A high-value transaction can stop being a property-security problem very quickly.

The watch is valuable.

The jewellery is valuable.

The artwork is valuable.

The cash-equivalent asset is valuable.

But the person carrying it may become more valuable to the offender than the asset itself.

That is the most important protection lesson I take from the March 2026 kidnapping of a Liverpool watch dealer.

According to the Crown Prosecution Service, the dealer traveled to an address on Dunkeld Close in Liverpool on the evening of March 28 to deliver a watch after arrangements had been made through his business Instagram account.

Prosecutors say he was lured inside, ambushed by masked men, assaulted, bound with duct tape and forced into his own Ford Kuga.

His girlfriend was ordered out of the vehicle.

The dealer was then taken to a nearby address on Hygeia Street and held overnight.

During the kidnapping, prosecutors say the offenders used the victims phone to repeatedly contact his business partner and demand watches, jewellery and later £10,000 in cash.

The partner received dozens of calls.

A bag containing watches was eventually left at the Asda Breck Road car park as instructed.

Police surveillance officers observed two males on scrambler bikes collect the bag and travel toward the address where the dealer was being held.

At 6:43 p.m. on March 29, armed officers entered the Hygeia Street property and found the victim in a rear bedroom with minor injuries.

Three men were sentenced on October 2 after guilty pleas, while a fourth defendant was awaiting sentence.

This case is not useful because it proves Instagram is dangerous.

It does not.

Businesses legitimately sell through social media every day.

It is not useful because it proves every private buyer is suspicious.

They are not.

And I am not interested in looking backward and telling a kidnapping victim what he should supposedly have done differently.

The useful protection question is broader:

When a business, family office, collector or UHNW household moves something valuable to a person or location it does not control, what has to be verified before the movement begins, and what happens if the person carrying the asset suddenly becomes the leverage?

That is a different problem from ordinary residential security.

It is different from cyber fraud.

It is different from protecting a collection sitting inside a vault.

It is transaction security.

Key takeaways

• The person and the property become one risk. Once someone is physically transporting high-value goods, protecting the asset and protecting the individual can no longer be separated.
• A digital conversation does not establish physical trust. Instagram, WhatsApp, email or text can initiate a deal, but higher-risk transactions require independent identity and location verification.
• The meeting location is part of the security decision. An unfamiliar private address selected by the counterparty creates a different risk from a controlled, staffed professional environment.
• Last-minute changes should trigger re-verification. A change of address, recipient, vehicle, timing or payment instruction should not automatically flow through because the transaction is already underway.
• Missed check-ins need a predetermined response. Do not wait several hours before somebody decides a delay feels unusual.
• The carrying phone can become an attack surface. If an offender gains control of the victim and phone, contacts, inventory information and business communications may all become available.
• Family offices need a duress protocol. When a demand arrives involving a detained employee, principal or family member, staff should know who calls law enforcement and who controls internal decisions.
• A ransom deadline should not eliminate process. Criminal urgency is designed to force rushed decisions.
• Do not improvise independent negotiations. A real kidnapping or blackmail event should move immediately to law enforcement and specialist crisis support.
• Two-person approval can protect critical changes. High-value delivery changes, asset release and unusual financial instructions should not depend on one employee acting alone.
• Public inventory and real-time movement are different things. Luxury businesses need marketing visibility, but they do not need to expose who carries inventory, when it moves or where deliveries occur.
• The protocol should scale with value and exposure. Not every watch delivery needs executive protection. Higher-value or higher-risk movements should receive greater verification and control.

What happened in Liverpool

The CPS says the transaction began through the dealers business Instagram account.

On March 28, the dealer traveled to Dunkeld Close to deliver a watch.

When he arrived and knocked at the address, prosecutors say he was lured inside.

Masked men ambushed him.

He was forced to the floor.

Assaulted.

Bound with duct tape.

The offenders repeatedly told him that they were taking him before putting him into his own Ford Kuga.

His girlfriend was ordered out.

The vehicle then moved approximately 250 metres to another address on Hygeia Street, where the victim was held overnight.

From a protection standpoint, the short distance between the original meeting location and detention location is worth noting.

This was not described as an elaborate cross-country abduction.

The criminal control point began at the transaction location.

Once the victim crossed the threshold and lost freedom of movement, the security problem changed completely.

The offenders allegedly converted the victim into leverage

This is what makes the case much more important than an ordinary watch theft.

According to prosecutors, the offenders used the victims phone to contact his business partner.

The demands were backed by threats to shoot or seriously injure the kidnapped dealer.

The business partner received dozens of calls.

The demands reportedly included watches and jewellery and later £10,000 in cash.

This means the target had changed.

The watch carried to the original appointment was no longer the only objective.

The victim himself became the mechanism through which offenders allegedly tried to reach additional business assets.

That is exactly why family offices and businesses handling valuable goods need to think beyond theft prevention.

A kidnapping can turn one employee into a credential

Normally, an employee proves authorization by:

calling from a known phone;

using a known account;

knowing internal information;

referencing a legitimate transaction;

or speaking in their own voice.

During coercion, all of those normal trust signals can still be present.

The employee may genuinely be on the phone.

The employee may genuinely know the information.

The employee may genuinely tell the office to release an asset.

That does not mean they are acting freely.

This is where ordinary business authentication stops being enough.

The transaction protocol should assume coercion is possible

I do not mean staff should treat every call from a colleague as suspicious.

I mean certain actions should have controls that do not disappear simply because a trusted person suddenly sounds urgent.

Release another £500,000 watch.

Bring cash.

Send the principal vehicle to another location.

Change the destination.

Open a vault.

Give me another persons telephone number.

Send somebody alone.

Those are not ordinary operational requests anymore.

The system should recognize the change.

The first layer is transaction classification

Not every handover requires the same protective posture.

I would classify the movement before deciding the controls.

Factors can include:

asset value;

portability;

resale value;

public visibility;

counterparty history;

meeting location;

distance traveled;

whether the carrier is alone;

time of day;

cash involvement;

and any previous security concerns.

A repeat client receiving a watch at a known office is not the same as a first-time social-media contact asking for a six-figure item to be delivered to a private residence.

Higher value should mean more control, not merely more insurance

Insurance can address financial loss.

It cannot undo kidnapping.

That distinction matters.

If the asset value or transaction structure creates meaningful personal exposure, the protocol should change before the movement begins.

Verify the counterparty independently

A social-media profile is a lead.

It is not automatically identity verification.

An account can be genuine.

Compromised.

Impersonated.

Newly created.

Or simply controlled by someone whose physical identity has not been established.

For a higher-risk transaction, I want an independent verification process appropriate to the circumstances.

That could include:

known company contact information;

established client records;

previous transaction history;

identity confirmation;

business registration where relevant;

or confirmation through another trusted party.

The exact process should remain proportionate and lawful.

Do not verify through the same channel that created the concern

This is important.

If the Instagram account says:

“My delivery address changed. Message this new WhatsApp number.”

Then confirming the change only through that new WhatsApp number has not independently verified anything.

Go back to a trusted contact point.

A known telephone number.

Established business email.

Existing client record.

Another authorized person.

That is true whether the issue is fraud or physical-security exposure.

Verify the location as well as the person

The identity may be genuine.

The requested location can still be wrong.

Ask:

Who controls the property?

Is the address associated with the buyer?

Is it an office?

Residence?

Short-term rental?

Vacant property?

Hotel?

Parking lot?

Why is the transaction occurring there?

A different location creates a different risk.

I prefer controlled meeting environments for unfamiliar transactions

A controlled environment can provide:

known access;

staff presence;

video;

known exits;

predictable communications;

and easier law-enforcement response.

Examples could include an established showroom, business office, private bank environment where appropriate, or another professional site chosen by the seller rather than an unknown third party.

This does not mean private-home transactions can never happen.

It means they deserve a different level of scrutiny.

An unfamiliar private address should be a risk modifier

Not an automatic refusal.

A modifier.

If the customer is new and the location is unfamiliar and the item is extremely portable and valuable, several risk factors are stacking together.

The answer may be:

move the meeting;

send additional personnel;

use professional transport;

conduct greater verification;

or decline the transaction.

Control the meeting location where possible

The party selecting the location often controls more of the environment.

They know:

who is present;

the physical layout;

where vehicles can be positioned;

what cameras exist;

which doors operate;

and who else can enter.

For a high-value handover, giving all of that control to an unknown counterparty should be a deliberate decision rather than habit.

Location changes should restart part of the approval process

One of the most useful controls is simple change management.

The approved meeting is:

10 a.m.

Client office.

Known address.

Named recipient.

Then at 9:42 the buyer says:

“Plans changed. Come to this residential address instead.”

That is a new transaction condition.

Treat it that way.

Do not let sunk cost drive a bad security decision

The carrier is already on the road.

The item is already out of the vault.

The client is important.

The sale is almost complete.

Those are commercial considerations.

They should not eliminate re-verification when the physical situation changes.

Create a transaction release checklist

Before a higher-risk item leaves controlled custody, somebody should be able to answer:

Who is receiving it?

Has that person been independently verified?

Where is the meeting?

Who verified the address?

Who is carrying the item?

What vehicle is being used?

Who knows the itinerary?

What is the expected arrival time?

When is the first check-in?

What happens if the location changes?

Who can authorize that change?

What happens if the employee misses contact?

That process can take minutes.

It does not have to become bureaucracy.

Separate approval from execution on sensitive movements

I like two-person control for certain high-value decisions.

One person receives the request.

Another approves the unusual change.

That is particularly useful for:

new counterparties;

large asset releases;

destination changes;

cash requests;

after-hours transactions;

or instructions received under unusual urgency.

The second person does not need to redo the entire deal.

They provide an independent pause point.

Two-person control helps against both coercion and fraud

This is where physical and financial security overlap.

An employee can be manipulated digitally.

Or physically coerced.

The same control can help with both.

One trusted voice should not always be enough to release unlimited value.

Keep the carrier inventory-limited

If one transaction involves one watch, there may be no reason for the carrier to transport six additional watches unless the business model requires it.

More inventory increases exposure.

It can also increase the leverage an offender has once the person is detained.

Minimize the information carried with the asset

The person may need:

buyer information;

address;

receipt;

transaction authorization.

They do not necessarily need:

the full inventory list;

vault access information;

other customer addresses;

complete family-office contacts;

or every high-value movement scheduled that week.

Least necessary information matters because the carrier may lose control of the phone, laptop or paperwork.

The Liverpool case makes phone compromise especially important

Prosecutors say the offenders used the victims own phone to contact his business partner.

That gave the calls immediate credibility.

The receiving employee was not dealing with a random spoofed number.

The communication was coming through the kidnapped persons device.

This is why phone possession cannot equal unlimited authority.

A known device is not proof of free consent

If an employee suddenly calls from their normal phone and says:

“Bring every watch we have.”

I want the organization to recognize the instruction as exceptional even though the device is legitimate.

Normal identity verification answers:

“Is this really John?”

A duress protocol asks another question:

“Is John acting freely?”

Do not build the entire duress plan around a secret word

A prearranged word or phrase can be useful in some environments.

It should not be the only control.

People forget codes under stress.

Offenders may hear the conversation.

The exact scenario may make the phrase impossible to use naturally.

I would rather have layered indicators:

unexpected asset demand;

unusual location;

request outside the persons authority;

broken check-in;

pressure not to call somebody else;

and any established duress signal.

Missed check-ins should trigger action automatically

“Text me when you get there.”

That is not enough.

What if they do not?

At what point does someone call?

Five minutes?

Thirty?

Two hours?

Who checks?

Who decides whether to contact police?

The answer should already exist for higher-risk movements.

Use a defined check-in sequence

For example, the organization may require:

departure confirmation;

arrival confirmation;

completion confirmation;

and return-to-safe-location confirmation.

The exact cadence depends on the transaction.

The important part is that silence means something.

Build a reasonable grace period

Traffic happens.

Meetings run late.

Phones die.

A professional process should not summon armed police because an employee is seven minutes late.

The grace period should reflect the expected movement and risk.

Once the threshold is exceeded, escalation begins.

Escalation should not rely entirely on calling the missing person

If the person is under coercion, repeated calls may not clarify the situation.

The organization can also review:

known destination;

scheduled counterpart;

vehicle status;

last confirmed communication;

authorized itinerary;

and other available information.

If danger is reasonably suspected, move to law enforcement rather than attempting to solve the situation internally.

Do not wait 24 hours to report someone missing or endangered

Police.uk explicitly states that there is no 24-hour waiting requirement for reporting a missing person.

If someone may be in immediate danger, police say to call 999 immediately.

That matters for businesses and family offices because people sometimes hesitate:

“Maybe the meeting is just running late.”

“Maybe his phone died.”

“We do not want to overreact.”

When the facts reasonably indicate danger, report it.

A kidnapping demand needs a predefined crisis path

The family office receives a call.

Or the jewellery business.

Or the principal’s assistant.

The caller says:

“We have him.”

“Do not call police.”

“Bring these assets.”

“You have 30 minutes.”

That is not the moment to search the company handbook for the first time.

First identify the crisis owner

Who immediately takes internal control?

Security director?

CEO?

Family-office principal?

Chief of staff?

Designated crisis lead?

One person should coordinate internal decisions.

That does not mean they personally negotiate.

It means the organization stops fragmenting.

Contact law enforcement immediately

The UK National Crime Agency says kidnapping or extortion should be reported directly to police and that emergency cases should be reported through 999, making clear that the incident is a kidnapping or blackmail/extortion.

The NCA Anti Kidnap and Extortion Unit provides specialist 24/7 strategic and tactical support to law enforcement in the UK and internationally.

That specialist structure is important.

A family office does not need to become a kidnapping-negotiation team.

The United States has specialist federal resources too

For U.S.-based families and businesses, immediate danger should be reported through 911.

The FBI also specifically encourages reporting threats involving extortion and violence and can be contacted through a local field office or 1-800-CALL-FBI.

In international kidnapping cases, FBI resources can include agents, hostage negotiators and victim specialists working with local and foreign authorities.

Again, the lesson is simple:

Get qualified authorities involved early.

Do not let the offender define your organizational structure

Criminal instructions often include:

do not call police;

do not tell anyone;

stay on the phone;

bring the money alone;

move now.

Those instructions are designed to isolate the recipient and control decision-making.

The organization should already have a process that moves the event out of one employees hands.

Do not assume every kidnapping demand is genuine either

This is the other side of the problem.

Virtual kidnapping scams use fear and urgency to convince families and businesses that someone has been abducted when no physical kidnapping has occurred.

The FBI says such callers often try to keep recipients on the phone and prevent them from independently contacting the alleged victim so that payment occurs before the deception is discovered.

The family office therefore needs to handle two possibilities at once:

the kidnapping may be real;

or the demand may be fraudulent.

That is another reason to involve law enforcement immediately rather than choosing one assumption.

Verification and response need to run in parallel

Do not spend 45 minutes trying to prove whether the kidnapping is real before reporting it.

And do not automatically release assets solely because the caller sounds convincing.

Activate authorities.

Preserve the communication.

Attempt independent verification where safe and appropriate.

Keep the organization coordinated.

Preserve the communications

Call logs.

Messages.

Telephone numbers.

Voicemails.

Account details.

Payment instructions.

Images.

Emails.

Do not casually delete them after the immediate crisis.

Police guidance for blackmail cases emphasizes that texts, screenshots, account details, usernames, dates and timelines can all be useful to investigators.

Keep one written incident chronology

Time of first call.

Who answered?

What was demanded?

What number appeared?

Was the victim heard?

What did they say?

What changed during later calls?

Who contacted police?

What instructions did authorities provide?

A real-time chronology helps prevent information from becoming scattered across five phones and three conversations.

Do not turn the entire office into a crisis room

More people do not automatically improve decisions.

I want a small authorized group.

Crisis lead.

Security.

Law enforcement liaison.

Legal counsel where appropriate.

Relevant executive.

Other employees receive only what they need.

Control internal information during the kidnapping

A company-wide message saying:

“John has been kidnapped and we are arranging a watch drop”

does not help.

It creates rumor, information leakage and potentially media exposure.

Need-to-know matters.

Do not post publicly while the incident is active

Family members may want help.

Employees may panic.

Friends may post:

“Has anyone seen him?”

That might be appropriate in some missing-person cases when coordinated with police.

During an active kidnapping or extortion response, public communication should be coordinated with the investigating authorities.

The Liverpool case also shows why asset release needs control

According to the CPS, the business partner was instructed to leave a bag containing watches at the Asda Breck Road car park.

Police surveillance officers later watched two males arrive on scrambler bikes, collect the bag and travel toward Hygeia Street.

I would not generalize from that operational police decision and tell private businesses how to conduct ransom drops.

That would be inappropriate.

The useful lesson is the opposite:

Once law enforcement is involved, follow the coordinated professional response.

Do not independently invent your own drop procedure.

Family-office employees should never conduct an improvised ransom delivery

“Grab the money and go.”

No.

A kidnapping response is a specialist law-enforcement problem.

An untrained employee carrying cash or valuables to an offender-selected location can create another hostage.

Protect the original victim without creating a second one.

Do not send another valuable employee into the same unknown environment

This applies before an incident too.

The first employee misses a check-in.

The instinct may be:

“Send another person over to see what’s going on.”

That can multiply the exposure.

If circumstances suggest potential danger, escalate through the security and law-enforcement process.

Transaction security should include an abort rule

A high-value movement should be allowed to stop without somebody feeling they failed the business.

Examples of conditions that can justify pausing and re-verifying include:

• the recipient changes unexpectedly;
• the location changes at the last minute;
• additional unknown people appear;
• the buyer demands movement to another location;
• the transaction changes from normal payment to cash;
• communication moves to an unverified new number;
• the environment does not match what was expected;
• the carrier cannot reach the designated office contact;
• or the carrier simply identifies a material security concern.

Stopping to verify is cheaper than proceeding because everyone feels committed to the sale.

The employee should have permission to leave

This sounds obvious.

Commercial pressure can make people ignore concerns.

“The client is important.”

“We drove an hour.”

“The boss expects this sale.”

“Do not embarrass us.”

If the person carrying a high-value asset identifies a legitimate concern before committing to the meeting, the organization should support withdrawal and reassessment.

Do not make the carrier the sole decision-maker either

They may not know the wider picture.

One person can become normalized to strange behavior.

That is why the office should retain oversight.

Use check-in questions that confirm more than arrival

“Here.”

That tells me very little.

For a higher-risk movement, the office may need confirmation that:

the expected recipient is present;

the location matches;

the transaction is proceeding as approved;

and no material change has occurred.

Keep it brief.

Transport should match the transaction

Sometimes the business owner drives.

Sometimes a courier.

Sometimes an armored carrier.

Sometimes an executive protection team.

The correct model depends on:

value;

visibility;

route;

threat;

client profile;

insurance requirements;

and operational frequency.

Do not use executive protection simply as expensive delivery staff

If a movement genuinely requires EP, the purpose is protecting the person and managing exposure.

The team should understand:

counterparty;

location;

movement;

arrival;

communications;

and contingency options.

Standing beside someone holding a watch without any of that is not a protection plan.

Discreet movement can be preferable to obvious security

A visible convoy around a luxury-watch delivery may advertise value.

In another threat environment, visible protection may be appropriate.

Again, assess the movement.

There is no universal presentation.

Packaging should avoid advertising the asset where practical

High-value goods should not needlessly travel in packaging that announces exactly what is inside.

This is not about deception.

It is reducing avoidable visibility.

Vehicle choice matters too

A highly identifiable luxury vehicle carrying known luxury inventory may attract different attention from a less conspicuous transportation choice.

That does not automatically make an ordinary vehicle safer.

It is another exposure factor.

Route information should remain controlled

Who knows the delivery route?

Who knows the departure time?

Who knows the item is moving?

Who knows the meeting address?

The answer should not automatically be the entire sales team.

Public marketing and private logistics should be separated

A luxury dealer may need to show inventory publicly.

That is normal business.

What does not need to be public:

where the item is stored tonight;

who will deliver it;

which car they use;

what time they leave;

what other inventory travels with them;

or which residential address contains additional stock.

Real-time social posts can reveal movement unintentionally

A story says:

“Heading out to deliver this beauty.”

Another shows the vehicle.

Another shows the neighborhood.

The intention is marketing.

The result can be movement intelligence.

Businesses and collectors should separate promotion from real-time logistics.

Family offices face the same problem with private collections

The family acquires:

a rare watch;

jewellery;

art;

collectibles;

or another portable asset.

Who receives it?

At which residence?

Who knows it arrived?

Who transports it to another property?

Who can authorize its release?

That is not merely inventory management.

It is physical-security governance.

The collection register should not be the delivery instruction

I do not want the courier carrying a document showing every valuable asset the family owns.

The receiving party should have enough information to verify the specific handover.

Not an unnecessary map of the collection.

Separate asset records from movement records where appropriate

The collection manager may need full valuation information.

The driver may only need:

pickup;

destination;

authorized receiver;

and handling instructions.

Least necessary information reduces secondary exposure.

The carrier phone should not unlock the entire organization

This is a major lesson from any coercion event.

If the employee loses control of the phone, what becomes available?

Complete client list?

Inventory?

Vault application?

Gate application?

Internal team directory?

Family addresses?

Banking?

Schedule?

The business should minimize what one compromised device can expose.

Remote lock and credential revocation should be executable quickly

If a phone is known to be under criminal control, someone authorized should know how to:

disable relevant accounts;

revoke sessions;

protect sensitive systems;

and preserve what law enforcement needs.

This should be coordinated carefully during an active kidnapping so that protective actions do not interfere with the police response.

Do not make technical changes blindly during a hostage event

This is important.

Someone may say:

“Wipe the phone immediately.”

That could remove useful investigative data or affect communication with the victim.

During an active event, follow the law-enforcement strategy.

Pre-plan technical capability so it is available when requested.

Family offices need a single crisis communications tree

Principal.

Spouse.

Security director.

Chief of staff.

Legal counsel.

Insurance contact.

Law enforcement.

Depending on the incident, some need immediate involvement.

Others do not.

Define it before the crisis.

Insurance should be understood before high-value movement

The family office should know:

what is insured in transit;

who can transport it;

which carriers are approved;

whether private delivery changes coverage;

and what reporting requirements follow a loss.

Insurance does not replace security.

It can influence the operating procedure.

Repeated high-value movements need a formal program

If this happens once a year, a bespoke plan may be enough.

If employees move valuable watches every day, improvised security is no longer reasonable.

Build a repeatable system.

Approved meeting categories.

Verification.

Release authority.

Movement tracking.

Check-ins.

Exception approval.

Incident reporting.

Luxury-goods crime is not hypothetical

The Jewelers Security Alliance describes itself as a centralized security and crime-information resource for roughly 20,000 jewelry-industry members and maintains a crime database used to identify patterns affecting jewelers and law enforcement.

The point is not that every collector or dealer is under constant threat.

It is that portable, high-value assets support an established criminal market and therefore deserve deliberate movement security.

The person selling the asset can be worth more than the asset

This is worth repeating.

An offender steals one watch.

That produces one gain.

An offender controls someone who knows:

where additional watches are;

who holds them;

who can release them;

which employees respond;

and how to reach the business partner.

The kidnapping creates leverage beyond the object carried into the meeting.

This is why transaction security is also organizational security

The carrier connects:

customer;

inventory;

business partner;

vehicle;

storage;

phone;

payment;

and potentially family.

Protecting the movement means limiting how much of that network one compromised person can unlock.

Do not publish the entire staff directory

Criminals do not need help identifying:

who manages the collection;

who holds vault access;

who drives;

who approves transfers;

or who can release funds.

Public-facing staff information should follow business need.

Reception and assistants should recognize transaction-related pretexting

“I am meeting Michael about the Rolex.”

“He told me to collect the package.”

“The delivery changed.”

“I need the storage address.”

“He said you should give me his partners number.”

Those statements should be verified rather than rewarded with more information.

Partners should not be able to authorize each other into unlimited exposure

A business partner may genuinely know sensitive information.

Under coercion, that information can be exploited.

Critical asset release should follow process even when the request appears to come from a known principal.

Emergency authority should be broad enough to protect people

A security manager should be able to stop a movement.

A driver should be able to refuse an unexpected destination until verified.

A staff member should be able to escalate a missed check-in.

No one should fear being fired because they paused a six-figure handover after the recipient unexpectedly changed.

Commercial culture determines whether the security procedure works

You can write the best policy in the world.

If sales staff hear:

“Never lose a client over security”

they will bypass it.

If they hear:

“Stop when something materially changes and we will resolve it quickly”

they are more likely to use it.

Speed matters in luxury sales, but so does control

UHNW clients expect service.

They may want the item tonight.

They may change hotels.

They may send an assistant.

They may ask for delivery to a jet.

A good transaction-security program should handle legitimate flexibility without abandoning verification.

Build fast verification, not no verification

Known assistant?

Call their established number.

New hotel?

Confirm through the principal or known representative.

Different driver?

Verify with the approved transportation provider.

Speed and control can coexist.

International movements require another layer

Customs.

Insurance.

Local law.

Secure transport.

Hotels.

Private aviation.

Different police systems.

A travel security program should account for the valuable property when it materially changes principal exposure.

The asset should not dictate the principal movement unnecessarily

If the principal is traveling for business, do they need to personally carry the valuable item?

Sometimes yes.

Sometimes a professional secure-logistics provider is the better answer.

The highest-profile person should not automatically become the courier.

Collectors need the same discipline during private trades

Two collectors meet through a forum.

One brings a rare watch.

No business premises.

No employees.

No established buyer relationship.

Private trade does not eliminate the need for verification.

If anything, it may increase it.

Meet where the environment supports the transaction

A good location does not guarantee safety.

It gives the participants more options.

Known access.

Staff.

Cameras.

Emergency response.

Neutral control.

Do not disclose the exact asset until necessary

Where business practices allow, there may be no reason for numerous third parties to know the exact watch reference, value or number of pieces moving.

Need-to-know applies to valuables too.

After a failed or suspicious transaction, update the internal record

Buyer changed address unexpectedly.

Could not verify identity.

Requested cash.

Insisted on an isolated location.

Deal cancelled.

Document it.

If the same contact returns through another employee six months later, the business should know.

Centralized incident history matters

Salesperson A rejects the transaction.

Salesperson B receives the same buyer a week later.

Without shared information, the second employee starts from zero.

That is a preventable gap.

What families, collectors and family offices can do now

Classify high-value movements

Define what value or risk level triggers additional approval.

Verify new counterparties independently

Do not rely only on the originating social-media account.

Verify the meeting address

Understand who controls the location.

Prefer controlled locations for first-time high-value handovers

Especially where the asset is highly portable and easy to resell.

Require approval for last-minute changes

Address.

Recipient.

Time.

Payment.

Limit inventory carried

Move what the approved transaction requires.

Limit data on the carrying device

Do not make one lost phone the key to the entire business.

Use defined check-ins

Departure.

Arrival.

Completion.

Safe return.

Create a missed-check-in threshold

Decide when normal delay becomes an escalation.

Give employees authority to abort

Security concerns should not be punished as lost sales.

Create one emergency escalation number

The employee should not have to decide which executive to call.

Create a kidnapping and extortion protocol

Who contacts police?

Who controls internal communications?

Who preserves evidence?

Who liaises with specialists?

Do not improvise ransom deliveries

Coordinate with law enforcement.

Preserve communications

Messages, account details, telephone numbers and timelines can matter.

Review phone compromise procedures

Know what can be revoked and who has authority to do it.

Review insurance requirements

Understand transit and courier conditions.

Separate marketing from real-time logistics

Display the product without advertising the movement.

Record suspicious transaction attempts

Make them searchable across staff and locations.

Review executive protection triggers

Know which movements justify professional accompaniment.

How MSB Protection approaches high-value transaction security

At MSB Protection, I would not start by asking whether the watch needs an armed guard.

I would start with the complete transaction.

What is moving?

What is it worth?

Who is carrying it?

Who is receiving it?

How do we know?

Where is the meeting?

Who chose that location?

Who can change it?

Who knows the movement?

What happens if the carrier misses contact?

What information is on the carrier’s phone?

What can the carrier authorize?

What happens if they are coerced?

Those answers determine whether the transaction needs:

• better verification;
• different meeting arrangements;
• secure logistics;
• a second employee;
• professional transportation;
• executive protection;
• protective intelligence;
• family-office oversight;
• or some combination of those measures.

The answer should match the risk.

The objective is controlled flexibility

Luxury business cannot function like a military checkpoint.

Clients expect responsiveness.

Collectors make unusual requests.

Principals change schedules.

Aircraft move.

Hotels change.

Events run late.

Security has to work inside that reality.

The goal is not rigidity.

The goal is making sure commercial flexibility does not eliminate the controls that protect the person carrying the value.

Frequently asked questions

What happened to the Liverpool watch dealer?

According to the Crown Prosecution Service, a watch dealer traveled to Dunkeld Close in Liverpool on March 28, 2026 to deliver a watch after arrangements were made through his business Instagram account. Prosecutors say he was lured inside, assaulted, bound and kidnapped before being held overnight at a nearby address.

Was the dealer alone?

No. The CPS says his girlfriend was with him when he was abducted. She was ordered out of his Ford Kuga before the offenders drove away with him.

How far was the detention location from the original meeting?

The CPS said the Hygeia Street address where the victim was held was approximately 250 metres from Dunkeld Close.

How did the offenders contact the business partner?

Prosecutors say they used the kidnapped dealers own phone to make repeated threats and demands.

What did they demand?

The CPS says the demands included watches, jewellery and later £10,000 in cash, accompanied by threats to shoot or seriously injure the victim.

How many calls did the business partner receive?

The CPS describes the contact as dozens of calls.

Was a ransom or asset drop made?

The CPS says the business partner left a bag containing watches at the Asda Breck Road car park under instructions received during the kidnapping. Police surveillance officers later observed two males on scrambler bikes collect the bag.

How was the dealer rescued?

At 6:43 p.m. on March 29, armed officers entered the Hygeia Street address and found the victim in a rear bedroom with minor injuries.

What evidence did police recover?

The CPS says searches recovered cable ties, gloves, duct tape, balaclavas, watches and jewellery. Digital evidence included mobile phones, an image of the victim during captivity and internet searches relating to Dunkeld Close.

Who was convicted?

Connor Kenny, Patrick Gray, Callum Walsh and Anthony White pleaded guilty on April 29 to conspiracy to kidnap, conspiracy to blackmail and conspiracy to commit fraud.

What sentences were imposed?

On October 2, Patrick Gray received eight years and three months, Callum Walsh seven years and six months, and Connor Kenny seven years and seven months. The CPS said Anthony White would be sentenced later.

Did prosecutors say the victim was specifically targeted?

Yes. The CPS said the victim was deliberately targeted because of his business. The public summary does not set out every step through which the offenders allegedly selected him.

Does this mean selling watches through Instagram is unsafe?

No. Instagram was the communication channel described in this case. The security issue is whether high-value physical transactions originating online receive appropriate verification before a person and valuable asset move into an uncontrolled environment.

Should businesses refuse all home deliveries?

No. The location should be assessed alongside the value, client history, verification, staffing and transaction circumstances. An unfamiliar private address for a first-time high-value buyer deserves greater scrutiny than an established client location.

What is transaction security?

Transaction security is the process of managing the physical and information risks around a sensitive handover, including counterparty verification, meeting location, asset custody, transportation, check-ins, exception approval and emergency response.

How is transaction security different from executive protection?

Executive protection focuses on protecting the person. Transaction security includes the broader commercial process around the movement of the asset. Some higher-risk transactions may require executive protection as one component.

Should every luxury-watch delivery have a bodyguard?

No. Protection should scale with the risk. Value, destination, counterparty, public exposure, transaction history and current threat information all matter.

What should trigger additional security?

Examples can include an unfamiliar counterparty, very high asset value, isolated meeting location, unexpected destination changes, significant cash involvement, previous suspicious behavior or current threat information involving the person carrying the item.

How should a buyer first contacted on social media be verified?

Use an independent channel or trusted record appropriate to the transaction rather than treating possession of a social-media account as sufficient identity proof.

Why verify the address?

Because knowing who requested the meeting does not automatically establish who controls the physical environment where the meeting will occur.

What if the buyer changes the address at the last minute?

Pause and re-verify. A material location change alters the security assumptions under which the movement was approved.

What is two-person approval?

It means requiring a second authorized person to confirm certain sensitive actions such as a large asset release, unusual destination change or emergency financial instruction. It helps reduce both fraud and coercion risk.

Why are check-ins important?

They make delay observable. Without an expected contact time, an employee can disappear into an abnormal situation for hours before anyone recognizes the problem.

How often should a carrier check in?

There is no universal frequency. The schedule should follow the transaction and travel time. Higher-risk movements may justify departure, arrival, completion and safe-return confirmations.

What if someone misses a check-in?

Follow the predetermined escalation process. That may begin with attempts to contact the individual and can progress quickly to security leadership and law enforcement when circumstances indicate potential danger.

Do you have to wait 24 hours to report someone missing?

No. UK police explicitly state that there is no 24-hour waiting requirement. If the person may be in immediate danger, police advise calling 999 immediately.

What should staff do if they receive a real kidnapping demand?

Activate the crisis protocol and contact law enforcement immediately. In the UK, the NCA advises reporting emergencies through 999 and clearly stating that the incident involves kidnapping or blackmail/extortion.

What specialist support exists in the UK?

The National Crime Agency Anti Kidnap and Extortion Unit provides specialist 24/7 strategic and tactical support to UK and international law-enforcement agencies dealing with kidnapping and extortion.

What should a U.S. family office do?

Call 911 when someone may be in immediate danger. Extortion threats can also be reported to the FBI through a local field office or 1-800-CALL-FBI.

Should staff pay immediately if a caller threatens the victim?

Do not independently improvise a payment or asset transfer. Move the event immediately into a coordinated law-enforcement response and follow specialist direction.

Why should a family office not conduct its own ransom drop?

An untrained employee can become another victim, interfere with an investigation or create additional risk. Kidnapping and extortion response should be coordinated with law enforcement.

What if the kidnapping demand is fake?

Virtual-kidnapping schemes do occur. The FBI says offenders often use urgency, fear and continuous phone contact to stop families from verifying the alleged victims status. Contact law enforcement immediately while independent verification proceeds.

How can a family office tell a real kidnapping from a virtual one?

Do not expect staff to resolve that question alone. Preserve the call information, attempt appropriate independent verification and involve law enforcement immediately so both possibilities can be addressed.

Should the family office use a secret duress word?

A duress phrase can be one layer, but it should not be the entire system. Exception detection, missed check-ins, two-person approval and unusual requests provide additional protection if a code cannot be used.

Why does phone security matter in a physical kidnapping?

A captured phone may contain contacts, business communications, inventory information, calendars, addresses and access to company applications. The device can give offenders leverage beyond the victim.

Should the phone be remotely wiped immediately?

Not automatically during an active kidnapping. Technical actions should be coordinated with law enforcement because the device and communications may have investigative value or remain relevant to the response.

Should a carrier know where all inventory is stored?

Only if their role genuinely requires it. Limiting unnecessary information reduces the amount an offender can gain through one coerced employee.

Should inventory movement be posted on social media?

Real-time movement details generally create unnecessary exposure. Businesses can market products without broadcasting exactly when, where and by whom valuable goods are being transported.

Can a family office use the same process for artwork and jewellery?

The principles transfer, but the movement risks differ. A portable watch, large painting and rare automobile require different logistics. Verification, custody, movement approval and exception control still apply.

Should the principal personally transport valuables?

Only when that makes sense for the circumstances. A professional secure-logistics provider or another approved carrier may sometimes reduce exposure.

What should happen after a suspicious transaction is cancelled?

Document the relevant facts so another employee does not unknowingly restart the same transaction with the same counterparty later.

Why maintain a transaction incident database?

Because repeat attempts may occur through different employees, phone numbers or accounts. Centralized records make patterns easier to recognize.

Does high-value transaction security overlap with protective intelligence?

Yes. Information about suspicious counterparties, repeated requests, unusual location changes and prior incidents can inform whether a future movement requires additional protection.

What should a family-office security assessment review?

For high-value transactions, a security assessment can review approval authority, asset custody, counterpart verification, movement procedures, communications, check-ins, duress escalation, device exposure and law-enforcement coordination.

Final thoughts: protect the transaction chain, not just the asset

The Liverpool watch-dealer kidnapping is a strong example of why high-value property cannot be protected in isolation from the person moving it.

The transaction began digitally.

Then it became physical.

The dealer traveled to an address.

According to prosecutors, he was ambushed and kidnapped.

Then the situation expanded again.

The victim’s phone became a communication channel.

The business partner became part of the crisis.

Additional watches and jewellery became the demand.

Cash was added later.

A drop location was selected.

The original business transaction had become an organized coercion problem.

That is the point family offices, collectors and luxury businesses should understand.

Do not build high-value security around the object alone.

Verify the person.

Verify the location.

Control changes.

Limit the information carried.

Know who can release additional value.

Use check-ins that actually trigger something when they fail.

Give the carrier authority to stop.

Keep real-time logistics private.

Have a process for coercion.

Know who calls law enforcement.

Know who controls the office during the crisis.

And do not allow the person holding the phone to become the only authentication required for the next asset release.

Most high-value transactions will be completely legitimate.

Security should not make luxury business unusable.

The goal is controlled flexibility.

Fast service when everything matches.

Fast verification when something changes.

And fast escalation when a commercial transaction stops looking commercial.

The watch is valuable.

The person carrying it is more important.

A professional security program should be designed accordingly.

Sources

• Crown Prosecution Service

---

About Michael Braun

Michael Braun is a former Special Unit Operator, former Manager at Gavin de Becker & Associates, and Founder & CEO of MSB Protection, an executive protection and residential security firm serving high-net-worth and ultra-high-net-worth clients.

Braun has built his career at the intersection of specialized protective operations, executive protection, residential security, protective intelligence, and security risk management. His experience spans special-unit operations, leadership within Gavin de Becker & Associates, and the development and oversight of private protection programs within demanding UHNW environments.

He has been recognized by The Top 100 Magazine as a leading CEO in the private security field and is the subject of an upcoming Marquis Who’s Who feature highlighting his leadership and contributions to the profession.

Today, Braun is recognized for his work in executive protection, UHNW estate security, residential protection, protective intelligence, adversarial security assessments, and security auditing throughout Beverly Hills and Southern California.

His work focuses on moving private security beyond simply “providing a body” and toward intelligence-led, risk-based protection programs designed to identify vulnerabilities before an adversary can exploit them.

---

Looking for Executive Protection or Residential Security Services?

If you are a high-net-worth or ultra-high-net-worth individual, family office, estate manager, chief of staff, or executive in Beverly Hills, Los Angeles, Malibu or Southern California, MSB Protection provides executive protection, residential security, 24/7 protection, protective intelligence, medical-readiness planning, and security risk management.

We evaluate the complete security environment, from threat exposure and residential vulnerabilities to personnel, technology, procedures, protective intelligence, and emergency response, and build a program around the risks that actually exist.

Contact us for a confidential consultation or message us at +1 (805) 285-2807.