal investigator is real. We cannot stop a purchase at a gold dealer or a handover at a door, and no browser extension can. From step three onward this stops being a web problem, and pretending otherwise would be dishonest about what software does.

Step one is different. The fraudulent security pop-up is a web page, and it is the single moment in the chain that is both visible to a browser and weeks ahead of any money moving. Layer 1 runs generic URL-shape checks locally before a page renders, and to be accurate it is not the layer doing the work here. Layer 2 checks the address server-side against reputation sources, our blocklist and a brand database of more than 550 names, which is what catches pages dressed as Microsoft or Apple security alerts. Layer 3 is the AI deep scan, one free scan a day for everyone and unlimited on Premium at $14.99 a year across up to three devices.

Worth noting that Layer 3 is unusually well suited to this one, which is not always true. A scareware page's deception is its content: a fake infection warning and a phone number to call, written to be read. There is something for a content scan to find, which is the opposite of a cloned business page where every word is genuine and only the ownership is a lie.

Blocking a scareware page usually feels like a small thing, because a pop-up is not dangerous by itself. In this chain it is not a small thing. It is the doorway, and it is the last point at which the person being targeted has not yet been told to stop talking to their family. Our existing write-ups on fake Microsoft support pop-ups and the wider tech support playbook cover that first step in detail; this post is about where that step now leads.

If it has already happened

Speed matters, and so does dropping the secrecy immediately.

Tell a family member or a friend today, even if the caller said not to. That instruction was the scam protecting itself, and it stops mattering the moment you decide to ignore it.

Call the bank that the withdrawal came from and say plainly that it was fraud, then report it to the FBI's Internet Crime Complaint Center at ic3.gov and to the FTC at reportfraud.ftc.gov. Report it to local police as well, because these are physical handovers and there is sometimes a courier to identify, which is how arrests in these cases tend to happen.

Then expect a second wave. People who have lost money to this are contacted again by supposed recovery services, and that follow-on fraud is its own tracked category, covered in our piece on scammers impersonating the IC3 itself. Nobody who contacts you first can get your money back. Our step-by-step recovery guide sets out the rest in order.