Ex-FBI Agent Says She Got Four Bitcoin Ransom Emails in Nancy Guthrie Case, Warns Public of Possible Scam

TUCSON, Ariz. — A former FBI agent says she received four emails demanding bitcoin in exchange for the release of Nancy Guthrie, the missing mother of "Today" co-anchor Savannah Guthrie, and is warning that scammers may be trying to profit from public concern over the case.

Jennifer Coffindaffer, a retired FBI special agent and law and justice contributor for NewsNation, said she received the messages in April but initially kept quiet, reporting them only to the FBI. She said the bureau told her the bitcoin address in the emails did not match the address in ransom notes investigators believed to be legitimate.

Coffindaffer said she believes the messages were sent by people seeking to take advantage of those following the case, not by anyone responsible for Guthrie's disappearance.

She said she decided to speak publicly because she worries others who care about Guthrie's fate could be targeted and "lured to make a deposit."

"That's the reason I wanted to come forward because I was concerned that now other people might be contacted and might fall for the ploy," Coffindaffer said.

What the emails said

Coffindaffer told Newsweek the four emails arrived over the course of two days to a personal email address. They demanded payment in bitcoin for Guthrie's release and included an image appearing to depict Guthrie that Coffindaffer described as artificially generated.

She described the image to NewsNation as showing a woman resembling Guthrie with a shaved head, dirt on her face and a tear running down her cheek.

Two of the emails demanded 25 bitcoin, while a later message lowered the demand to 2 bitcoin, according to reporting based on the messages reviewed by Newsweek. One message claimed the sender could bring Guthrie home within 12 hours if paid.

Coffindaffer said she did not engage with the sender.

"I never responded to any of them," she said.

The authenticity of the image has not been established, and the emails do not provide verified information about Guthrie's condition or whereabouts.

Personal email and religious appeals

Coffindaffer said she was troubled that the messages reached an email account she does not use for work and believed was not publicly known.

"They found my personal email address," she said, explaining that she has five email accounts and uses all but one for business.

She said others she asked to look into how the address might have been found were unable to locate it through searches. She said she believes she may have been targeted because of her public commentary on the investigation.

Coffindaffer also said the emails contained Bible verses that appeared designed to appeal to her faith.

"I'm pretty religious, I'm a devout Catholic, and they certainly worked that angle in their ransom notes to me," she said.

She said she believes the senders may be part of an organized group. That assessment has not been confirmed by investigators.

Similar note sent to neighbor

Coffindaffer said she went public after learning that Guthrie's neighbor, Lauren Serpa, had received a similar message.

Serpa said she received a ransom demand in late September that claimed Guthrie was alive in Mexico and directed her to send bitcoin in exchange for her release. That message reportedly included an image nearly identical to the one sent to Coffindaffer.

Coffindaffer said she discussed the notes with Serpa, and the two determined that the bitcoin wallet addresses in the messages they received matched each other.

Authorities warn of scams

The Pima County Sheriff's Department has said recent ransom messages are not credible, has warned the public about potential scams and has said the investigation into Guthrie's disappearance remains active.

On Sept. 29, the department said the joint sheriff's office and FBI task force investigating the case had been made aware of a new possible ransom text message related to the investigation.

The Guthrie case has drawn several purported ransom demands since her disappearance. Earlier in the investigation, TMZ reported receiving emails from a person demanding bitcoin in exchange for the name of Guthrie's alleged kidnapper. The outlet said no bitcoin was exchanged, and a former FBI official said at the time that he suspected a scam.

The investigation

Nancy Guthrie, 84, disappeared from her home in the Catalina Foothills area near Tucson early this year. Authorities have been investigating her disappearance as a kidnapping for ransom.

In the months since, a suspect has not been publicly named, and Guthrie has not been found.

The case has drawn sustained national attention, in part because of her daughter's prominence as a co-anchor of NBC's "Today" show. The FBI has publicized the search, including through billboards in other states seeking information.

Advice for the public

Law enforcement officials and fraud experts have long warned that high-profile missing-person cases can attract scammers who exploit public sympathy or a family's desperation for answers.

Cryptocurrency is often used in such schemes because payments can be difficult to trace or reverse once sent.

Anyone who receives a message claiming to have information about Guthrie or demanding payment for her release should not send money, should preserve the original message and should report it to law enforcement rather than engaging with the sender.

Tips in the Guthrie investigation can be submitted to the FBI or the Pima County Sheriff's Department.

Coffindaffer's account has not been independently verified, and authorities have not publicly identified who sent the emails or confirmed any connection between the senders and Guthrie's disappearance.