In October 2024, retired minister Louis Vellia Jr. received an alarming email claiming someone had purchased Bitcoin using the bank debit card tied to his PayPal account.

Through a series of online and phone interactions, the 72-year-old Beaufort County resident was directed to “reimburse” PayPal by withdrawing cash from his bank and feeding it into a cryptocurrency ATM at a nearby convenience store.

At first, “everything sounded normal — the email, you know, was perfect. I had no reason to believe it was not,” he says. But the next day, the bank alerted him to irregular account activity.

Vellia reached…