BENTON — A 78-year-old southern Illinois woman was alarmed when a popup message appeared on her computer in April warning that it had been compromised. She Googled the number for Microsoft support and called the first option that appeared in her search results.
The man on the other end of the line told her he was a supervisor on Microsoft’s fraud-prevention team. He gave her the bad news first: Her computer had been hacked, he said, and her sensitive data potentially compromised.
But he had a solution: If she followed his directions and gave him remote access to her computer, he could look inside and determine the extent of the damage.
She did as instructed.
Unfortunately, the supposed Microsoft supervisor told her, it was bad.
That was the beginning of an elaborate, monthslong scheme that would lead the Marion woman, identified only as D.B. in federal court records, to move nearly $1.8 million from her investment accounts. She was instructed to move the money into money market accounts, federal court records show, and spend more than $823,000 on gold bars that she believed a federal agent needed her to turn over for safekeeping while authorities worked to secure her compromised accounts.
But the agent wasn’t real, and the first load of gold bars she handed over in the Marion Walmart parking lot, worth $318,459, is gone, Kathleen Howard, an assistant U.S. attorney for the Southern District of Illinois, told a federal judge in Benton last week.
One of the fraudsters admitted guilt in the conspiracy.
Those who duped the Marion woman and others they targeted across the country, including the defendant who appeared in court to accept a plea deal that day, did so knowing their victims were “elderly and otherwise vulnerable,” Howard told the judge.
Gold-bar scams on the rise
In September 2025, the FBI warned that it was seeing an increase in what it described as “gold bar and bulk cash courier scams” that can unfold in a variety of creative, insidious, and increasingly sophisticated ways that weaponize trust and fear.
Criminals pose as tech-support workers, financial institution representatives and agents of the FBI, Department of Justice, Federal Trade Commission and U.S. Treasury Department. In this case, the Marion woman believed the man who greeted her in the Walmart parking lot in June was an agent of the U.S. Treasury.
The precious metals industry has also taken notice.
Gold can be a smart investment alongside traditional portfolios, but it’s also attractive to scammers because it’s hard to trace once it changes hands, said Paul Cox, director of sales for California-based Freedom Gold USA. It may be natural to wonder how someone could fall for these scams, but Cox said that until you’ve seen one up close, it’s hard to comprehend just how manipulative they can be. He’s seen smart people duped. Those who threaten to plant illegal material are particularly effective, he said: “People will do anything the minute they feel fear.”
They may also use the opposite tact, building a close rapport over weeks with vulnerable seniors who come to trust them explicitly. Cox recalled one woman who had already lost about $50,000 in a gold-bar scam when she was approached by real police officers hoping to put an end to it. Yet the woman remained so convinced by the scammers that she doubted the sworn officers and chose to keep working with those stealing from her instead, he said.
The FBI reported that between 2023 and May 2025, it had documented more than 1,700 bulk cash and gold-bar scams, resulting in losses of more than $186 million.
An NDA, a tracker phone and daily check-ins
The scammers started working right away to get their hooks into D.B. and separate the Marion woman from the hundreds of thousands of dollars in her nest egg.
After D.B. followed Williams’ instructions to give him remote access to her computer, he was able to learn about D.B. ‘s Edward Jones Investments account, according to a sworn affidavit by a Homeland Security Investigations agent, who worked the case with Marion police and the U.S. Postal Inspection Service.
Williams then transferred the elderly woman to another man, who identified himself as Kevin Jones, and who claimed he worked in Edward Jones’ fraud prevention department.
Jones told D.B. that her Edward Jones account had indeed been compromised — and protecting it would require extreme measures. He then had her sign a purported nondisclosure agreement in which D.B. agreed to keep the operation a secret from family and law enforcement. Jones mandated that D.B. maintain regular contact with him, asking that she send “good morning” and “good night” texts every day. She was provided a “tracker phone” that Jones monitored.
Jones later told D.B. that in order to protect her money, D.B. needed to convert her assets to gold. She did as instructed and moved $1.8 million from her Edward Jones accounts into a money market account. She then spent $318,459 on six one-ounce bars and 20 100-gram bars. Jones instructed D.B. how to package the gold for transportation, and then gave her instructions for handing the gold bars over to a U.S. Treasury agent.
She was instructed to meet the agent on June 8 — 67 days after she first made contact with the scammers. They’d meet in the Marion Walmart parking lot, D.B. was told, and after exchanging the code word “black bug” she should hand over the gold bars.
The exchange went as planned, and the scammers were pleased. Not long after, Jones began instructing her to convert even more of her assets into gold — this time just over a half-million dollars. She did that, too.
D.B., though, started to grow suspicious. The federal seal on the documents Jones sent her after handing over the gold bars didn’t look real. That’s when she finally contacted the Marion Police Department, federal court records show. D.B. believed them when officers told her she’d been duped.
A sting turns the tables on the scammers
For months, the scammers had called the shots. This time, they would be the ones set up.
With the help of Marion police, another drop was arranged with Jones, who once again guided D.B. as she packaged two kilograms of gold bars worth about $272,000. On July 7, Jones told D.B. to meet the agent at the Cornerstone Church in Marion near Sam’s Club. And once again, he told her, she should exchange a password with the U.S. Treasury agent.
Federal prosecutors say law enforcement watched Ruoyu Lian approach the elderly woman outside a Marion church later that day. He exchanged a new secret code word with her — this time, “poker queen” — and took the box he believed contained two kilograms of gold.
Instead, it was filled with sandbags.
Investigators arrested Lian moments later. Just 12 days later, he was indicted by a federal grand jury for his role in the conspiracy. He’s the only one facing charges to date connected to D.B.’s lost investments.
On Sept. 24, Lian, 30, of Flushing, New York, sat in federal court in Benton wearing an orange jumpsuit, his wrists and ankles shackled. Lian told U.S. District Judge Phil Gilbert that he understood only a little English. Appearing via Zoom, a Mandarin interpreter translated the words of the judge, prosecutor and his own attorney for him through headphones, then translated Lian’s responses back to the court.
He pleaded guilty to felony wire fraud and conspiracy to commit wire fraud, offenses that could carry sentences of up to 20 years and $250,000 in fines each. No family or supporters appeared in court with him.
Defense attorney: To ring leaders, ‘Lian is expendable’
Federal court records make clear that Lian didn’t operate alone, but his lawyer, former Jackson County State’s Attorney Joe Cervantez, said prosecutors painted a picture that made Lian appear to have a more active role than Cervantez believes he actually did. Cervantez said they pointed to his New York apartment and the fact he drove a Porsche to suggest he’d benefitted financially from this scheme or others.
But Lian shared the apartment with his girlfriend and another roommate, drove an older, four-door model Porsche, and his father still provided him financial support so he could make ends meet, Cervantez said. Lian, he said, worked as a sushi chef in New York.
He said Lian became acquainted with people in New York he didn’t previously know, at a New York establishment frequented by people who shared his cultural background. Over time, Cervantez said, they convinced Lian to play the role of the U.S. Treasury agent — making him the scheme’s “courier,” and thereby putting him at the greatest risk of arrest for little reward.
He received only a relatively small payment — amounting to about two weeks’ pay at his restaurant job — to fly to southern Illinois and collect the gold from D.B., Cervantez said.
Cervantez said that, unfortunately, he believes Lian’s arrest will do little to deter such schemes.
“Lian is expendable to them,” he said of the fraud ring leaders. “At the end of the day, everybody in the scheme is still on to the next one.”
In exchange for Lian’s guilty plea, prosecutors agreed to pursue a sentence within federal guidelines, which Cervantez said ranges from 40 to 52 months in federal prison. The plea agreement preserves Cervantez’s ability to argue for a sentence below that range. In addition to any prison time or fines, Lian will be required to pay more than $318,000 in restitution for the gold taken from D.B. and never recovered, Howard, the assistant U.S. attorney, told the court. Judge Gilbert told Lian, a Chinese citizen and legal permanent resident, that he will be deported after completing his sentence.
His sentencing hearing is scheduled for Jan. 14.
The Saluki Local Reporting Lab is a special project of the SIU School of Journalism and Advertising and is designed to give students from diverse backgrounds practical reporting experience while providing news coverage to underserved communities.
Capitol News Illinois is a nonprofit, nonpartisan news service that distributes state government coverage to hundreds of news outlets statewide. It is funded primarily by the Illinois Press Foundation and the Robert R. McCormick Foundation.