A federal employee just pulled off a brazen million-dollar heist—and his weapon of choice? Fake invoices and PayPal accounts.

James Montoya spent his days working IT for the U.S. Geological Survey. But behind the scenes, he was running a different kind of operation. He created three bogus PayPal accounts, each tied to fabricated IT vendor companies that existed only on paper. Then came the clever part: he funneled over $1 million in government funds straight into his own pockets through these phantom businesses.

The scheme unraveled when auditors noticed irregular payment patterns. What looked like routine vendor transactions were actually self-directed transfers disguised as legitimate IT services. Montoya had been exploiting his position and technical knowledge to manipulate the payment system—a reminder that insider threats remain one of the toughest security challenges, whether in traditional finance or decentralized systems.

This case highlights a timeless problem: when trust meets opportunity without proper oversight, even established institutions become vulnerable. Payment platforms, centralized or not, need robust verification mechanisms to prevent such exploitation.