SEATTLE — The man from Baghdad showed up unannounced this month in a state office building in Salem, Ore., with a piece of paper in his hand that he said was worth $6.4 million. He politely asked that his name be kept quiet, then told state officials that he had set up a local bank account into which they should deposit money annually. And then he went away, richer and more mysterious than when he arrived.

It was not an ordinary day at the Oregon Lottery.

The story started with small details, lottery officials said, and became bigger from there: The man was 37, an Iraqi Kurd. He had recently arrived in the United States from his home in Baghdad, and he said in fine English that he had won the Oregon Megabucks lottery drawing in late August by possessing the six correct numbers — without ever having visited the state.

The ticket, lottery officials learned, had been bought through thelotter.com, a company based in the island nation of Malta in the Mediterranean Sea, but had been printed out in a little deli on the outskirts of Bend, Ore., called Binky's.

Lottery officials' jaws dropped. Then they picked up the phone, calling the Department of Justice and Interpol. Was the man who he said he was, a successful businessman who had bought his ticket online? Was he on any kind of watch list? And how on earth would a lottery ticket from Binky's, of all places, end up in the possession of a man from halfway around the world?

But there was more: Despite Oregon laws that make lottery winners' names public, the man wanted anonymity. His life, and the lives of members of his family, he said, could be put in danger back home if his new net worth became known.

He told lottery officials that he had set up a bank account in Oregon where he wanted the first of 20 annual payments of $158,720 to be deposited, and that he intended to give the money to his two sons.

Thelotter.com arranges lottery ticket sales from around the world to buyers from all corners. It boasts of having "official tickets for all the world's biggest lotteries" — including Powerball in the United States and EuroMillions in France — as well as "100 percent commission-free wins."

Sean J. Riddell, a lawyer for thelotter, said the Oregon Lottery winner was still in the United States, but declined a request for an interview. Nor, Mr. Riddell said, would the man comment on his work or other details of his life in Iraq, or how he had acquired his visa to come to the United States.

The Oregon Lottery's director, Jack Roberts, said that an investigation was continuing into whether international lottery ticket sales are entirely legal — he said he had his doubts — but that the winner had done nothing wrong as far as anyone could determine. Everything checked out, Mr. Robert said, most crucially the six winning numbers on the ticket.

So the check was cut. Mr. Roberts said "yes" to anonymity, as well, although he added that a court could overrule him if the decision was challenged.

"I didn't want to be responsible if one of his kids gets kidnapped," Mr. Roberts said. "It's my decision that the need for his safety outweighs the public's need to know."

Foreign residents have played and won American state lotteries before. A group of Australians won $27.6 million in the Virginia Lottery in 1992. But that was before Internet commerce or online gambling existed in any widespread form.

In 2012, two foreign residents won prizes through tickets in United States lotteries bought through thelotter, the company said, although those prizes were much smaller than the one claimed by the Iraqi man: $1.25 million between the two winners.

Lottery laws are in many cases decades old and less than clear, legal experts said. Although a few states have experimented with online lottery sales, federal law makes it illegal to sell lottery tickets across state lines unless allowed by both states. Gambling online, with the exception of bets on horse racing, is legal only in Nevada, New Jersey and Delaware.

But in cases like this, in which the lottery ticket was bought over the counter, not through the Internet, the uncertainty runs deeper still.

"I think thelotter is at best in a gray area of legality," said Keith C. Miller, who teaches gambling law at Drake University in Des Moines.

Another prominent gambling expert, I. Nelson Rose, a professor of law at Whittier Law School in Costa Mesa, Calif., went firmly the other way.

"I think it probably was 100 percent legal," he said, referring to the Oregon transaction.

Thelotter said in an email that it made no wagers itself, or transferred any lottery tickets by mail or Internet, but that it instead provided what it called "a messenger service," using people who walk into shops like Binky's and plunk money on the counter. On its website, the company says that it makes its money in transaction fees for the ticket purchases and that it collects no percentage of winnings.

"We physically purchase the official tickets through our reliable and secure local offices located in more than 25 countries and make a scanned copy available to the players' secure personal accounts, which confirms their ownership," the company said in an email. "When a player wins, he is entitled to claim the prize in person."

Actual lottery tickets, the company added, are "never owned by us but only kept in a secured location on behalf of the customer until he claims his prize." The company said it had "handed over winning tickets" valued at more than $35 million.

In Oregon, it was up to Mr. Riddell to provide proof that the local chain of custody of the winning ticket was unbroken from its purchase in August until the winner's arrival, just in case any questions arose. He dispatched a private investigator to Bend to make sure. Finally, the ticket went into a bank safe deposit box.

Back at Binky's, Christmas came early with a $64,000 check that arrived out of the blue, a 1 percent bonus from the Oregon Lottery for having sold a winning ticket.

Judie Bell-Putas, 80, who owns the shop with her son — with a grandson behind the counter helping out with soup and sandwiches — said she had no idea who bought the ticket in August on behalf of the company in Malta, and that she did not much care.

"We're going to be using it to take care of the stuff we really need, and keep things going," Ms. Bell-Putas said.