The investigation into the disappearance of 84-year-old Nancy Guthrie has taken another unexpected turn after a prominent forensic psychologist questioned whether the ransom letters released by authorities were genuine and suggested that investigators should consider a very different possibility: that the incident may have begun as a burglary that unexpectedly escalated.
Guthrie, the mother of NBC “Today” co-anchor Savannah Guthrie, disappeared from her home in Tucson, Arizona, in the early hours of February 1, 2026. Six months later, she has still not been found, no one has been publicly charged in connection with her disappearance, and authorities continue to describe the case as an active investigation. The FBI remains involved, while the Pima County Sheriff’s Department says investigators are continuing to examine forensic evidence, surveillance footage and thousands of tips.
The latest debate centers on two ransom letters that authorities publicly released at the end of July. Investigators said they decided to disclose the communications because they believe the wording, writing style and specific details contained in the letters could cause someone in the community to recognize the author. Sheriff Chris Nanos has repeatedly emphasized that releasing the documents was an investigative decision intended to generate new information rather than an announcement that authorities had established who wrote them.
Forensic psychologist Dr. Kris Mohandie, however, told Fox News that he does not believe the ransom letters are authentic. His assessment does not represent an official law-enforcement conclusion, but it raises an important question about whether investigators may be looking at the wrong motive if they assume the disappearance was primarily a kidnapping carried out for financial gain.
Mohandie argued that aspects of the communications do not fit what he would normally expect from a genuine ransom operation. He also pointed to the apparent technological sophistication reflected in references to Bitcoin and electronic communication, while noting that unusual details in the letters could potentially become useful investigative clues regardless of whether the messages ultimately prove authentic.
His central argument is that investigators should remain open to multiple explanations. A ransom communication can be genuine, deliberately deceptive or completely fabricated by someone attempting to interfere with an investigation. The fact that a letter contains information related to the victim does not automatically establish that the writer was responsible for the disappearance.
That distinction is especially important in the Guthrie investigation because authorities have already encountered communications that were proven to be fraudulent.
Earlier in the investigation, a California man was arrested after authorities determined that a ransom communication connected to the case was fake. Derrick Callella later pleaded guilty in federal court to charges related to the fraudulent message. That case demonstrated how the disappearance attracted individuals who were not necessarily connected to whoever took Guthrie but were willing to exploit the situation and the family’s desperation.
Federal investigators also determined that three messages that surfaced through media outlets were bogus, according to Reuters reporting in July. At the same time, investigators continued treating two February communications separately, meaning the existence of fake messages did not automatically establish that every communication connected to the case was fraudulent.
That complicated history helps explain why authorities have been cautious about making definitive statements regarding the newly released letters.
The first letter reportedly demanded millions of dollars in Bitcoin and threatened consequences if the payment deadlines were not met. The second letter presented a dramatically different account, claiming that Nancy had died after her abduction and that her body had been left in a natural area. Neither claim has been independently established by authorities.
Most importantly, the second letter should not be interpreted as confirmation that Nancy is dead.
Investigators have not publicly recovered her body, identified a burial location or announced a definitive cause of death. The letter represents the claim of an unidentified writer, not a forensic finding. Sheriff Nanos has continued to say that the investigation is active, and authorities have asked the public to focus on information that can be independently verified.
The circumstances surrounding Guthrie’s disappearance remain disturbing. She was last known to be at her Catalina Foothills home on January 31. The FBI later released surveillance footage showing an armed individual near her front door who appeared to interfere with the home’s camera. Investigators have described the footage as an important part of the case and have continued seeking information about the unidentified person.
Guthrie was considered particularly vulnerable. She had difficulty walking, used a pacemaker and required daily medication for a heart condition. The FBI has emphasized the urgency of locating her and continues to offer a reward of up to $50,000 for information leading to her recovery and/or the arrest and conviction of those responsible.
The possibility raised by Mohandie — that the incident could have originated as a burglary rather than a planned kidnapping-for-ransom operation — remains a theory, not an established fact. There is currently no public evidence proving that a burglary occurred or that the disappearance resulted from an attempted break-in that went wrong.
Nevertheless, the theory highlights an important investigative question: what was the offender actually trying to accomplish when they approached Guthrie’s home?
If the person seen on the surveillance footage entered the property intending to steal something, investigators would need to determine whether anything was taken, whether the offender knew Guthrie was inside, and whether the situation changed unexpectedly once the person entered the residence. If, on the other hand, the individual arrived specifically intending to abduct Guthrie, investigators would need to determine why the ransom communications were structured as they were and whether they accurately reflected the offender’s motives.
At this stage, neither explanation has been publicly established.
Authorities have also continued examining a vast amount of digital and physical evidence. Sheriff Nanos recently said investigators are working through tens of thousands of tips and reviewing thousands of videos and photographs. He also described continuing DNA and forensic analysis involving laboratories outside Arizona.
That volume of evidence creates both opportunities and challenges. Investigators may possess information that cannot yet be publicly disclosed because releasing it could compromise the case. Nanos has argued that the department has gathered substantially more evidence than the public knows about and that investigators have a responsibility to protect the integrity of an ongoing investigation.
The sheriff has also pushed back against the idea that the case has become inactive.
“We are never giving up,” Nanos said while discussing the investigation’s six-month milestone. Authorities have continued working leads even as public attention has shifted toward the ransom notes and questions about the early stages of the investigation.
For Savannah Guthrie and her family, however, the passage of time has made the uncertainty increasingly painful.
Savannah has repeatedly asked anyone with information to come forward. Following the release of the letters, she issued another emotional appeal, urging people to consider whether they recognized the writing or had noticed unusual behavior in someone they know. She also suggested that a person might be afraid, conflicted or uncertain about coming forward but could still possess information that matters to investigators.
The family’s position has remained consistent: they want answers about what happened to Nancy.
The release of the letters therefore represents an unusual attempt to use the public as an investigative resource. Rather than keeping the communications entirely within the case file, authorities are hoping that someone will recognize a phrase, a spelling pattern, an unusual expression or some other characteristic that investigators themselves cannot connect to a particular person.
That approach has precedent in major criminal investigations. Sometimes the language used by an offender becomes more recognizable to people who know them personally than it is to professional investigators. A family member, coworker, friend or acquaintance might recognize a peculiar phrase or writing habit without initially realizing its importance.
But there is another side to the strategy.
Publicly releasing suspicious communications can also create noise. Thousands of people may develop theories, identify innocent individuals or misinterpret details in the documents. Investigators therefore have to separate genuine leads from speculation and determine whether any new information can be independently corroborated.
The Guthrie investigation has already demonstrated how quickly misinformation can become intertwined with the search. The existence of a fake ransom-note suspect, multiple questionable communications and conflicting interpretations of evidence makes verification particularly important.
That is why Mohandie’s assessment should be viewed as an investigative perspective rather than a conclusion.
He believes the ransom notes may not be legitimate and has questioned whether the overall incident resembles a conventional kidnapping-for-ransom case. His suggestion that investigators examine the possibility of a burglary gone wrong could provide another avenue for investigators to consider, but there is currently no public evidence establishing that this is what happened.
Likewise, the fact that some ransom communications were proven fake does not mean that the two letters released by the sheriff’s department are necessarily fake. Authorities have said they considered the two communications significant enough to release publicly, and investigators continue to examine them.
The distinction between “potentially useful” and “proven genuine” is critical.
Sheriff Nanos has said there are details in the released notes that could cause someone to recognize something familiar. Investigators apparently believe that, even if the letters ultimately turn out not to have been written by the person who abducted Guthrie, the documents may still contain information capable of producing a useful lead.
Meanwhile, the FBI continues to maintain a public information request connected to the case. Surveillance footage released by the bureau shows the unidentified individual near Guthrie’s residence, and investigators are still asking anyone who recognizes the person, vehicle or circumstances surrounding the footage to come forward.
The investigation has also faced criticism over its early handling. Recent reporting has raised questions about the initial response, the experience of some investigators and the relationship between local authorities and federal investigators. Those issues remain disputed, and they should not be confused with evidence identifying the person responsible for Guthrie’s disappearance.
What remains clear is that the case has not been solved.
Nancy Guthrie has not been located. No suspect has been publicly charged with abducting her. The identity of the person captured near her home remains a critical unanswered question, and authorities have not publicly established whether the ransom communications came from the actual offender.
The profiler’s burglary theory adds another possibility to an already complicated investigation, but it does not replace the evidence.
Ultimately, investigators will need to determine what happened inside and around Guthrie’s home, who was responsible, where Nancy was taken and what happened to her afterward. The ransom notes may help answer some of those questions — or they may prove to be another layer of deception.
For now, the most significant development is that investigators are willing to reconsider possibilities and expose more evidence to public scrutiny in the hope that someone recognizes something they have overlooked.
Six months into the case, that may be exactly what the investigation needs.
A single credible tip could connect a name to the masked figure, explain an otherwise unexplained detail or reveal why someone wrote the ransom letters in the first place. Until that happens, the burglary theory remains only a theory, the ransom notes remain disputed evidence, and Nancy Guthrie remains missing.
The search for the truth continues.