On the first day of the iPhone X release, Avinash ended up with too many phones. After waiting in line, he bought two phones on spec, eventually deciding to list them on Facebook Marketplace for a quick profit. He figured it wouldn’t be hard to find a buyer, and he was right: within hours of listing the phone, he was flooded with offers. But one stood out: someone named Andy Mai was offering to buy the phones for $1,700 apiece, hoping to pick them up that Saturday.

“Obviously, I was pretty taken aback by that,” Avinash says. The buyer arranged to make the exchange outside the 800 Degrees Pizza in Westwood, Los Angeles. He didn’t show up in person, but sent a tall Asian man and another helper, who said they were friends of Mai. After Avinash saw $3,400 come into his Venmo account, he handed over the phones. “Then Monday morning, I get an email saying the funds have been withdrawn.”

It’s unclear why the money was withdrawn, but it’s likely Mai had paid with illicit funds -— either taken from a stolen credit card or a hacked account. Once Venmo caught on to the transaction, the company reversed the charges, sending the money back to its rightful owner. When Avinash told Venmo about the phone handoff, they recommended he contact the LAPD, which pledged to investigate but has shown little sign of tracking down the missing phones. Avinash was left with no phones and was out at least $2,000.

The Verge has identified 10 more victims, totaling over $125,000 in reversed transactions

“This money was going to my tuition and my visa processing fees,” he told me. “With that gone, I’m really in a fix.”

Avinash wasn’t the only victim. The Verge first reported on Mai’s scheme in July, tracking thousands of dollars in reversed transactions tied to camera purchases — but the massive scope of the fraud is only now becoming clear: in addition to the cases The Verge identified this summer, we have identified 10 more victims, totaling over $125,000 in reversed transactions, most of which can be linked to the individual, or group of individuals, who go by “Andy Mai.” The earliest heists date back as far as 2014; the most recent one occurred earlier this month. The stolen goods include phones, camera equipment, handbags, and designer sneakers. Sometimes the scams begin with listings on Facebook Marketplace, other times Craigslist. But each scam hinges on a payment made through Venmo, and they all end with victims handing away their goods and receiving nothing in return.

Through it all, Mai seems to have avoided any repercussions from law enforcement or Venmo itself. Nearly all the victims recall an “Andy Mai” account on both Facebook Marketplace and Venmo — but when they called the number provided to them, a different person picked up the phone each time. With dozens of different people taking part in the scam, police have been unable to make much progress on the case. Occasionally, a security camera would pick up footage of the person picking up, or even their license plate — but police never seemed able to do much with those leads.

The scammers have been careful to cover their tracks. Pickups typically take place at a neutral location; given the choice, Mai favors the Westwood pizzeria, just a few minutes’ walk from the UCLA campus. The pickup person seems to be someone new each time, usually young, male, and Asian.

Eager to get his money back, he set a trap, listing another iPhone X for sale on Craigslist

Most victims tell a similar story, with Mai initially reaching out through Facebook Marketplace, then sending money from a Venmo account with some variation of his name. He cycles through Venmo accounts quickly, often being suspended after a particular scam had gone through. But many victims encountered the same Facebook account on Marketplace, showing a handsome Asian man hanging out with friends. The page listed him as an alumni of a local college, and showed a seemingly normal network of friends. But none of the victims that The Verge spoke to have seen the individual in the Facebook profile in person, so it’s plausible the pictures were stolen or faked. As soon as victims began snooping around in earnest, the account was suspended, and it disappeared from Facebook entirely.

Some of the best leads have come from victims themselves. A victim named Jonathan lost an iPhone X to an Andy Mai using the same Venmo account involved in the Avinash scam. (Since the case is still open, Jonathan asked to not use his full name.) He posted his phone to Facebook Marketplace on November 4th. Mai reached out to him with an offer to purchase the phone for $1,500 and the meet-up was arranged at the same Westwood pizza parlor. A short, pudgy Asian man came to pick up the phone, Jonathan says, not more than 25 years old. When the money came through to his Venmo account, Jonathan handed over the phone — but just like Avinash, the money was gone within 24 hours.

Jonathan connected with other victims over Facebook and began to register the scam’s scope. Eager to get his money back, he set a trap, listing another iPhone X for sale on Craigslist. When Mai responded, Jonathan insisted that they meet him in the courtyard of his downtown Los Angeles apartment complex, planning to confront whoever showed up. Before the meeting, I asked if he was scared. After all, if Mai was involved in organized crime, a physical confrontation could be dangerous. Jonathan shrugged it off. “Absolutely not,” he said. “I will hold this guy down until the police get there.”

He was in for a surprise. When he confronted the courier, the man had never heard of the listing or any reversed Venmo charges. He said he was a UCLA student, and had been paid $200 to pick up the package. The only thing he had in common with Mai was that they both spoke Vietnamese. When Jonathan laid out the broader scam, it was clear the courier had no idea what he was involved in.

The courier had no idea what he was involved in

“He was sweating beyond belief when I cornered him, so I don’t think he was lying,” Jonathan said. “He didn’t really know anything about the guy. He knew his voice, but that’s it.”

Mai has been able to play that trick reliably enough to turn it into an ongoing racket, making a small fortune off unsuspecting phone flippers and other peer-to-peer sellers. The most recent surge of victims has come with the iPhone X release, as line-sitters look to flip Apple’s most expensive phone for a profit. But The Verge was contacted by victims reaching as far back as the iPhone 6 Plus launch in 2014, when Mai bought 44 phones from a reseller for more than $40,000. (All of the money was recalled shortly after the purchase.)

Another incident involved six pairs of Yeezy Zebras, a sought-after sneaker collaboration between Adidas and Kanye West. The victim listed the sneakers for $13,550 in March, near the peak of their value, and lost his entire haul to Mai’s scam. Other users reported similar scams after listing handbags from Hermès and Chanel.

Mai’s scam exploits a little-known weakness in how Venmo works. Outside of a few recent merchant-based systems, Venmo doesn’t provide fraud protection, and recommends users only transact with people they know and trust. That lets Venmo transfer money without taking a fee, but it also leaves users vulnerable to criminals like Mai. If a scammer can convince someone to trade goods for a Venmo payment, they can pay with stolen money and get away clean. Within 24 hours, Venmo will reverse the charges, leaving sellers with no money and no goods.

The victim listed the Yeezys for $13,550 and lost his entire haul

Though Venmo is explicit that it doesn’t recoup losses from fraud, it still monitors for account takeovers and payments that involve stolen money. “As a service of PayPal, Inc, Venmo has the benefit of nearly 20 years of experience in payments security and fraud prevention,” one representative told The Verge. “We have many tools that we use to monitor accounts and transactions that can lead to investigation. If ever a question is raised about an account, our account specialist team will investigate and take appropriate action.”

Venmo’s simultaneous lack of fraud protection and wording about fraudulent account monitoring can be confusing. When Avinash received the fraud warning that accompanied the charge reversal, he assumed Venmo was cracking down on Mai. “If they were proactive enough to block my account for receiving the money,” he says, “how is this person able to keep opening accounts to do this?”

The situation has gotten even more confusing as Venmo has expanded into retail. In September, the company began shipping its own debit cards, and a month after that, it expanded to allow e-commerce payments wherever PayPal is accepted. That leaves a mess of different transaction types that are largely invisible to the average user, some with fraud protections and some without. Crucially, the system leaves peer-to-peer transactions completely vulnerable.

Reached for comment, Venmo emphasized that the product is not intended for actual transactions, and users should only use Venmo retail services with authorized vendors. “PayPal and Venmo are continually working to combat and prevent the illicit use of our services,” a representative said. “We devote significant resources to financial crime compliance, and we proactively refer cases to and assist law enforcement officials in their efforts to identify, investigate and stop illegal activity.”

Still, the scam doesn’t seem to be going anywhere. While Mai’s activities are focused around Los Angeles, The Verge has documented similar heist reports in New York City and the Bay Area. Since our initial article in July, various representatives from the Los Angeles Police Department have expressed a belief that Mai will be caught soon, but there’s been no indication of an arrest or other investigative progress.

In the meantime, Avinash is left looking for someone who can help him get his money back. “I’m still waiting for someone from the police department to get back to me,” he says. “There’s just not a lot of options there.”