A forensic psychologist has cast serious doubt on two purported ransom letters in the Nancy Guthrie disappearance, telling investigators the case looks more like a home break-in that spiraled out of control than a planned kidnapping.
Dr. Kris Mohandie, a forensic psychologist who reviewed the letters tied to the 84-year-old Tucson woman's suspected abduction, told Fox News Digital he does not believe either note is genuine. Guthrie, the mother of "Today" show co-host Savannah Guthrie, has been missing since the beginning of February 2026. No one has claimed the more than $1.2 million in reward money posted in the case.
The Pima County Sheriff's Department released the grammar and punctuation of the two notes publicly on Friday, July 31, a move Mohandie endorsed even as he questioned the letters' credibility. Investigators want the public to study the writing style and help identify the author. The sheriff's department said it believes the notes' "distinctive linguistic characteristics may be recognizable to someone who knows or has interacted with the notes' writer," the Washington Examiner reported.
Mohandie zeroed in on specific problems with the first letter, which demanded $4 million in Bitcoin and was sent not to the family but to a news outlet, CBS Tucson affiliate KOLD-TV, on February 2, one day after Guthrie vanished. The note gave Savannah Guthrie until February 9 at 5 p.m. to pay or her mother would be killed.
The letter shifted between "we" and "I" pronouns, a detail Mohandie flagged as a sign of inauthenticity. He told Fox News Digital:
"I certainly question the legitimacy of the so-called ransom note in which the individual is sending it to a news outlet, saying this will be a ransom, so on and so forth, talks about 'we' and then breaks into 'I' in terms of pronouns. There are a lot of things wrong with that ransom note, and it raised a lot of questions for me of veracity."
A second letter followed days later. It claimed Guthrie had "perished", and included what amounted to an apology. That note stated the abductors "never intended to hurt her," that her death was "heart related," and that she was "buried in nature," as Breitbart reported.
Both letters referenced details not widely known to the public, including damage near Guthrie's property and personal items she had with her when she disappeared, such as her Apple Watch and a broken floodlight. Investigators initially treated those details as potential evidence the writer had direct knowledge of the crime. Mohandie was not persuaded.
"I don't make much out of those two details," he said. "They seem to be details that inadvertently could have gotten to somebody, and so that's not enough for me to say, this is something only the killer would know."
Mohandie's broader theory rests on more than the letters. FBI-recovered doorbell camera footage from Guthrie's Tucson home showed a masked individual with a black Ozark Trail backpack and an apparent holstered weapon attempting to disable the camera at 1:47 a.m. on February 1. The suspect stood roughly 5 feet 9 inches to 5 feet 10 inches tall with an average build. He remains unidentified.
Guthrie had been dropped off at her home at 9:50 p.m. on January 31, National Review reported. Bloodstains confirmed to be hers were found at the scene. Paulette Sutton, a retired bloodstain pattern analyst with more than 40 years of experience, described the pattern as a "drip trail", "a continuous source of blood dripping from an object or from a person," consistent with a bleeding individual, possibly from a bloody nose.
To Mohandie, the footage and the physical evidence point away from a coordinated ransom operation. He offered a blunt assessment of what he believes happened.
"Unfortunately, I think this case is a simple matter of a burglary gone wrong and then attempts to cover things up. But that's a hypothesis and good investigators are investigating all hypotheses and following leads, and I think they're doing their job here."
If Mohandie is right, the ransom letters were written after the fact, not by kidnappers holding a hostage, but by someone trying to muddy the trail. That distinction matters. A genuine ransom case implies a living victim and a negotiation. A staged ransom note after a fatal break-in implies a cover-up.
The case has already produced one confirmed fraud. Derrick Callella sent imposter ransom demands to the Guthrie family in early February 2026. He pleaded guilty, and a judge ordered him into inpatient treatment before sentencing. His communications were separate from the two letters now under scrutiny.
Callella was not the only opportunist. Additional purported ransom notes surfaced months later, sent to TMZ and timed to coincide with Savannah Guthrie's emotional return to the "Today" show. Those notes, from an anonymous sender who demanded one Bitcoin, roughly $71,000, contradicted themselves, claiming Guthrie was dead in one passage and alive in the Mexican state of Sonora in another. Former FBI agent Jennifer Coffindaffer called the sender a scammer, noting the demand for $71,000 made no sense when a $1.2 million reward was already on the table.
"They sent these right when Savannah Guthrie went back to work," Coffindaffer said. "That was by no mistake, that was absolutely meant to further torment her and her family."
The flood of fraudulent and questionable ransom communications has complicated an already difficult investigation. Investigators must chase every lead, even the ones that look like hoaxes, because dismissing the wrong one could mean missing the real thing. Mohandie acknowledged as much, pointing to the Unabomber case as precedent, the FBI's decision to publish Ted Kaczynski's manifesto ultimately led to his identification.
"I understand why law enforcement needs to investigate these as potential leads, and it is a strategy that has worked. You look at Ted Kaczynski and putting that out there on the Unabomber case is what led to it being resolved. So they need to put that out there. Maybe somebody does recognize something unique in these writings."
Nancy Guthrie has now been missing for roughly six months. The FBI's Phoenix field office has been involved from the early stages. Heith Janke, then the special agent in charge of that office, sat down with Savannah Guthrie and other family members early in the case to record a video response to the first ransom note. Janke has since left that role.
Investigators are pursuing a digital trail tied to the ransom communications, hoping to identify the sender or senders and potentially bring criminal charges. Federal authorities have been enlisted to help trace the origin of the notes. Meanwhile, the sheriff's office has cited a lengthy DNA and digital evidence review as the investigation passes the six-month mark.
The case has also generated friction within the agencies handling it. A Pima County official has said the sheriff rebuked her for sharing a case tip directly with the FBI, a claim that highlights tensions between local and federal investigators working the same case.
Separate from the investigative disputes, two men detained during the kidnapping probe have filed a $3.25 million claim against the Pima County sheriff, adding a legal dimension to an already sprawling case.
The Pima County Sheriff's Department is asking anyone who recognizes the writing style in the released notes to call 520-88-CRIME. The FBI tip line is 1-800-CALL-FBI. The total reward, over $1.2 million, remains unclaimed.
Mohandie, for his part, said investigators are right to keep every theory alive. "A good investigation keeps an open mind," he said. "It really does." But he was equally direct about where the evidence, as he reads it, actually points: not toward a ransom plot, but toward something uglier and simpler, a break-in that went fatally wrong, followed by someone's attempt to throw investigators off the trail.
An 84-year-old woman is still missing. A masked figure on a doorbell camera is still unidentified. And more than $1.2 million in reward money sits uncollected, which tells you everything about how much anyone actually knows.
