The Refund That Came Back in a Box

The case

A refund that has to go back. That is how this one starts, in the plea agreement’s telling. A call center overseas reaches an elderly person. A call turns into a refund. The refund turns out to be too big. And part of it, the victim is told, has to be returned.

Not by check. In cash. Hidden in a package. Mailed to a name the victim has never heard of.

In a federal case in the Southern District of California, the lead defendant’s plea agreement was filed in court on 30 June 2026. It says that while he took part, the conspiracy received about 2,000 victim packages, at an average loss of about $32,000 per package. Victims, it says, were told to “withdraw bulk cash from their bank accounts, to conceal the cash in packages, and to send cash-laden packages through express mail via private and commercial interstate carriers to the names and addresses provided by the conspirators.”

And the names on those boxes, the plea agreement says, were not real.

This article follows the path of a box, as the court records describe it, from the call to the car: the refund, the instructions, the address, the fake ID that matched it, and the cash moving on. It also follows the one phone call, from one victim, that prosecutors say opened the case. This is a case study, not a guide to the scheme.

How to read it. The documents speak with different voices, and every sentence here says which one it uses:

• The plea agreement says / admitted — the lead defendant’s signed plea agreement. It lists some facts as “true and undisputed” and others as facts he “agrees that the government can prove.” Both are his agreement; neither is a verdict on anyone else.
• The indictment says / defines — an allegation by the grand jury. In the prosecutors’ own words, charges in an indictment “are merely accusations, and the defendants are considered innocent unless and until proven guilty.”
• Prosecutors say — the U.S. Attorney’s press releases. A summary by one side.
• The docket shows — the court’s own record of what was filed.

No victim or defendant is named. The defendants’ names are in the public record. We leave them out. This channel follows the method, not the people.

How does a refund turn into a box of cash?

By convincing the victim that the money was never theirs. The case’s superseding indictment defines the refund scam this way: criminals use social engineering “first to gain the victim’s trust, then to convince the victim that he/she had accidentally received an ‘over-refund,’ a portion of which the victim was instructed to return.”

That is the pitch. The victim isn’t paying anyone. Just giving back what was never theirs.

Prosecutors, describing the same scheme in an earlier release, say the most common version involved “pressuring—or threatening—them to return the supposed excess funds via wire transfer, cash, or gift cards.” The plea agreement names the same three exits: gift cards, wires to foreign bank accounts, and bulk cash sent by carrier to locations across the country.

This article follows the cash, because cash is the one that needed a door, and someone behind it.

A refund is money that comes to you. This one only works if money leaves. Out of the bank, in cash, hidden inside a box, sent to a stranger at an address that came from the people on the phone.

Why would anyone follow those instructions?

Because, the plea agreement says, the people on the phone had built trust first, and in many instances had already looked at the victim’s money.

The order, as the plea agreement lays it out, starts with a message. Members of the conspiracy at call centers outside the U.S. reached people “including pop-up ads, emails and phone calls.” “The purpose of these communications was for victims to call the scam call centers.” Once someone called, conspirators “used social engineering techniques to build trust with victims.”

Then the screen. “In many instances,” the plea agreement says, conspirators had victims download remote desktop software, which they used “to remotely access victims’ computers and to identify how much money a victim had in his/her bank account(s).” That access was to the victim’s own computer. Nothing in these records says any bank was broken into.

Trust first. Often, a look inside the account. Then the refund.

We covered the pop-up end of this path in our piece on fake tech support pop-ups, and the remote-access end in our piece on how stolen crypto gets spent. We won’t repeat either here. This case is about where that phone call can end: a pop-up, a callback, a refund, and then a box, at a rented door.

The targets were not random. The plea agreement says the victims were “vulnerable, elderly, with ages averaging in the mid- to late-70s, but with victims as old as 97 years-old.” That is an average, and an upper end. Behind it are real people, and none of them is named here.

What does the plea agreement’s own math say?

That the number is an estimate, and it says so. The plea agreement puts two figures side by side: the conspiracy “received approximately 2,000 victim packages” during the lead defendant’s participation, and “the average victim loss per package was approximately $32,000.” He took part, it says, from at least 2019 through at least 2023.

Its footnote does the multiplication: “Based on an estimated 2,000 packages and estimated $32,000 per-package loss, which results in approximately $64,000,000 in loss.”

Estimated. That word is the plea agreement’s, and it stays. The case has three headline money numbers, and they are not the same thing:

• An estimated $64 million in loss — the footnote’s arithmetic, for the period the lead defendant took part.
• At least $64 million in restitution, to be ordered — the plea agreement says he “shall be subject to an order of restitution” requiring him to repay victims “at least $64,000,000.” He has not been sentenced, so that order does not exist yet.
• “$65 million” — the label prosecutors used in their announcement for the whole scheme.

None of the three should be added to another, and none of them is money that has been paid back. The records we read don’t say what, if anything, has been returned.

One more thing the numbers don’t say. About 2,000 is a count of packages. None of the records we could read says how many people sent those packages. So we won’t turn boxes into victims. (The U.S. Attorney’s release says “over 2,000.” The plea agreement’s word, which this article uses, is “approximately.”)

How did investigators find out where the boxes were going?

Prosecutors say it started with one phone call. “The investigation started in December 2020 after an elderly victim contacted an express mail carrier after being defrauded into sending bulk cash in the mail,” the U.S. Attorney’s office wrote.

That is all the release says about that person. No name. No age. No city. No amount. So we won’t guess. The person who made that call had already been defrauded into mailing cash. And they still picked up the phone.

The call, prosecutors say, “led to the discovery of 11 total packages, containing approximately $135,000 in cash.” They don’t say how one call led to eleven boxes, only that it did. And the release does not say those packages all came from that one victim. Each of the packages, prosecutors say, was addressed to a fake name and a short-term rental.

Eleven boxes is a small number next to two thousand. But it was enough to show the shape of the thing. Fake names. Rented addresses.

Prosecutors also say the investigation turned up “several YouTube videos posted in 2020 and 2021 that helped identify other members of the conspiracy.” We come back to them below.

Who was on the other end of the address?

No one with that name. The plea agreement says it plainly: “Recipient names were fictitious names; recipient addresses were for short-term rentals.” The names and addresses came from the conspirators.

So the box wasn’t going to a bank, or an office. It was going to a real front door. A rented one. Addressed to a name that belonged to no one. From the victim’s side, the address looked like any other: a name, a street, a number.

Then the pickup, in one sentence of the plea agreement: “Using fraudulent driver’s licenses or IDs matching fictitious recipient names, members of the conspiracy in the United States then retrieved the victim packages.”

That’s the design of the address. The name was fake, so the box pointed to no one. And it matched an ID, so someone could still collect it.

The doors didn’t stay put either. The plea agreement says members “booked short-term rentals in a hub-and-spoke pattern,” and “after some time, members of the conspiracy would relocate to a new location and continue the pattern.” Even the address a victim was given was temporary.

And the victims’ money paid for the doors. Among the ways fraud proceeds were used to promote the scheme, the plea agreement lists two that point straight back at the box: “to pay cash to co-conspirators for retrieving victim packages” and “to pay for short-term rentals used as part of the scheme.”

A rental that changes. A name that never existed. An ID that matches no one real. Every piece of the address was built to disappear.

Where did the cash go after the box was opened?

It kept moving, the plea agreement says. On two days, it gives dates for bulk cash from the scheme being driven onward.

In March 2021, members of the conspiracy were operating the scheme in another state. On 4 March 2021, a co-conspirator drove with “approximately $70,000 in bulk cash” concealed in his vehicle. Eight days later, on 12 March 2021, the lead defendant and two co-conspirators drove with about $120,860 in bulk cash, concealed in the vehicle and on the lead defendant’s person.

In both instances, the plea agreement says, the cash was being taken to other members of the conspiracy “so it could be further laundered.” That was the purpose. It is not what happened to the second load: prosecutors say both drives were stopped by law enforcement, and that the second time “law enforcement seized $120,860 in fraud proceeds.”

These are the only two moments the plea agreement describes. The records we read don’t trace the rest of the cash.

That’s the direction the money travels. Out of a bank account. Into a box. Into a rental. Into a car. Further away at every step. For a victim, that’s the hard part. Cash in a car has no chargeback, no recall, no bank on the other end to call. Which is why the moment before the box is sealed matters most.

And the scheme didn’t begin or end in those cars. The plea agreement says “a substantial part of the fraudulent scheme was committed from outside of the U.S.” The calls came from call centers overseas.

Was the refund scam the only script?

No. The plea agreement says the conspiracy operated “a series of tech support, bank impersonation, government impersonation, and refund scams (as defined in the Indictment).”

When this case’s indictment defines a bank impersonation scam in general, it uses a word readers of our article on a gold bar courier case may remember: criminals told victims “that their accounts were compromised.” That is a definition, not a link. Nothing in these records ties this conspiracy to that case.

Here’s what this case shows. The whole machine ran on one step it couldn’t take without the victim: their own cash, in a box, on its way to a name that didn’t exist.

How did investigators find people hiding behind fake names?

After that one call, prosecutors say, partly with help from YouTube videos. Prosecutors say videos from two YouTube channels “helped law enforcement identify multiple defendants and uncover the structure of the fraud conspiracy.” They say the videos helped identify three specific people, and “all three are named in the indictments.” Charged, that is. The records we read don’t say how their cases ended. We are not naming them, and we are not showing or describing those videos here. The court record is enough.

Then the case moved through the court:

• May 2025 — a grand jury returned a superseding indictment, the docket shows.
• August 2025 — prosecutors say a nationwide takedown of “28 alleged members” followed.
• June 2026 — by then, prosecutors say, more than 30 defendants had been publicly charged in related indictments.
• 30 June 2026 — the lead defendant pleaded guilty to two counts: conspiracy to commit mail and wire fraud, and conspiracy to launder monetary instruments. For the money laundering count, the plea agreement says he took part from about 2020 until his arrest. In the same announcement, prosecutors reported guilty pleas from others in the scheme.
• July 2026 — the court accepted his plea, the docket shows.

From one call in December 2020 to a nationwide takedown in August 2025.

What happens to the lead defendant now?

He has pleaded guilty and is awaiting sentencing. In August 2026, the docket shows, a pre-sentence report was filed. Then it shows motions to continue, and an order on them. The public records we could read show no new sentencing date, and none of the Justice Department announcements we checked reports a sentence for anyone in this case.

So the case has its admission, but not its ending. The sentence is the court’s to decide.

Remember that phone call, the one that opened the case? The person who made it still has no name in these records. In the prosecutors’ telling, the case starts there anyway.

How to spot it

These are the signals the court records describe. Each comes with a question to ask yourself, not the caller.

A refund that came in too big. Counter-test: ask yourself who told you about the extra money. A real refund doesn’t come with instructions to send money back. If someone says you were refunded too much and wants the difference returned, that is the scam this case’s indictment describes.

A message that wants you to call. Counter-test: ask yourself where the number came from. In this scheme, the plea agreement says, pop-ups, emails and calls existed to get victims to call the scam call centers. If a pop-up tells you to call a number, don’t call it.

A request to install software. Counter-test: ask yourself why a refund needs your screen. In many instances here, the plea agreement says, that software was used to see how much money a victim had. Hang up, and check your account yourself, without their software.

Cash, hidden, in a package. Counter-test: ask yourself who benefits from the hiding. No real bank, company or agency asks you to hide cash in a package and mail it to a name you don’t know. If the instructions include hiding it, that alone tells you who wrote them.

A name and address you don’t recognize. Counter-test: ask yourself why your cash has to go to a stranger. In this case, the plea agreement says, the names were fictitious and the doors were rented.

What to do if it is happening to someone you love

Don’t wait for proof. If someone you love mentions a refund that has to be paid back in cash, that’s enough. Call them. Then call their bank, and, if a box already went out, the carrier. Prosecutors say this investigation started when one elderly victim contacted the express mail carrier.

Never send cash by mail. The Federal Trade Commission put it bluntly in a 2018 consumer alert: “never, ever send cash by mail.”

Report it. File a complaint with the FBI at ic3.gov and with the FTC at ReportFraud.ftc.gov.

Know what restitution means here. In this case, the restitution in the plea agreement is still to be ordered, and no record we read shows anything paid back. Restitution that is still to be ordered is not a refund.

The box, again

Remember that box? It was sold as a refund going back. It was the last step the scam needed from the victim. And one call about it was the first step of the case.

That’s the part you can use. Not anyone’s name. The pattern.

Everything here comes from the public record of case No. 3:25-cr-01097 in the U.S. District Court for the Southern District of California: the lead defendant’s plea agreement (June 2026), the superseding indictment (May 2025) and the docket, plus two U.S. Attorney’s releases (April and June 2026). No victim or defendant is named. What the indictment says is allegation; what the plea agreement says is one defendant’s admission; what prosecutors say is the government’s summary; the sentence has not been decided.