How Florida retiree lost $200K in fake PayPal refund scam

Brian Oliver is retired, sharp and financially savvy enough to have a stock-and-bond portfolio worth hundreds of thousands of dollars. He is not the type of person you picture getting scammed. That is exactly why scammers picked him.

What happened to Oliver, 85, is the kind of story that makes your jaw drop, and your stomach turn at the same time. It started with a routine-looking email and ended with a box of gold coins rolling away in the back of a black Mustang. In between, Oliver lost $200,000 and nearly half of his retirement savings.

He told his story on my Beyond Connected podcast at getbeyondconnected.com, along with Detective Justin Torres of the Gainesville Police Department in Florida. What they shared together is equal parts chilling and clarifying.

Sign up for my FREE CyberGuy Report

BEWARE FAKE CREDIT CARD ACCOUNT RESTRICTION SCAMS

Brian got an email that said PayPal owed him money. It was not a wild claim. He had dealt with PayPal before and figured, "Maybe they found some money for me." So he responded. The email included a phone number, and that number connected him to a man who called himself Andrew Johnson.

"Yeah, we have $450 for you. Type in the number 100 on your computer and we'll get it started."

Brian typed 100. Andrew immediately said he had made a mistake: "Oh no, you put in 10,000."

Brian pushed back. He said he did not type 10,000. Andrew told him to check his Bank of America account. Brian opened it, and there it was: $10,000 sitting in his checking account.

Except it was not real. The scammers had somehow mirrored his bank's website. What Brian saw looked exactly like his actual Bank of America page, complete with a new balance and a phone number embedded in the "Contact Us" section. That number was fake, too.

Brian called it. A man named Josh answered, identifying himself as a Bank of America representative. He told Brian that the only way to return the money without triggering a $3,500 tax penalty was to withdraw $10,000 in cash and feed it into a crypto ATM.

Oliver had never heard of a crypto ATM before that day. Josh helpfully told him exactly where to find one. It was in a sketchy part of town, and Oliver walked in carrying $10,000 in his pocket.

"I'm on my knees, on a cement floor, and I'm 85," Oliver said.

He fed one hundred $100 bills into the machine, bill by bill, watching over his shoulder the entire time. Some bills got kicked back out. He fed them in again. When the machine finally accepted all of them, he photographed the receipt and sent it to Andrew Johnson, just as he had been instructed.

Then Oliver went home and told Andrew it was done. Andrew told him they still had to take care of his refund. He told Oliver to type in the number 200.

FAKE PAYPAL EMAIL LET HACKERS ACCESS COMPUTER AND BANK ACCOUNT

Oliver typed it. Andrew's response came fast: "Oh my God, my boss is going to kill me. It's $200,000 we've transferred to your account."

This type of scam is becoming more common, and it often involves criminals impersonating trusted platforms like PayPal.

"PayPal does not tolerate fraudulent activity, and we work hard to protect our customers from evolving phishing scams," a spokesperson for PayPal told CyberGuy. "We always encourage consumers to learn how to spot the warning signs of common fraud, including our tips on the PayPal Newsroom for identifying phishing emails that attempt to impersonate trusted brands. We further recommend contacting Customer Support for assistance through official channels such as the PayPal app and our Contact Us webpage, and never responding to suspicious, unexpected emails."

Oliver opened his bank account again. The fake mirrored site showed $200,000 sitting there. Josh Wilson was back on the phone with a new plan. This time, the crypto ATM would not work because the amount was too large. Oliver needed to liquidate $200,000 from his stock and bond portfolio, convert it to cash and use it to buy gold coins.

Oliver protested. He told them to just reverse the transfer. They said it was impossible.

"This is my retirement money. 50% of my retirement money," he said.

The scammers told him not to breathe a word to anyone. Josh specifically warned him that telling his broker the truth could trigger tax problems. So Oliver called his broker and said he had his eye on a piece of real estate he wanted to flip. The broker processed the sale without question.

YOUTUBE JOB SCAM TEXT: HOW TO SPOT IT FAST

Oliver went to a gold coin store, wrote a check for $198,560 and waited two to three days for it to clear. Andrew Johnson stayed in regular contact the entire time.

When the gold was ready, Johnson gave Oliver one final instruction. A courier would come to his door to pick up the box. Before handing it over, Oliver should ask the courier for a password. The password was "blue."

The courier arrived. He was driving a black Mustang. He said the word blue. Oliver handed over the box.

"He told me the password," Oliver said. "I handed the box, and off went my $200,000."

The day after the courier left, Andrew Johnson called back with urgency. He told Brian Oliver another $200,000 had landed in his account, and they needed to do the whole thing over again. That was the moment it broke.

"That's when I came out from under the ether of this scam," Oliver said. "And I said, this cannot be right."

He immediately called the Gainesville Police Department.

Detective Justin Torres of the Gainesville Police Department took the call and started working the case immediately. The scammers had asked Oliver for photos of the gold and the purchase receipt, which gave law enforcement about a day and a half to set up an operation before the courier was scheduled to return.

Detective Torres pulled in four officers from the department's Gun Violence Initiative unit, a team of intermediate detectives trained for exactly this kind of boots-on-ground work. They set up covert and marked vehicles around Oliver's residence at a careful distance.

"It was pretty high intensity because I'm listening to Mr. Oliver's conversation with Andrew," Torres said. "And I'm also trying to be a good distance away to listen to my radio and be able to broadcast what I need to to the other officers on the outside."

The scammers were suspicious. They kept pushing Oliver to be more compliant. Oliver pushed back. The goal was to keep them on the line long enough for the courier to show up. The courier, a man named Seth Wayne, drove in from Tampa. The officers waited. When he arrived, they arrested him. The case went to trial. Seth Wayne received an 18-year prison sentence.

A federal jury has since convicted a second courier in the same scheme. Atharva Shailesh Sathawane, 22, an undocumented immigrant from India, was found guilty of conspiracy to commit wire fraud and money laundering, with Brian Oliver among his victims.

Sathawane was arrested after the Gainesville Police Department set up a second sting operation at Brian's home. Court documents showed Sathawane was involved in more than 30 transactions across multiple states, contributing to nearly $8 million stolen from elderly victims. He faces up to 20 years on each count, with sentencing scheduled for Dec. 16 in Gainesville, though he is appealing his conviction.

Ten other victims testified at Seth Wayne's trial. They had come from all over the state of Florida, and their stories made Oliver furious.

Some had received fake arrest warrants, official-looking documents claiming their identities had been tied to gun running. They were told the only way to clear their names was to pull their savings and buy gold, which would be placed in a special locker in Washington, D.C., until their names were cleared.

One victim lost $1.8 million. Another lost $4.9 million. A third woman lost over $1 million across two separate pickups by the same courier. Her husband was in hospice care in Florida while all of this was happening. She drained her entire life savings, sold her condo and had to move in with her daughter and son-in-law in Alabama, leaving her dying husband behind.

Once the gold or cash leaves a victim's hands, recovery is nearly impossible. Most of Seth Wayne's deliveries went to parking lots at McDonald's or shopping centers, where he handed the money directly to a controller. One pickup went to a jewelry store, where an employee came outside to collect it. That connection is still under active investigation by the IRS and FBI.

The call centers running these operations are overseas. Higher-level couriers in the United States are still being investigated. The full network is, as Detective Torres put it, "very intricate" and "very complicated."

Seth Wayne himself was a mid-to-upper-level courier. He was also paying other couriers and compensating his handler. When investigators downloaded his cell phone after a judge-approved search warrant, they found evidence that he had researched exactly what he was doing before deciding the money was worth the risk.

SCAMS THAT AREN'T ILLEGAL (BUT SHOULD BE)

The defense of "willful blindness," the idea that a courier can claim ignorance and escape responsibility, no longer holds up in Florida courts. Seth Wayne found that out the hard way.

For a deeper look at what Oliver went through, you can hear the full story on my Beyond Connected podcast at getbeyondconeccted.com.

Detective Torres laid out the most important red flags clearly, and Oliver added a few from painful personal experience. Here is what both of them want you to know.

Scammers manufacture pressure because it works. If someone on the phone is telling you that you must act right now, that is not a real emergency. That is a tactic. Torres put it directly: "They want to make you believe that you have to do all this right now."

If someone calls claiming to be from PayPal, your bank or a law enforcement agency, hang up and find the real number yourself. The number embedded in Oliver's fake bank website looked completely legitimate. It was not.

Literally ten seconds. Detective Torres confirmed what many security experts say: "If you pause these scams for just 10 seconds, many of them will just fall apart." A scammer who is pushed back even slightly will often overreact, and that reaction will feel wrong.

The moment someone on the phone tells you not to tell a family member, friend or neighbor what is happening, stop. That instruction exists for one reason: to prevent you from getting help before they get your money. "Once you start hearing that isolation conversation, that is the biggest red flag," Torres said. "You need to hang up the phone."

Oliver made this one simple: "If you're told to go buy gold, the only reason they tell you to buy gold is because it can never be traced. It's a scam." No legitimate company, government agency or financial institution will ever ask you to buy gold coins and hand them to a stranger.

If you have already bought gold and someone is coming to your home to pick it up in a box, Oliver's advice is direct: "Stop right there. It's a scam."

If someone claims they accidentally sent you money and asks you to return it, stop right there. Real companies fix errors on their own systems. They will not ask you to withdraw cash, buy crypto or purchase gold to correct a transaction.

If you need to check your bank account, use your official banking app or type the website yourself. Do not trust links, screens or phone numbers provided during a call. In many cases, scammers create fake sites that look identical to the real thing.

Scammers often stay on the phone and guide you through every move. That level of control should raise concern. Legitimate companies do not walk you through withdrawing cash, using crypto ATMs or buying gold to solve a problem.

Before moving a large amount of money, pause and call someone you trust. A quick conversation with a family member or friend can shift your perspective. In many cases, that outside voice is enough to stop a scam in progress.

Scammers build convincing stories using real details they find online. This can include your phone number, home address or financial history. To reduce that risk, consider removing your information from data broker and people-search sites. While you can do this manually, it often takes time, which is why some people use a data removal service such as Incogni to help automate the process and keep their information from resurfacing.

Check out my top picks for data removal services and get a free scan to find out if your personal information is already out on the web by visiting Cyberguy.com.

Get a free scan to find out if your personal information is already out on the web: Cyberguy.com.

Brian Oliver lost $200,000, leaving him with only half of his retirement savings. Today, he says he is slowly sinking toward bankruptcy, and the odds of getting that money back are slim. Even so, he chose to go public so others could hear his story before it happens to them. What makes this case different is that it led to real consequences. Detective Torres and his team moved quickly and set up a sting operation. As a result, they arrested a courier who later received an 18-year prison sentence. Meanwhile, the IRS and FBI are still investigating the larger network. However, this kind of outcome is rare. In most cases, victims lose everything and never see justice. These scams are complex, often run from overseas, and are designed to move money fast. Because of that, law enforcement usually focuses on the people closest to the victim and works backward. In the end, Oliver's turning point came during a second demand for money. At that moment, something felt off, so he paused. Then he said, "This cannot be right." That instinct matters. In many cases, that brief pause is enough to break the scam.

If you were in Oliver's position, at what exact moment do you think you would have stopped, and what would it have taken for you to make that call? Let us know by writing to us at Cyberguy.com.

Sign up for my FREE CyberGuy Report

Copyright 2026 CyberGuy.com. All rights reserved.