The Fake Lease: Stopping a Crypto Rental Scam in Marion County

Marion County, in North Central Florida, is home to just over 400,000 residents spread across small cities, retirement communities, and rural farmland. Here, scams often take the form of realistic rental listings, investment pitches, or tech support scams designed to separate victims from their savings — crimes that frequently reach across jurisdictions and borders.

The Marion County Sheriff’s Office (MCSO) has made asset recovery central to its mission. Lieutenant Carlton Curtis, who leads the property crimes unit, put it plainly: “When we can make a victim whole or get their money back...that means a lot to us. We work hard for our victims. We do everything we can to make them whole.”

The scam: A fake lease and a bitcoin deposit

In August 2024, “Jessica” found a rental on Facebook that looked perfect for her growing family. The lister provided instructions to tour the home through a legitimate real estate app, and the property appeared ready for move-in. The only oddity was the lockbox: “Every time I asked for the code, he would give me a wrong one. And then he told us how to break it,” she recalled.

When it came time to pay, the lister directed Jessica to a nearby Bitcoin ATM. She deposited the funds for first month’s rent, last month, and a security deposit — receiving printed receipts that documented the transactions and wallet address.

Days later, deputies knocked. “I received a phone call from my husband that the detectives and Marion County Sheriff’s Office came to the door saying that the house was fraudulent and we needed to leave within the next few hours.” Deputies gathered the Bitcoin ATM receipts and routed the case to Detective Richard Truman, MCSO’s crypto asset investigator.

It’s a scenario playing out more often in Marion County, where cryptocurrency-related crimes are on the rise. “A lot of our victims here in Marion County have no clue they are being scammed,” said Lieutenant Curtis.

Following the money: From crypto ATMs to an exchange

The receipts were the starting point. “Deputies on scene collected Bitcoin ATM receipts, which had the wallet address on them. I plugged it in and was able to conduct a blockchain analysis,” Truman said. The trace showed the victim’s deposits moving into a suspect-controlled wallet and then into a deposit address attributed to a major exchange.

Using TRM Forensics, Truman followed the funds directly to a Binance deposit wallet — “a relatively simple trace,” as he described it. He and an economic crimes specialist submitted an information request to the exchange and asked for the funds to be held.

The exchange’s response contained know-your-customer details associated with the account — enough for MCSO to identify an overseas account holder and confirm that the victim’s funds had not yet been withdrawn. From there, the team initiated a freeze and moved to secure the assets for return.

Two things made the technical work move quickly:

• Clear provenance from the ATM to the exchange. The Bitcoin ATM receipts gave investigators a concrete on-ramp address. TRM’s attribution connected the dots (ATM deposits → suspect wallet → exchange deposit) in one view that could be shared with prosecutors and the court.‍
• Case-ready visuals. “With the graphs created in TRM, I was able to easily present the case to the Attorney General’s office,” Truman said.

For context, Truman’s unit evaluates multiple tools; his north star is what helps cases move. “TRM seemed the most cop friendly,” he noted of his early impressions — a small but telling signal about usability in the field.

The outcome: Funds returned, playbook reinforced

Florida’s Fugitive Disentitlement Act allows courts to limit certain civil remedies for individuals who evade prosecution — and, crucially for victims, permits the state to pursue seizure of assets tied to a criminal case even if a suspect does not appear in court. In this matter, because the exchange account was already frozen, MCSO and its partners could start the recovery process immediately.

When the proceedings concluded, Jessica’s stolen funds were returned. “I never thought I’d see this ever again,” she said.

Cases like this are not rare in Marion County, where scams often begin with what seem like ordinary opportunities — a rental listing, an investment pitch, a prize announcement — and end with victims losing their savings. Jessica described the moment deputies arrived as “very distraught,” focused on “my daughter having a roof over her head.”

For investigators, the case reinforced how quickly a fraud can be unraveled when the right artifacts are secured at the outset and the investigative path is clear. Deputies gathered Bitcoin ATM receipts within hours, enabling on-chain analysis that led directly to the suspect’s account and, ultimately, to the victim’s restitution.

As Detective Richard Truman put it, “When we seize funds, we’re able to not only recover assets for victims, but also make it harder for criminals to operate. That’s how we make our county a safer place.”