Five indicted over refund scheme leveraging POS glitch

A federal grand jury in Miami returned a 22-count indictment charging five men in connection with a nationwide fraud and money laundering scheme. They are accused of exploiting payment processors and what appears to have been a glitch in POS systems that enabled them to generate millions of dollars in bogus refunds.

The five—Michael Jerry Phanor, John Ngotho, William Lopes, Armani Amado, and Henry Nunez—are charged on Sept. 24, 2025, in the United States District Court for the Southern District of Florida with money laundering and wire fraud offenses. According to the indictment, an earlier-filed criminal complaint affidavit, and statements made during initial court hearings, the five conspired with others to manipulate refund transactions at retail chains across the United States.

Don Apgar, director of the merchant payments practice at Javelin Strategy & Research, speculated in an email exchange that it was an inside job that probably isolated one or a couple of retail chains that used the same POS software that had a glitch.

"It sounds like one of these guys had insider info on this glitch in the [stores'] POS software," he said. "Either they worked at the retail chain or worked for the software company."

Manipulated glitch in split-tender refund process

The indictment alleges the defendants used a "split-tender" method of payment, purchasing merchandise with two debit cards. They then returned the merchandise, in each case securing a refund to the first card while intentionally stalling the process for the second refund by presenting the wrong card, entering incorrect PINs or feigning calls to financial institutions.

Holding the refund transaction open gave them opportunities to trigger repeat refund signals, causing multiple credits to be issued to the first debit card.

"If the POS software was coded correctly, it would have processed the split tender refund as two transactions," Apgar said. "So, when the credit to the second card failed, it would only re-attempt that credit, not start over and re-credit the first card as well."

While one of the five conducted the staged return at the store, others would monitor the account associated with the first debit card and quickly withdraw funds from an ATM or otherwise transfer funds out of the account.

"Normally, refunds wouldn't hit a debit account until the following day," Apgar noted. "But there are new technologies that enable these real-time credits [for example Visa Direct], and so the crooks would have to know that [a store they were scamming] was using newer payout rails so they could grab the erroneous credits in real-time before they were reversed.

"All of this points to a unique scheme to exploit a specific software feature. I don't see this as anything that would happen to the majority of merchants."

After receiving multiple refund credits, the defendants would terminate the return and bring the merchandise to other store locations and start the process all over again. The result was that the conspirators were able to generate tens of thousands of dollars in fraudulent credits from a single purchase.

Stores hit nationwide by 'Money Grows on Trees' collective

According to the charging documents, the alleged scheme was carried out in dozens of stores nationwide, including in Miami, Tampa, New York City, Chicago, Phoenix and Southern California. Apgar suggested it may have been one or two chains with stores in these cities. "They couldn't just run this scam on every store in Miami because not every store had this unique weakness," Apgar conjectured.

U.S. Attorney Jason A Reding Quinones for the Southern District of Florida and Acting Special Agent in Charge Jose R. Figueroa of Homeland Security announced the charges. The U.S. Attorney's office explained in a statement that Homeland Security has been heading up the case, and law enforcement has traced $1.5 million in fraudulent refund credits to the five men and continues to identify additional accounts and transactions.

"The defendants flaunted their proceeds on social media, showcasing private jet travel, luxury vehicles, and bottle service at exclusive clubs," according to the statement, which added that the five had dubbed themselves the "Money Grows on Trees" collective.

Ngotho, Lopes and Nunez were arrested on Aug. 26, during the execution of search warrants at two luxury penthouse apartments in downtown Miami, the statement noted. Ngotho, a citizen of Kenya, and Phanor, a citizen of Haiti, are subject to deportation if convicted of the allegations.

Notice to readers: These are archived articles. Contact information, links and other details may be out of date. We regret any inconvenience.