Barbara Kearns was doing something ordinary when the scam began. The 87-year-old Mountain Home, Arkansas, grandmother was checking email and playing solitaire when her computer screen turned red and alarms began blaring.
A message told her to call Microsoft. Kearns called because she believed she was reaching a company she could trust, according to KTLO.
That call eventually moved from a frightening computer warning to bank withdrawals, photos of cash, and two courier pickups at her home. By the time someone outside the scam realized what had happened, Kearns had lost $71,000.
Investigators later said the money was taken through a fake Microsoft and Federal Reserve scheme. A California man, Wenyan Song, has been charged with felony theft in connection with one of the cash pickups, according to the Baxter County Sheriff’s Office.
The Red Screen Appeared During Solitaire
Kearns started Feb. 28, 2025, with her usual computer routine. Then a red screen appeared, sirens sounded, and the message told her to call a number that appeared to be connected to Microsoft.
KTLO reported that she panicked and thought the computer might blow up. When she called the number, the person on the phone claimed to be with Microsoft’s “Identity Theft Department,” according to the sheriff’s office.
The caller, who used the name “Jack,” stayed in contact with her for days. Investigators said he worked to gain her trust and isolate her from people in the community who might have helped her recognize the scam.
The First Courier Took $33,000
By mid-March, the caller had convinced Kearns that hackers were trying to steal her money and that her savings would only be safe if placed with the Federal Reserve.
Kearns closed a local savings account and withdrew $33,000 in cash. She was told to bring the money home, spread it on a table, take photos of the cash and her driver’s license, and package the money.
The sheriff’s office said a supposed Federal Reserve courier came to her home on the morning of March 17 and collected the cash using a fake code word arranged by the caller.
Afterward, Kearns was told the money was secure at the Federal Reserve in St. Louis. KTLO reported that she later received what was presented as a letter of authenticity.
A Second Account Was Liquidated
The first pickup did not end the calls. The scammers stayed in contact and later learned Kearns had another investment or retirement account.
They persuaded her that those funds were also at risk. She liquidated the account, went back to the bank, and withdrew another $38,000.
A second courier came to collect that money using essentially the same process. Investigators later identified Song as the man accused of making the second pickup.
A Roofer Heard the Story and Called Police
Kearns did eventually question part of the story. After being told her first withdrawal was safe at the Federal Reserve in St. Louis, she called the institution and learned that it does not accept deposits from individual customers.
The scam still did not stop right away. KTLO reported that another call followed about her teaching retirement money.
The conversation that finally broke through came from an unrelated home repair. After a storm damaged her roof, Kearns called a roofer for an estimate. She explained that she only had an insurance check and did not know if she had enough money left to cover the rest of the repair.
When the roofer heard what had happened to her savings, he told her she had been scammed and asked permission to contact law enforcement.
Investigators Later Identified a Courier
Officer Scott Thrasher began investigating in May. Investigators later learned about a similar case in the Eureka Springs and Holiday Island area, where law enforcement had arranged a sting for another cash pickup.
Song was arrested during that Carroll County operation, according to the Baxter County Sheriff’s Office. Investigators then worked with the U.S. Department of Homeland Security to obtain rental-vehicle information and GPS records tied to the vehicle Song had been driving.
The sheriff’s office said the GPS data placed the vehicle near the Baxter County victim’s residence on the dates she reported the courier pickups. When Thrasher later showed Kearns a photo lineup, KTLO reported that she immediately identified Song.
Song, also listed as Wenyuan Song, was booked on a felony theft-of-property charge and held on a $75,000 cash-only bond, according to the sheriff’s office. The charge remains pending unless and until resolved in court.
Police Recovered Some of the Money
Kearns initially thought there was little chance of getting any of her savings back. Investigators continued pursuing people described as money mules in related scams, and KTLO reported that authorities eventually recovered some of her money.
The amount returned to Kearns has not been publicly disclosed. The full $71,000 has not been reported as recovered.
KTLO reported that Kearns has relied on family, friends, and church support after the scam. She still plays solitaire, but said she plans to pull the plug on her computer if anything like the red-screen warning appears again.
No Federal Reserve Courier Is Coming for Cash
The Federal Reserve says it will never contact the public through an unsolicited phone call or email asking for money or personal information. It also does not take personal deposits from consumers.
A real bank, tech company, government office, or Federal Reserve employee will not tell someone to withdraw cash, photograph it with a driver’s license, package it, and hand it to a courier at home.
Anyone who sees a sudden computer alert with a phone number should not call the number on the screen. Shut down the browser or device, use another phone or computer to contact a trusted relative, bank, or local police department, and look up company contact information from an official website.
If money has already been handed to a courier, victims or relatives should save bank withdrawal records, phone numbers, call logs, screenshots, letters, photos, packaging instructions, courier descriptions, vehicle details, doorbell or security video, and any code words used during the pickup. They should report the theft to local law enforcement, the bank, and the FBI’s Internet Crime Complaint Center.