Six months after Nancy Guthrie vanished from her Arizona home, two ransom notes released by the Pima County Sheriff's Department have split forensic experts on whether the messages are genuine, and investigators still have no suspect.
Nancy Guthrie, the 84-year-old mother of Today show host Savannah Guthrie, was reported missing on February 1 after she failed to attend a virtual church service. The next day, a ransom note arrived at KOLD-TV, the CBS affiliate in Tucson. A second note followed on February 6. Both sat under seal for nearly six months before the Pima County Sheriff's Department released them publicly on July 31, saying the notes "provide valuable insight into the mindset, motives and the evolution of their tone over time."
The release marked the six-month anniversary of Guthrie's disappearance, a timing choice that NewsNation senior national correspondent Brian Entin called deliberate. Entin, who shared his analysis exclusively with Us magazine in a new cover story on the case, said the sheriff's office was "probably trying to capitalize on that six-month moment" in hopes the notes "could drum up some new interest and maybe an important tip to come in."
Whether these notes hold real leads or amount to a cruel hoax remains the central question, and the experts cannot agree.
The first note, addressed directly to Savannah Guthrie, opened with a blunt declaration: "We have your mother Nancy. She is safe but scared." It continued with a ransom demand and a threat: "She will be held for ransom and once payment is received, she will be released unharmed.... If payment is not received by the last deadline... she will be killed."
Four days later, the tone reversed. The second note, addressed to the Guthrie family, stated that Nancy "perished shortly after she was taken" and was "buried in nature." It closed with an apology: "Nothing you could have done could have changed the outcome.... We want your family to know this and hope you all can find peace. We are truly sorry."
The shift from a ransom demand to a death notice in under a week is one of the contradictions that has drawn scrutiny from forensic analysts outside the investigation. The content of the second note, particularly the claim that Nancy was "buried in nature", has not been publicly verified by law enforcement.
According to the New York Post, investigators have zeroed in on two details in the first note that lend it credibility: the note correctly identified a broken floodlight behind Nancy's home and included information about her Apple Watch. Those details suggest the sender had firsthand knowledge of the property, information unlikely to be available to a random hoaxer.
Dr. Carole Chaski, a forensic linguist unaffiliated with the investigation, found a grammatical error in the first note that she said raises serious doubts about its authenticity. The problem is a verb-tense shift.
Chaski walked through the language in detail:
"[One] part of this note that I thought was interesting is 'We have your mother', present tense. 'She is safe but scared', Present tense. 'She will be held for ransom', future. She is being held for ransom. If it's for real, you know. I'm not sure this note is for real. Because of that tense shift."
She elaborated on why the shift matters. A kidnapper holding someone would describe the situation in the present tense, "she is being held", not the future. The future tense, Chaski noted, "comes normally later, which it does in this note when it says she will be released. So that makes sense because that's talking about what's going to happen in the real future. But what's happening in the real present is that she's being held for ransom, not that she will be held for ransom."
Chaski's analysis points to a writer describing a scenario rather than reporting a fact. A genuine kidnapper, in her view, would not stumble over whether the hostage-taking is already happening.
Not every expert shares her skepticism. Ana Belmonte, an assistant professor of forensic psychology at The Chicago School and also unaffiliated with the case, reached the opposite conclusion. She pointed to the specific details about Nancy's home as a marker of credibility.
"The inclusion of the information about Nancy's smartwatch and the damaged light indicates the source of the note is likely credible."
The first note stated that Nancy had a white smartwatch at the foot of her bed and that a floodlight in her backyard had been damaged, details that would require access to or surveillance of the property. The FBI has previously faced criticism for what some observers called hedging on whether the notes are authentic.
Scott Curtis, a retired FBI agent not working on the case, offered a different reason for caution. He said he does not "put a lot of significance" into the notes because they are not handwritten, and typed communications, in his assessment, could be AI-created.
That concern carries weight in 2025, when large language models can mimic human writing patterns with increasing accuracy. But it also cuts against Chaski's analysis: if the notes were AI-created, the verb-tense error she flagged might be a machine glitch rather than evidence of a human faker.
Retired investigator Lisa Miller, formerly of the Colorado Attorney General's Office, reached a different conclusion. Fox News reported that Miller assessed the notes were not written by AI, citing "uneven grammar, emotionally charged repetitions, and awkward phrasing." She also identified a consistent writing habit: the sender creates a statement and then immediately follows it with a comma-spliced reinforcing statement, a pattern she found across both notes, suggesting a single author.
Miller drew a parallel to the Unabomber case, where the FBI's decision to publish Ted Kaczynski's manifesto led his own brother to recognize the writing style and contact authorities. "Law enforcement rarely makes the deliberate call to release an offender's own words to the public," Miller said. The Pima County Sheriff's Department appears to be making the same bet, that someone will read these notes and recognize the voice behind them.
Pima County Sheriff Chris Nanos reinforced that strategy. "There are a number of pieces of information in these notes that just might jar someone to say, I've heard that, or the wording, the style of the writing," he said. The FBI has publicly stated that some of the ransom communications in the case may be legitimate, even as debate continues among outside analysts.
The ransom notes are far from the only evidence in the case. The AP reported that the FBI has collected more than 13,000 tips and the sheriff's department has received at least 18,000 calls since Nancy was reported missing on February 1. Unidentified DNA was collected from Guthrie's property and sent to an out-of-state forensic lab for analysis.
The Washington Examiner reported that a black glove found in a field near Guthrie's home contained DNA evidence and appears to match gloves worn by a suspect captured on doorbell camera footage. That DNA is being run through the FBI-managed CODIS database, which holds more than 19 million offender profiles. Investigators have also traced the suspect's gear, an Ozark Trail Hiker backpack, mask, and clothing, to Walmart purchases and are combing through the retailer's sales records and surveillance footage.
FBI-recovered doorbell camera footage, initially believed lost, showed a masked individual with a backpack and what appeared to be a holstered weapon attempting to disable the camera at 1:47 a.m. on February 1, the same day Nancy was reported missing. Bloodstain pattern analysis from the property revealed what retired analyst Paulette Sutton described as "a drip trail, which means it's a continuous source of blood dripping from an object or from a person." Nancy's pacemaker app also disconnected around the time of her disappearance, according to National Review.
The ransom notes demanded between $4 million and $6 million in Bitcoin, with payment deadlines that have since passed. Efforts to trace the Bitcoin wallet provided in the notes have stalled; the New York Post reported the wallet has remained inactive. Authorities are also attempting to trace a string of proxy servers linked to the IP address used to send the ransom emails, but that digital trail has not yet led to a suspect.
The case has also attracted opportunists. A California man received probation after sending a fake ransom note to Nancy Guthrie's family, a reminder that not every communication in the case is connected to the actual disappearance.
Savannah Guthrie, 54, has issued public appeals for information, describing her mother as a "loving woman of goodness and light" and addressing the abductor directly on social media: "It is never too late to do the right thing."
Sheriff Nanos has assured the public that investigators are still working the case. The FBI tipline, 1-800-CALL-FBI, remains active, and tips can be submitted anonymously.
But six months in, the gap between the volume of evidence and the absence of an arrest is hard to ignore. Investigators have DNA, doorbell footage, retail purchase records, digital trails, and two ransom notes whose language has been dissected by linguists, psychologists, and retired federal agents. Some profilers have flatly called the notes fabrications. Others say the notes' specific knowledge of Nancy's home proves they came from someone involved.
An 84-year-old woman vanished from her home in the middle of the night. Somebody knows what happened. The question is whether the people paid to find out will get there before the trail goes cold.
