FBI investigating legitimacy of Nancy Guthrie ransom notes

Who is behind the ransom notes tied to Nancy Guthrie’s kidnapping? That question continues to plague investigators working the case in Arizona, five months after the 84-year-old grandmother and mother of “Today” show co-host Savannah Guthrie was kidnapped in the middle of the night.

The notes fall into three categories: the two notes sent within the first week of her disappearance that investigators believe are likely legitimate, those that could be legitimate but that don’t have any clues suggesting they are, and those that authorities say are money grabs from would-be extortionists.

“The FBI and its task force partners have received several ransom notes over the course of this investigation,” an FBI official said Wednesday in a statement to CBS News. “Some have been deemed to be extortion attempts without legitimacy. Other ransom demands may potentially be legitimate and are still being investigated as such.”

The FBI official said the agency is assisting local authorities, namely the Pima County Sheriff’s Department, which is the lead agency on the case. Law enforcement sources have told CBS News that the FBI has been handling the digital forensic work on the ransom notes. Pima County Sheriff Chris Nanos has directed all questions about ransom notes to the FBI.

“This case continues to be investigated as a kidnapping for ransom case,” the FBI official said Wednesday.

A banner in support of Nancy Guthrie is displayed at KVOA in Tucson, Arizona, on March 3, 2026.Grace Hie Yoon/Anadolu via Getty Images
The first note, sent on Feb. 2, one day after Nancy Guthrie was reported missing from her home in Tucson, included details about Guthrie’s home that led investigators to take it seriously. One of the details described the placement of Guthrie’s Apple Watch with a white wrist band that was left on the floor next to her bed. Another detail noted that a floodlight on the back porch was out. The note demanded an initial $4 million in bitcoin within a few days’ time, and then upped the ante by $2 million more in bitcoin if the first deadline was missed.

The ransom message was sent via tip lines to two local news stations and TMZ. A Gmail address was entered as the contact email and addressed to Savannah Guthrie, multiple sources familiar with the note have told CBS News. The family worked with the FBI to craft a response, but there was no email back.

Then on Feb. 6, four days after the first communication came in, another one came through the tip lines. The FBI later determined it came from the same IP address as the first note, law enforcement sources told CBS News. This note indicated that Nancy Guthrie had died.

Savannah Guthrie and her siblings responded with a video message at the time, saying: “We received your message and we understand… This is very valuable to us and we will pay.” But they never heard from the potential kidnappers again.

“There are a lot of different notes, I think, that came,” Savannah Guthrie told Hoda Kotb in an interview in March. “And I think most of them, it’s my understanding, are not real. … But I believe the two notes that we received that we responded to, I tend to believe those are real.”

TMZ’s Harvey Levin on messages passed on to FBI
As the days went on, TMZ continued to receive tips that the outlet passed on to the FBI. One note caught the eye of TMZ founder Harvey Levin. It demanded 1 bitcoin, or about $60,000, for information about the kidnappers.

“A month ago, I called the FBI and I said, ‘Look, I just have this sense this guy might be real,'” Levin told CBS News in an interview last week.

The messages continued to come in, and Levin said he shared them all with the FBI, about a dozen messages in total. At one point, Levin said, the FBI indicated they believed the sender might be female.

Levin said he told the FBI, “What if we do a documentary, and we put that money in the bitcoin address and follow the path and where it goes? And we’d obviously not do anything without you, but just because we have this sense it’s real, what if we do this?”

“I had made six calls and I felt they were ghosting us,” Levin said. But the FBI eventually got back to him, Levin said, asking that he not follow through on the documentary idea because they felt they were close to identifying the sender.

In the most recent message Levin received from the individual last week, Levin said the sender wrote that a video of Nancy Guthrie was on a cellphone in a secure place, and the sender again demanded 1 bitcoin in exchange for information.

There is no indication the messages sent to TMZ are legitimate, and it is unclear how close the FBI is to identifying the sender. In response to CBS News’ request for comment on Levin’s statements, an FBI spokesperson referred to the official statement released Wednesday.

In an early instance of what authorities believe to have been an extortion attempt, federal prosecutors charged a California man with sending a fake ransom note via text message to Savannah Guthrie’s family. Derrick Callella allegedly texted them, “Did you get the bitcoin were [sic] waiting on our end for the transaction,” according to the charging documents. Callella has pleaded not guilty.

Callella’s next hearing is scheduled for July 2 at the federal courthouse in Tucson.

The Guthrie family is offering a $1 million reward for any information that leads to the whereabouts of Nancy Guthrie. The FBI is also offering a $100,000 reward and encouraging anyone with information to call 1-800-CALL-FBI (1-800-225-5324).