The disappearance of 84-year-old Nancy Guthrie, the elderly mother of “Today” show Co-Host Savannah Guthrie, was already a deeply unsettling case. But the messages that surfaced in the midst of it all gave the story an even darker edge.
The First Note Set the Clock Ticking
By the time the first ransom message arrived, Nancy had already vanished from the quiet routines of her Tucson life. The email came roughly a day after she was abducted.
It claimed that Nancy was “safe but scared.” Those three words were brutal in their own way. They suggested fear, but also survival.
For a family desperate for proof that Nancy was alive, the phrase may have seemed like the smallest possible thread to hold onto. But the rest of the message was not tender; it was cold, calculated, and built around a deadline.
The sender demanded $4 million in Bitcoin. If the family paid by 5 p.m. on February 5, 2026, the note said, Nancy’s return would be arranged. Then came the pressure. The sender reportedly warned that the price was only a one-time offer. If the ransom was not paid within four days — by February 9 — the demand would rise to $6 million.
It was the kind of demand designed to make people panic. There was no room for negotiation. No soft landing. No obvious way to know whether the person writing it was telling the truth. Then, at the end, came the two words that made the message feel even more sinister: “Or else.”
Five Days Later, Hope Changed Shape
The first note had created a countdown, while the second one changed the entire meaning of the clock. On February 6, another email arrived from the same IP address as the first message. To investigators, that mattered. This did not look like a random voice trying to insert itself into a high-profile case. It appeared to be connected to the first demand.
Those close to the task force came to know it as the “bad” email, and unlike the first message, this one did not keep the same harsh confidence. It opened with what a source close to the case described as a rambling “apology.” It was not an “apology” for taking Nancy; it was supposedly an “apology” for Nancy’s inadvertent death.
With that, the search entered a darker room. Until then, the public story had been a kidnapping: a missing mother, a ransom demand, a family pleading for contact, investigators racing against time.
Then the FBI Reportedly Found Something That Changed the Picture
At first, those notes appeared credible, suggesting that Nancy had been abducted and that someone was making demands. Now, according to Reuters, federal investigators have reportedly determined that all three kidnapping-related messages are fake.
That includes the two ransom notes reported in early February, just days after Nancy vanished. It also includes a third, more recent message from someone claiming to know who the kidnappers are.
The FBI official who spoke to Reuters did so anonymously because the investigation remains active. “None of the ransom notes are believed to be genuine,” the official said.
A second law enforcement source familiar with the matter reportedly confirmed the FBI’s assessment. The disclosure is striking because the notes had helped shape the public understanding of the case. Until now, much of the outside attention has centered on a possible kidnapping for ransom.
The reported FBI finding appears to raise questions about that premise. If the notes are fake, then one of the most frightening pieces of the story may not have come from anyone connected to Nancy’s disappearance at all. That does not make the case any less serious. But it does make it far more mysterious.
The Pima County Sheriff’s Department is leading the overall investigation. A spokesperson for the department, Angelica Carrillo, declined to comment on the ransom-note developments, citing an agreement to refer all questions about those messages to the FBI.
“We don’t have any updates, other than this is still an active investigation,” Agelica said. She added that DNA samples and video evidence collected in the case “remain under forensic analysis.”
So, while the ransom-note angle has reportedly been discounted, the case itself is far from closed. And the question at the center remains brutally simple: what really happened to Nancy?
Before the FBI reportedly reached its conclusion, the ransom notes had already drawn intense attention. All three messages were initially delivered to media outlets. Those outlets reportedly included celebrity news site TMZ. Only after that were the messages turned over to authorities for review.
The first two notes were widely described as communications from kidnappers. That framing suggested a familiar but terrifying scenario: a missing elderly woman, a demand for money, and investigators racing to find whether the threat was real.
The FBI took the lead in examining any alleged ransom notes or other suspect communications in the case. For a time, the agency had declined to publicly say whether any of the messages under review were credible. That silence left the public with more questions than answers: Were the notes legitimate?
Were investigators negotiating behind the scenes?
Had someone truly taken Nancy and attempted to profit from her disappearance? According to Reuters, investigators eventually determined that the first two notes came from the same sender. However, the FBI official did not specify how investigators reached that conclusion.
That unanswered point is one of the more intriguing details. The first two notes may have shared a common origin, but that still did not make them genuine. In fact, investigators reportedly concluded the opposite.
The FBI determined that the two notes, despite coming from the same source, were sent by a person or persons not actually connected with Nancy’s disappearance.
A Cryptocurrency Test Added Another Strange Turn
And the way investigators tested them adds another curious detail. Early in the investigation, the FBI deposited a small amount of cryptocurrency into an account, following instructions in the first message.
That move was reportedly meant to test whether the note was real and potentially trace the ransom demand back to whoever sent it. But the money was never taken; it was left untouched in the account. That detail appears to have played a role in the FBI’s conclusion.
According to the official, the untouched cryptocurrency, along with other unspecified investigative methods, helped the FBI determine that the first two ransom notes were fake. In other words, the sender made a demand — but apparently never collected even the test payment.
That is not the behavior investigators expected from someone truly trying to extract ransom money. Regarding the FBI discounting the third note, that message was more recent and, according to TMZ’s report cited by Reuters, came from someone claiming to know the identities of Nancy’s abductors.
The Case Is Still Active, but the Ransom Trail Looks Far Less Certain
The person also allegedly claimed to have video of the “main guy” involved in the kidnapping. Even more disturbing, the person reportedly claimed to have video of Nancy on the day she died. But the FBI official told Reuters that this third note was also deemed fake. However, the official did not reveal how investigators ruled out the third message.
The FBI’s reported assessment changes the public shape of the case. The ransom notes once seemed to point toward a kidnapping-for-money scenario. Now, they appear to point toward something else: someone outside the case allegedly pretending to have information or involvement.
The disappearance remains alarming, and the unanswered questions remain heavy. But the ransom-note trail — the one that seemed to offer a terrifying explanation — now looks like a detour.
The Last Ordinary Evening
As previously reported:
To understand how deeply the ransom messages had fractured the case, it helps to go back to the last ordinary night anyone can place Nancy in the timeline. She was last seen on Saturday night, January 31. She arrived at her daughter Annie’s home at 5:32 p.m. She had dinner there, surrounded by the familiar rhythms of family.
Later that night, she was dropped off at her own home in Tucson, Arizona, at around 9:48 p.m. Her son-in-law, Tommaso Cioni, waited until Nancy was safely inside before driving away.
At 9:50 p.m., her garage door closed. That detail, small and precise, became one of the last markers of Nancy’s known life before the mystery began. The garage door closed; Nancy was believed to be home; the night should have ended there. But sometime after that, the trail began to twist…
The House Began Telling Its Own Story
In the early hours of February 1, the first strange signs appeared. Nancy’s doorbell camera disconnected at 1:47 a.m. Around 25 minutes later, software detected someone — or possibly an animal — on a camera. Then, at 2:28 a.m., Nancy’s pacemaker app disconnected from her phone.
Each detail, taken alone, might have left room for uncertainty. Together, they formed a troubling pattern. By Sunday morning, Nancy had not appeared at church. For those who knew her routine, that absence was enough to raise an alarm.
A friend contacted Nancy’s family. They checked on her and then notified the sheriff’s department around noon.
Police arrived at Nancy’s home at 12:15 p.m. and determined that she was missing under “concerning” circumstances.
The concern was immediate. The 84-year-old had limited mobility and relied on daily medication. This was not a woman who could easily disappear into the world without help. The house, the disconnected technology, and her absence from church all seemed to be saying the same thing: Something was wrong.
‘She Didn’t Go Willingly’
On February 2, Pima County Sheriff Chris Nanos publicly confirmed that Nancy’s disappearance was being treated as a crime. He urged neighbors to check home surveillance footage. Investigators had found things at Nancy’s home that concerned them. Then Nanos said the words that sharpened the entire investigation:
“She didn’t walk from there. She didn’t go willingly.”
That statement changed the emotional temperature of the search. Nancy was no longer simply missing; she had been “abducted.” Authorities believed someone had taken her. The quiet Tucson home was now a crime scene, and the woman at the center of it was in danger. A missing person’s flier, describing
Nancy as five feet, five inches tall, with brown hair and blue eyes and weighing 150 pounds, was released.
Blood at the Door, Bitcoin in the Message
By February 3, the clues had become more alarming. Authorities said they were analyzing an apparent ransom note that included details about what Nancy had been wearing on the night of the crime. The note demanded payment in Bitcoin. At the same time, investigators were looking at what appeared to be drops of blood outside the front door.
A law enforcement source shared that blood was also found inside the house. The blood outside the home was later confirmed to be Nancy’s. That detail took away some of the case’s remaining softness. This was not only a disappearance; it may have involved violence, or at least injury, near the threshold of Nancy’s own home.
Still, there was no suspect. Surveillance video had not yet given investigators the answer they needed. Sheriff Nanos said nothing had come up that clearly identified “your bad guy.” The case had evidence; it had fear; it had urgency. But it did not yet have the face of a suspect.
The First Public Plea
On February 4, the investigation still had no identified suspect or person of interest. That night, the FBI returned to Nancy’s home with canines, working through leads in the dark.
At the same time, Savannah and her siblings made their first major public appeal. In the video, Savannah addressed the possible captor or captors and asked for proof that Nancy was alive. She said:
“We live in a world where voices and images are easily manipulated. We need to know without a doubt that she is alive and that you have her.”
It was a journalist’s sentence and a daughter’s sentence at the same time. She understood deception; she also needed hope. Savannah said the family was ready to listen and asked whoever had Nancy to reach out. Then she spoke about her mother’s fragile health.
Nancy, she said, lived in constant pain and was without the medicine she needed to survive and not suffer. Savannah also spoke directly to Nancy: “Mommy, if you are hearing this, you are a strong woman.”
At that moment, the family’s public message was clear: Show us she is alive, and tell us how to bring her home. The next messages would make that plea far more complicated…
The First Deadline Drew Near
On February 5, the ransom demand reached its first critical moment. Sheriff Nanos said at a news conference that authorities believed Nancy was “still out there.” FBI Special Agent Heith Janke confirmed that the note included a 5 p.m. deadline. He said that if a transfer was not made, there appeared to be a second demand for the following Monday.
He would not say what the note claimed would happen if the demands were ignored. That omission made the silence more frightening. The FBI announced a $50,000 reward for information leading to Nancy’s recovery or to the arrest and conviction of those involved. Authorities kept asking for tips. They said it could take just one piece of information to break the case open.
That evening, Camron made another plea for contact. He said the family had not heard directly and needed a way to communicate. It was a family trying to open a line to the person who had taken their mother. But the next day, a message came…and it was not the kind anyone had prayed for.
The ‘New Message’ Arrived
On February 6, CBS News’ Tucson affiliate, KOLD, received a second message. However, the station did not release details, citing respect for the family and the investigation. Publicly, authorities said they were aware of a “new message” and were checking its authenticity. The Pima County Sheriff’s Department said investigators were actively inspecting the information.
The FBI issued a similar statement. To the public, it was another vague update in a frightening case. But the newer reporting gives that moment a very different meaning. This was reportedly the message that contained the rambling “apology” for Nancy’s inadvertent death.
It was the message that may have turned the investigation from a kidnapping into a potential homicide, and it was the message Savannah appeared to answer the very next day.
The Search Moved from Hope to Terrain
After the second message, the investigation seemed to close in again on physical spaces. On February 7, a few hours after Savannah’s video, investigators went to Annie’s home. That was the home where Nancy had eaten dinner the night before she vanished. They stayed for about two and a half hours and focused mostly on the garage.
Two law enforcement sources said that investigators were “developing good information,” though “nothing is imminent.” The phrase was maddening. It suggested movement, but not resolution.
On February 8, detectives were back at Nancy’s home. They focused on the backyard perimeter and searched what appeared to be a septic tank. It was the kind of search detail that tells readers what officials could not yet say. Investigators were no longer only looking for a person; they were looking for traces.
‘An Hour of Desperation’
By February 9, the search had entered its second week. A second ransom deadline was looming. Investigators were canvassing nearby gas stations, looking for suspicious vehicles caught on surveillance cameras around the time Nancy vanished. A sheriff’s deputy was placed outside Nancy’s home around the clock.
The case was now both a crime investigation and a protected scene. That afternoon, Savannah asked the public for help again. She said the family was at “an hour of desperation.” She told people that law enforcement was working tirelessly to bring Nancy home and asked anyone, even far from Tucson, to report anything strange.
The plea carried a new urgency. The family had already received messages; investigators had already found blood; the clock had already moved past the first demand, and still, Nancy had not been found.
A Face Without a Name
On February 10, authorities finally released images and video of a subject in Nancy’s disappearance. The figure was masked, gloved, and carrying a backpack.
The footage had been recovered from Nancy’s home security camera system after initially being inaccessible. One video showed the individual approaching the front door and raising a gloved hand toward the camera. Another showed the person holding a flashlight in their mouth before covering the camera lens with vegetation. The person appeared to be armed.
For the first time, the public could see a figure connected to the mystery. But seeing someone was not the same as knowing who he was. Savannah responded to the images by writing: “We believe she is still alive. Bring her home.”
Hours later, a subject was detained during a traffic stop south of Tucson and questioned in connection with the case. It looked, briefly, like the investigation might have found its way to a person. But the story did not settle there…
The Man Who Said He Was Innocent
On February 11, a man who said he had been questioned as a person of interest spoke to reporters after being released. He identified himself only as Carlos, and said he did not know Nancy.
“I didn’t do anything. … I’m innocent,” he stated. Authorities did not confirm that Carlos was the person of interest or that the person of interest had been released. A woman in Rio Rico, Josefina Maddox, also spoke outside a home authorities were searching.
She said her son-in-law had “nothing to do with it.” She added that authorities were “just invading my property” and insisted, “we’re not hiding anything.” The public had seen a possible suspect image, heard about a detention, and then watched certainty dissolve again. The mystery remained open.
The Backpack Trail
On February 12, the FBI released the first physical description of the suspect. He was described as a male of average build, approximately 5-foot-9 or 5-foot-10. The black 25-liter Ozark Trail Hiker Pack backpack seen in the doorbell footage became an important clue. The FBI doubled its reward to $100,000 for information leading to Nancy’s location or to an arrest and conviction.
Around that time, investigators were also examining black gloves found during the search. The gloves appeared to resemble those worn by the figure in the video.
For investigators, the case seemed to move through objects: a backpack, gloves, a mask, a camera, a door, a pacemaker signal. Each object carried the possibility of a name. But each one still had to prove it belonged to the story.