What to know about claims that Trump rally shooter used ‘encrypted’ messaging, bank accounts

Authorities investigating the assassination attempt on former President Donald Trump found a number of "encrypted" applications on the shooter’s phone, sparking some Trump supporters to speculate that more than a lone actor had perpetrated the attack. 

During a July 18 Fox News appearance, Rep. Mike Waltz, R-Fla., linked the gunman, Thomas Matthew Crooks, and reports that U.S. intelligence had detected a plot by Iran to assassinate Trump. 

"The shooter had three encrypted accounts overseas at the same time we’re having an Iranian plot." Waltz said. Pressed on what he meant, Waltz said, "Well, we know that they were based in servers overseas."

(Internet Archive)

Conservative activist and commentator Laura Loomer in a July 20 X post said something similar: "How does a 20-year-old nerdy kid have 3 encrypted overseas bank accounts? Who was sending him money overseas?"

Trump, too, cited encryption’s link to the shooting. He said July 22 on Fox News that Crooks "had some encrypted phone numbers and to foreign countries."

Waltz, Loomer and Trump didn’t respond to our requests for information or reports supporting their claims. 

As of July 24, FBI Director Christopher Wray said it appeared that Crooks acted alone. And investigators have not said that Crooks had bank accounts overseas. 

PolitiFact’s reporting found that these remarks about the presence of "encryption" in Crooks’ activities reveal misconceptions about what encryption is and how commonly it factors in online applications and communications.

News organizations including Politico, Axios and CBS News reported that top Secret Service and FBI officials on July 17 updated members of Congress on the investigation of the July 13 assassination attempt in Butler, Pennsylvania.

Citing unnamed sources, the news reports said officials told lawmakers in a private call that they were still working to access three encrypted platforms Crooks had used on his cellphone. 

Axios and Politico reported the three encrypted platforms were linked to Germany, New Zealand and Belgium, although this information was also not credited to a named source. CBS News described the platforms only as "three foreign encrypted platforms," without identifying countries. 

Waltz’s comments about Crooks’ "three encrypted accounts overseas" came a day after that briefing.

The news reports did not mention banks or banking and it is unclear what sparked Loomer’s claims about Crooks having foreign bank accounts.

Since that briefing, no new publicly available information from the FBI or any other official source supports the foreign bank account claims. 

Ross Delston, an independent attorney and certified anti-money laundering expert, said he had never seen "encrypted overseas bank accounts" used before in any context. He said the use of such terminology made him think the entire overseas bank account allegation was "bogus."

It’s hard to open an overseas bank account. In any well-regulated jurisdiction, "banks would have a minimum requirement with respect to funds on deposit, and there’d be questions about the customer." 

Delston said Germany, New Zealand and Belgium would all be considered well-regulated jurisdictions.

"Unless there’s a lot of money involved, there would be little interest in opening an account" for a 20-year-old in the U.S. who is not a high-net-worth customer, Delston said. 

FBI Director Christopher Wray testifies before a House committee about the July 13 shooting at a campaign rally in Butler, Pa., July 24, 2024, on Capitol Hill. (AP)

When asked about Crooks’ use of encrypted platforms and accounts, an FBI spokesperson pointed PolitiFact to Wray’s July 24 testimony before the House Judiciary Committee. 

Wray said then that FBI investigators had accessed some of Crooks’ accounts, "but some of them we’re still waiting on."

Crooks "had a number of encrypted messaging apps on" his phone, Wray said, and the FBI was working to gain access to that content. The FBI initiated legal proceedings to try to gain access to several platforms, including gaming accounts and messaging applications, he said.

"Some of them we may never get access to because of the encryption issue that … presents an increasingly vexing barrier for law enforcement," Wray said. He did not mention bank accounts.

Some of the FBI’s offices overseas are part of the investigation because some of Crooks’ accounts, purchases or communications involved foreign companies, meaning the agency must "get evidence from overseas," Wray said. 

PolitiFact searched Wray’s testimony and found no mention of Germany, New Zealand, Belgium, banks or banking. 

At one point, Rep. Jim Jordan, R-Ohio, the Judiciary Committee’s chair, asked Wray to "tell us what you can about the encrypted platforms we’ve heard about." 

Wray said investigators were digging into Crooks’ devices and social media accounts "in an effort to try to learn more about his state of mind, his motive, his ideology, his contacts — everything else." 

Wray: "One of the things we’ve learned in finally getting into his phone — which was also a significant technical challenge from an encryption perspective. But, in addition, once we got on the phone, it turned out he was using some encrypted messaging application." 

Jordan: "And, again, the same question relative to the bombs, is this — was this a pretty sophisticated or is this — this is the kind of the norm you see with folks like, you know, similar situation? How would you —"

Wray: "On this — on this subject, I would say this is unfortunately, now, become very commonplace and it’s a real challenge for not just the FBI, but state and local law enforcement all over this country."

Rep. Wesley Hunt, R-Texas, asked two encryption-related questions: Which specific encrypted messaging applications the shooter had used and whether Wray could confirm whether Crooks was communicating with foreign nationals through the encrypted messages. 

Wray said he could not immediately provide the specific applications and reiterated that the FBI had not "identified any accomplices or co-conspirators, foreign or domestic." He said the agency hopes to gain access to the encrypted messages, partly because they could show whether Crooks had communicated with foreign contacts. 

Encryption is a method of scrambling data so that only that data’s intended readers can make sense of it, cybersecurity experts told PolitiFact.

Cybersecurity experts also universally said encryption is used widely. 

"Encryption is used daily by anyone using a cell phone, computer or the Internet," said Thomas Hyslip, a professor of instruction in criminology at the University of South Florida who formerly worked in federal law enforcement investigating cybercrime. 

"iMessage uses encryption, so all your messages are encrypted between the sender and receiver," he said, referring to a system Apple devices use. "If you go to a website that starts with ‘https,’ then your data is encrypted between your computer or phone and the webserver."

Experts said many communication applications or platforms use encryption in some capacity, including WhatsApp, Signal, Zoom and Telegram. Similarly, everyday banking applications such as Wells Fargo Mobile or Chase Mobile use encryption, as do platforms used to transfer money like Venmo, Apple Pay and PayPal, according to their websites.

"Privacy and security are now things that the consumer market expects and demands," said John Sammons, an associate director and professor at Marshall University’s Institute for Cyber Security.

Clifford Neuman, a computer science practice professor at the University of Southern California’s Information Sciences Institute, said that in many cases, encryption means data is encrypted as it is sent over a network, decrypted on the servers being used and then reencrypted before it is sent over a network to its destination. 

When data appears decrypted on servers, Neuman said law enforcement can often obtain it  with a warrant or subpoena, depending on factors such as jurisdiction and the data’s location. 

However, "encrypted messaging" typically refers to the use of end-to-end encryption, Neuman said.

End-to-end encryption means data does not get decrypted on the server, making it "much more difficult for authorities or others to intercept," he said. Many messaging apps provide this encryption by default, so "it is not that rare and many individuals use it for completely legitimate purposes," Neuman said.

Strong encryption is very difficult, "if not practically impossible," to break, which poses a huge problem for law enforcement, said John Sammons, an associate director and professor at Marshall University’s Institute for Cyber Security.

Nevertheless, all our experts agreed that the FBI’s statements about Crooks having used encryption do not alone show Crooks was involved in a larger criminal network or plot.

Crooks’ use of some platforms that employ encryption "may suggest a larger criminal conspiracy, but it certainly doesn’t prove one," because "encryption and encrypted messaging are in wide use today by both consumers and criminals," Sammons said.

PolitiFact Researcher Caryn Baird contributed to this report.

CORRECTION Aug. 8, 2024: An earlier version of this fact-check identified U.S. Rep. Mike Waltz, R-Fla., using the wrong first name. The story has been updated.

RELATED: PolitiFact’s coverage of the Donald Trump assassination attempt