Federal and state authorities have dismantled a sophisticated multi-state fraud network that stole at least $3.5 million from more than 40 elderly residents across Florida and beyond, resulting in the arrest of at least three individuals charged with coordinating unauthorized bank account takeovers, fraudulent transfers, and systematic withdrawals. The scheme, which operated from mid-November through mid-December 2024, relied on a combination of phone and online scams to target vulnerable populations, demonstrating how organized fraud rings now operate across state lines with coordinated precision.
The arrests of Jackson Saint Fleur, Feguerson Thelemaque (21), and Bryan Michel (25) exposed a network that had refined its methods to exploit both technological vulnerabilities in banking systems and the trust that elderly victims place in financial communications. The investigation gained momentum after authorities received an alert when a suspicious Manatee County resident was videotaped during an encounter with a courier, a common sign that stolen funds were being withdrawn in person. This breach of the perpetrators’ operational security provided the opening law enforcement needed to unravel what appeared to be a highly coordinated criminal enterprise with clear division of labor—scammers gaining initial access, account handlers orchestrating transfers, and couriers extracting physical cash from multiple locations.
Table of Contents
- HOW CRIMINALS EXECUTE COORDINATED MULTI-STATE BANK FRAUD
- THE ANATOMY OF BANK ACCOUNT TAKEOVERS AND FRAUDULENT TRANSFERS
- TARGETING VULNERABLE POPULATIONS THROUGH COORDINATED SCAMS
- HOW AUTHORITIES DETECT AND INTERRUPT FRAUD NETWORKS
- IDENTITY THEFT AND SOCIAL SECURITY FRAUD AS PART OF LARGER NETWORKS
- THE ROLE OF COURIERS AND CASH EXTRACTION
- CREDENTIAL THEFT ACROSS FINANCIAL INSTITUTIONS
- Frequently Asked Questions
HOW CRIMINALS EXECUTE COORDINATED MULTI-STATE BANK FRAUD
The fraudsters in this case employed a methodical approach that involved gaining unauthorized access to bank accounts, executing rapid transfers between accounts, and conducting coordinated withdrawals at multiple financial institutions in different states. This type of operation requires infrastructure that includes social engineering scripts to manipulate victims into revealing credentials, technical capability to access online banking portals, and a network of individuals willing to physically extract and transport large sums of cash. The December 2024 traffic stop that triggered a broader investigation illustrates how routine law enforcement actions can expose larger criminal infrastructure—in this case, a tinted-window violation led police to discover fraudulent credentials and violation of probation charges that unraveled an entire scheme.
What distinguishes organized fraud networks from individual scammers is the presence of specialized roles. Rather than one person handling the entire process from victim contact to fund extraction, professional networks compartmentalize operations: the person who makes the initial phone call may never see the stolen account credentials, and the person who withdraws cash may not know the victim’s identity. This reduces individual exposure if any participant is arrested and makes the network more resilient to investigation. In the Manatee County case, prosecutors identified three primary perpetrators, but the actual network likely included others who facilitated various stages of the operation.
THE ANATOMY OF BANK ACCOUNT TAKEOVERS AND FRAUDULENT TRANSFERS
Unauthorized access to bank accounts typically begins with social engineering—callers posing as bank representatives or utility companies extracting passwords, security questions, or other verification information from elderly victims who have been conditioned to trust customer service interactions. Once a fraudster gains login credentials, the technical portion of the attack becomes straightforward: they log in, review account balances, and execute transfers to accounts controlled by the fraud network. The limitation law enforcement faces in these cases is the speed at which transfers occur—within minutes of account compromise, funds can be moved across multiple institutions, making real-time prevention difficult even when banks are monitoring for suspicious activity. The coordinated withdrawal strategy used in this network demonstrates another sophistication: rather than attempting to extract the entire stolen amount from a single account or institution, the fraudsters distributed withdrawals across multiple banks and ATM locations.
This approach reduces the likelihood of triggering fraud alerts that would flag a single large withdrawal, and it complicates the bank’s ability to freeze funds before they leave the institution entirely. Authorities discovered that in several cases, fraudsters were withdrawing funds within hours of the transfer, meaning the victim’s own bank had minimal opportunity to reverse transactions even once the fraud was reported. A critical warning in cases like these: elderly victims may not immediately realize they have been compromised. Unlike merchants who notice unauthorized card charges quickly, a victim whose entire account has been transferred may discover the theft only when attempting to access their own funds—days or even weeks after the initial intrusion. By that point, the stolen money is typically already in the possession of the fraud network, making recovery nearly impossible.
TARGETING VULNERABLE POPULATIONS THROUGH COORDINATED SCAMS
This network specifically targeted elderly residents, a demographic that remains one of the most lucrative targets for organized fraud groups. The combination of phone scams and online fraud suggests the perpetrators were adapting their methods based on what worked—some victims may have been more responsive to phone contact, while others could be compromised through email or malicious links that captured their banking credentials. The fact that more than 40 identified victims were defrauded during a single six-week period indicates that the group had refined a repeatable process and was executing it with industrial efficiency.
The social engineering component of these attacks often plays on fear or urgency: callers claiming to be from the IRS threatening legal action, representatives from banks asking to “verify” account information during supposed security updates, or family members calling from overseas in apparent distress requesting emergency transfers. For elderly victims who grew up trusting banks and authority figures, and who may be less familiar with digital threats, these calls feel genuinely credible. The perpetrators in this case were sophisticated enough to understand not just how to compromise accounts, but how to manipulate their targets into willingly providing the information needed to do so.
HOW AUTHORITIES DETECT AND INTERRUPT FRAUD NETWORKS
The breakthrough in this case came not from proactive cybersecurity investigation but from a basic traffic stop in December 2024 that revealed probation violations and the physical presence of fraudulent credentials. This highlights a reality of modern fraud investigation: law enforcement often detects organized financial crime through traditional means—interdicting couriers, analyzing suspicious financial activity patterns, or encountering evidence during routine contact—rather than through cyber forensics. Banks may file Suspicious Activity Reports (SARs) when they notice unusual account behaviors, and the aggregation of multiple SARs across institutions can eventually reveal the existence of a network.
The tradeoff in fraud investigation is between speed and evidence. Quick intervention to freeze funds and arrest perpetrators prevents additional losses but may not capture the entire network, whereas slower investigation that builds comprehensive evidence of the full conspiracy takes longer but allows authorities to charge multiple individuals and dismantle the entire operation. In the case of Jackson Saint Fleur, Feguerson Thelemaque, and Bryan Michel, authorities appear to have used the traffic stop as leverage to begin identifying the broader network, eventually charging all three with conspiracy that dated back to mid-November.
IDENTITY THEFT AND SOCIAL SECURITY FRAUD AS PART OF LARGER NETWORKS
The broader context of organized financial fraud extends beyond simple bank account takeovers. In June 2026, federal authorities announced arrests of four individuals involved in a conspiracy to commit identity theft, wire fraud, bank fraud, and Social Security misuse—offenses that frequently operate in parallel with the kind of network dismantled in the Manatee County case. These broader conspiracy charges acknowledge that modern fraud rings don’t typically operate in silos; a network that gains unauthorized access to one person’s banking credentials often simultaneously creates fraudulent Social Security accounts, files tax returns in the victim’s name, or opens credit accounts.
A critical limitation of law enforcement response is the lag between when victims are compromised and when the network is completely dismantled. During the investigation into the Manatee County fraud ring, victims continued to be targeted while authorities built their case. Additionally, some fraud network members may never face consequences because they operated from outside the United States or used identity documents that made them difficult to locate and prosecute. The announcement of charges against Jackson Saint Fleur, Feguerson Thelemaque, and Bryan Michel represented resolution for some victims, but recovery of stolen funds remains exceptionally unlikely in cases involving organized networks.
THE ROLE OF COURIERS AND CASH EXTRACTION
Organized fraud networks require physical infrastructure to extract stolen funds from the financial system. Couriers—individuals who withdraw cash from ATMs and bank branches using fraudulent credentials or debit cards obtained through the network—serve as the final link between the digital theft and actual possession of money. The Manatee County case illustrates why courier activity is often how law enforcement gains visibility into larger networks: a single person withdrawing large sums of cash across multiple locations creates obvious behavioral patterns that police can observe.
The investigation that led to the dismantling of this network began when a resident videotaped an interaction with a courier, creating documentary evidence that authorities could use to trace the encounter back to the larger conspiracy. This demonstrates how awareness and vigilance by community members can complement formal law enforcement efforts. In many organized fraud cases, neighbors, bank employees, or other observers notice anomalous behavior—repeated visits to the same ATM, unusual cash withdrawals from an elderly person’s account, or strangers attempting to access someone else’s finances—and reporting these observations to authorities accelerates investigation.
CREDENTIAL THEFT ACROSS FINANCIAL INSTITUTIONS
The indictments of Jackson Saint Fleur, Feguerson Thelemaque (21), and Bryan Michel (25) included charges related to unauthorized access to bank accounts at multiple institutions, reflecting the reality that modern fraud networks don’t limit themselves to a single bank. Fraudsters who successfully compromise one person’s Chase account move immediately to attempt the same approach at Citizens Bank, Washington Trust, or other institutions where the victim may also maintain accounts. The conspiracy charges spanning mid-November to mid-December 2024 captured a coordinated effort to methodically identify and exploit victims across multiple financial institutions simultaneously.
What made this particular network “organized” rather than simply a group of individual scammers was the evidence that Fleur, Thelemaque, and Michel operated with a shared understanding of roles, shared access to victim information, and coordinated timing of account compromise and fund extraction. The violation of probation charges filed against one of the defendants suggests that this was not a network of first-time offenders but rather individuals with prior criminal histories who had applied experience to refined fraud operations. The identification of stolen credentials in physical form during the December traffic stop provided tangible evidence that the network was actively managing and sharing batches of compromised account information.
Frequently Asked Questions
How did authorities know this was an organized network and not individual scammers?
The coordinated timing of account compromises, evidence of shared victim information among multiple defendants, specialized roles in the operation (scammers, account handlers, couriers), and conspiracy charges spanning a defined period all indicated deliberate coordination rather than independent fraud activity.
Why was a routine traffic stop so important to solving this case?
The traffic stop in December 2024 revealed fraudulent credentials and probation violations that allowed authorities to connect a specific individual to the broader fraud network, providing the entry point to investigate Jackson Saint Fleur, Feguerson Thelemaque, and Bryan Michel’s coordinated activities.
What should elderly residents do to protect themselves from these types of attacks?
Never provide account credentials or security information to unsolicited callers, verify caller identity by hanging up and calling the bank’s official number, enable multi-factor authentication on all financial accounts, and contact banks immediately if they notice unfamiliar account activity.
How likely is it that victims will recover their stolen funds?
Recovery rates in organized fraud cases are extremely low. Once funds are extracted by a criminal network and distributed among multiple perpetrators or accounts, tracing and recovering that money becomes nearly impossible, especially if any portion crossed state lines or left the country.
What role did social media or online platforms play in this network’s operations?
While the verified facts focus on phone and online scams, the specific platforms used in the Manatee County case are not detailed in investigative reports, though organized networks typically use email phishing, social media-based contact, and compromised websites to distribute credential-stealing links.