Bridget Johnson is the biggest thief prosecutors in Kenton County, Kentucky, have ever seen—and, they say, the biggest fool.

The 59-year-old divorced mother of two was sentenced to 15 years in prison this week for wiring nearly $4 million in money from her employer to her online love. But Johnson never saw a penny of the proceeds, or even met her boyfriend. The romance, prosecutors say, was a scam, and Johnson was “the golden goose.”

Johnson met her would-be lover on Match.com in early 2017, prosecutors said. (Match.com is owned by IAC, the parent company of The Daily Beast.)

The mystery man told her he lived just one county away—in Fort Thomas, Kentucky—but was staying in Texas until he closed out a business deal, Kenton County Prosecutor Rob Sanders told The Daily Beast. If he could just get a small loan, he told her, he could wrap things up and be by her side in days. Johnson quickly wired him $6,000.

It was a pattern that repeated itself for months, Sanders said. Johnson’s boyfriend would fly off on business, promising to return if she loaned him just a few thousand dollars. Eventually, Sanders said, Johnson drained both her bank account and 401k of nearly a quarter-million dollars. When that well ran dry, prosecutors say, she turned to her employer.

“It’s a very sad case,” Sanders said. “Until she started stealing from her employer in order to try and recoup her own funds, she would have been one of the biggest theft victims we ever had.”

In a last-ditch effort to win back her Romeo, prosecutors say, Johnson began siphoning money from her employer of more than 20 years—the Northern Kentucky Convention and Visitors Bureau. Sanders said Johnson expected her boyfriend to pay her back before anyone noticed the money was missing.

“ Until she started stealing from her employer in order to try and recoup her own funds, she would have been one of the biggest theft victims we ever had. ” — Prosecutor Rob Sanders

Instead, prosecutors say, Johnson stole $4,049,421.14 from the tourism bureau over a 16-month period, writing checks to fake vendors and altering bank records in order to cover it up. Johnson sent the checks to at least eight different people around the country, each of whom kept a cut of the funds before sending it on to bank accounts in China, where authorities say the money trail went cold.

Police arrested one of these alleged middlemen, Keith Tasher of Brooklyn, New York, in the Bahamas in July. Tasher, the owner of three All Star Wireless stores in New York, cashed more than a dozen checks drawn from the Convention and Visitors Bureau account over the last 16 months, police testified this summer.

Tasher allegedly told investigators he was contacted by someone who need help doing business in China, and who instructed him to take a small cut of the money he received before passing it on. Tasher allegedly kept more than $400,000 of the $1,125,000 he received, according to Covington Police Investigator Eric Higgins. His attorney declined to comment.

Tasher is being held in Kenton County pending trial. Johnson, meanwhile, pleaded guilty to charges of theft, abuse of the public trust, and first degree unlawful access to a computer on Tuesday. She was sentenced to two 15-year terms and one 10-year term, to be served concurrently.

Sanders said the man who orchestrated the scheme is still at large and the investigation is ongoing. Current evidence indicates that the middlemen received funds from multiple sources across the country—meaning there could be other victims of the romance scam still to be discovered.

“I don’t think any of the other victims are the size and scope of Ms. Johnson,” Sanders said Wednesday. “I think this guy found himself the golden goose when it came to theft victims.”

He added, “She was just the gift that kept on giving, for quite some time.”