How a Miami Student’s Package Scam Came Crashing Down

It was the summer of 2023, and Matt Bergwall, a skinny 21-year-old University of Miami student, was lounging in an infinity pool in Dubai. Beside him was his girlfriend, a blonde Zeta Tau Alpha. The silver Cuban link chain on his wrist glistened as he held his phone high to snap a selfie, the city’s artificial palm-shaped islands splayed out along the horizon beneath them. Over the next few days, they swam in the pool and posed on their hotel balcony, posting a steady stream of pictures to Instagram. In one, he leans back on the edge of the pool, finger to the sky. “Eventful finals week,” he captioned it.

None of Bergwall’s friends at school had a firm grasp of how the sophomore — a self-styled fintech whiz, Marc Andreessen with a zoomer perm — had money for the Tesla he drove or the Gucci he wore or, for that matter, the room in Dubai. But who could care when Bergwall was ordering everyone Ubers and paying for tables at nightclubs and pitching in for yachts on Biscayne Bay? When he had the ear of venture capitalists at networking events in Brickell, Miami’s finance district? Okay, yes, his life had seemingly been enhanced exponentially, improbably, over the past year and a half — but wasn’t everything sort of improbable at UMiami? Wasn’t this the very place where Alix Earle had, by the end of her junior year, gained millions of followers for her “Get Ready With Me” videos? Where fraternity parking lots were filled with Lamborghinis and pledge classes with the children of billionaires who drove them?

One day several months later, Bergwall’s friends were hanging out on campus when the question they weren’t asking was accidentally answered via a text from a young woman’s father. A UMiami student had been charged with orchestrating a cyberscam that allegedly cost retailers millions of dollars, he wrote her, and was facing up to 45 years in prison. “We looked at each other and were like, ‘Oh my gosh, what if it’s Matt?’” she told me. “And then we opened the article and it actually was.”

Bergwall grew up in Darien, Connecticut, in a house not far from the leafy Woodland Park Nature Preserve. His father was a successful real-estate executive and his mother a VP of training and development at Chase. He was a quiet, smart child who was constantly on his computer. In middle school, that meant hours and hours sucked into the freewheeling virtual world of Minecraft.

Like any kid born after 2000, and especially a kid who enjoyed building custom gaming servers for his friends in his spare time, Bergwall spent his teen years observing the rise of a specific kind of demigod — from Satoshi Nakamoto to the market-moving mobs of r/WallStreetBets to Sam Bankman-Fried, the world seemed to belong to whoever could articulate the most absurd vision of how to finance it. Low interest rates fueled precipitous valuations, minting fortunes on laughable balance sheets. Crypto alchemy transmuted monkey NFTs into mansions. Bergwall’s own entrepreneurial streak first manifested in the hallways of Darien High, where former classmates say he sold vapes, an easy hustle at a time when school bathrooms were overflowing with kids hitting their mango-flavored Juuls between classes. On Instagram, he carved out a sideline buying accounts, growing their followings artificially, and selling them online. He soon moved on to freelance software engineering, building a website for an online community of Grand Theft Auto players. Bergwall’s friends were impressed but a little unnerved by how he used his skill for software engineering. Former classmates said he would install files on school computers that would crash them, that he’d hack into security cameras; there were rumors that he had changed his friends’ grades. When it started to seem like he might get in trouble for selling his peers access to discounted Spotify Premium accounts, his friends said, they “were able to convince him, like, ‘Hey, man, this probably isn’t the hill to die on,’” one told me. That friend said that when Bergwall boasted about his exploits, he tended to focus less on the money and more on “how cool it was that he was doing something vigilante.” Of course, the money was cool too. When Bergwall hosted a party, he would often buy alcohol for everyone. Per the friend, “It was clearly all coming from his own pocket.”

His senior year, he got a 40-hour-a-week job at Mirador, a financial-services company in town, at which he’d interned the summer before. This meant that in addition to his regular high-school course load, saxophone practice, and running sound for the school auditorium, he was spending his nights and weekends consulting on genuinely professional software projects. He described the role on LinkedIn as “truly a full stack project, managing design, development, and project management.”

Given his résumé, some of his friends expected him to go to an Ivy. Instead, he enrolled at UMiami, where he planned to double major in computer science and management. But in December 2019, halfway through Bergwall’s senior year, his father died of cancer. Devastated — “I do not know how I will move on from this. Right now I feel like I will never move on,” he wrote on Instagram — Bergwall decided to take a gap year and focus on making more money. He stayed on at Mirador and added a second job at a Boston-based crypto start-up called Flipside. In October 2020, he went on a podcast called Dharma Unfiltered, hosted by UMiami student Reed Kastner-Lang. Bergwall had yet to matriculate; he and Kastner-Lang found each other in a Snapchat group for incoming freshmen with an interest in entrepreneurship. “You’ve tasted a lot of different things within the computer-science industry,” Kastner-Lang said to Bergwall. “Down the road, what do you see yourself doing?” Bergwall explained that, actually, his thinking had shifted lately. He once dreamed of working as a software engineer at Google. Now, “I don’t want to be a slave for Google,” he said. “I want to build something. I want to run something.” When his gap year ended, he quit Mirador, reduced his hours at Flipside, and moved to Miami to begin in-person classes in the spring of 2021.

By the time he arrived, Miami had already taken its place as a haven for a particular flavor of techno-optimist capitalist: libertarians, crypto bulls, and OnlyFans agencies. The city promised a launching pad for a gifted young software engineer to step off the traditional career track — the kind of thing expected in stuffy, old-money Darien — into a lifestyle on the bleeding edge of the new-money grind-set. Bergwall was not alone among his classmates in idealizing this. The campus is overrun with wannabe digital players, several students told me. Everyone is an influencer; everyone is launching a brand. Only months after she graduated in 2023, Earle established the Alix Earle Scholarship for any other “aspiring entrepreneur” with the “ambition to be a changemaker in the world of business.” (The application asks for a two-minute video answering the questions “What impact would this scholarship have on your educational and career goals?” and “Why is it important to you to be a student at the University of Miami?”)

“A lot of kids come to Miami and try to emulate the lifestyle,” said Jesse Fromer, a recent graduate who grew up in South Florida. He said he sees the school’s culture as downstream from the ostentatious flexing of the city’s most visible residents — club promoters, influencers, VC bros. The cars are more than likely rented, the jewelry fake. “But if you’re not from here, it’s hard to tell what’s real and what’s fugazi,” said Fromer. Adding to the pressure are the expenses of the social life and keeping up appearances: While young women typically don’t pay covers for nightclubs and boat parties, young men are often expected to buy tables and rent boats for thousands of dollars a weekend. The status anxiety on campus is acute, Fromer said, because of how ostentatiously rich the upper crust of the student body is. Like Bergwall, many students come from Northeast suburbs where they might have gone to private schools and thought of themselves as wealthy. But the richest students at UMiami are a different breed — trust-funders released from any sort of East Coast stealth-wealth sensibility.

When Bergwall moved to a campus dorm, he fell in with a group of friends in his building. Bergwall was a year older, given his gap year, and struck them as suave and intelligent. “He seemed put together,” said one. While many of the guys in the group projected machismo, Bergwall displayed a sensitive side. He let a female friend in his building teach him how to take care of his curly hair.

Bergwall was also quick to embrace the Miami party life. His friend posted a picture of him, a year into his time in college, lounging in a hot tub on a yacht, shirtless in sunglasses and drinking from a red Solo cup. (He captioned it, “Boat fit for a Bond villain.” Bergwall commented back, “sometimes you need to play the part.”) As the months went by, he started dressing flashier, leaving behind the preppy button-ups of his New England youth. He motored around campus on an electric skateboard and told classmates he’d bought a matte-gray Tesla, which he started posing with on Instagram.

He leaned way into a tech-guru persona, describing himself on LinkedIn as “Serial Entrepreneur | Venture Capital Catalyst | Igniting Innovation & Growth.” During a business-class lecture in which the professor asked students not to use their laptops, Bergwall “would be the only one with it out,” Fromer said. “Like, ‘Sorry, Professor, it’s for work.’” Work, ostensibly, was his new venture fund, EJB Investments. After class, he’d go to networking events for VCs and founders in the sleek high-rises of Brickell. At these, according to a friend, he’d talk up the fund, adopting a hyperconfident online business jargon and claiming that he managed more than $1 million in assets. “I’ve been an entrepreneur since my early days. I’ve always been passionate about building technology that didn’t exist yet and finding new ways to solve complex problems,” he wrote on LinkedIn. Over the course of his freshman year, he told friends that the firm had invested in several local companies, including a beverage-ordering app and a concert-promotion business; it also launched an NFT project called Skeletal Cats. By his sophomore year, Bergwall had become the kind of guy who could walk up to the hottest clubs near campus and skip the line because he knew the bouncer. “He was just crazy connected. Like, it seemed like he knew everyone and that if you worked with him or were friends with him, you would have a great time and you would be in his circle and, like, you would be successful,” said a student who was in a fraternity with one of Bergwall’s friends. On Instagram, he posted pictures of himself dripped out in a Gucci belt, a Stone Island pendant, and a $41,000 Rolex President Day Date. Toward the end of his sophomore year, he started taking his girlfriend on lavish trips: Dubai in the summer of 2023, then Tulum. High-school friends watching on Instagram couldn’t believe his glow-up: “For this wannabe Ken doll to pop out of nowhere, it was shocking,” one said. “People were like, ‘Where the hell is he getting all this money from?’” One student who worked at a finance firm was skeptical of what Bergwall told him: that the money came from his VC firm’s investments paying off. “In VC world, it takes about three-to-five years to exit,” he told me. “And he launched it, like, nine months before he met me. So I was like, ‘How are these making you money right now?’”

A few months ago, I bought a $60 toaster on Amazon that just would not heat up enough to toast bread. I wanted my money back. But repackaging the toaster and dropping it off at a post office seemed like too much of a hassle. So I did something slightly nefarious: I logged on to Amazon, opened the customer-service chat window, and told the outsourced worker on the other end that my toaster had never arrived. The agent apologized, asked zero follow-up questions, and immediately refunded me $60. I had committed a common, low-grade version of a type of fraud that has proliferated in recent years as massive online retailers flood the world with packages and offer customers frictionless returns. Often referred to simply as refunding, it involves finding ways to get money back for products people have not actually returned. A lot of refunding is perpetrated by sophisticated cybercriminals who trick retailers and shipping companies at scale, obtaining high-value products in bulk and reselling them online to customers who want watches, computers, or other expensive items for cheap. According to a December 2023 report from the National Retail Federation, retailers lost $101 billion from return fraud last year.

Refunding first emerged alongside the early-2010s explosion in online retail and typically involved simple methods like buying items and claiming they never arrived (like my toaster). But as companies caught on, tactics evolved. In 2019, a fraudster who went by Bob published Bob’s Refunding eBook, which collected a number of methods that had been circulating on hacker forums and other underworld sites. (Nowadays, such tips circulate mostly on Telegram, the anonymous chat app on which much contemporary fraud is coordinated. The community is crass, like 4chan refitted for the zoomer mind: Refunding chat rooms with thousands of members host a flood of racist memes, slurs, cat GIFs, and extreme porn mixed in with advice on fraud methods.) Bob is credited in fraud circles with popularizing FTID — Fake Tracking ID, wherein the scammer returns an empty box to a retailer but edits the shipping label provided by the company to an address that is slightly different from the warehouse where returns are meant to go. The package gets scanned by, say, UPS when it’s picked up, allowing the customer to claim a refund, but it will never arrive at its destination.

There are other FTID methods. One involves writing addresses in special dissolving ink, which is legible when the package is picked up and scanned by the delivery company but invisible by the time it arrives at its destination; the courier on that end is unable to deliver the empty box, allowing the customer to claim a refund. The gold-standard method is what’s known as “insider” — scammer slang for compromised retail- or shipping-company-employee accounts that allow the scammer to directly submit false information about a package. Scammers can contact insiders either by bribing logistics employees or hacking their computers. But recently, as refunding has become more popular, insiders have started to reach out directly to fraudsters on Telegram, offering back-end access to the companies at which they work in exchange for a cut of the scheme. However they’re come by, having an insider allows the scammer to skip the more irritating steps of the scam — shipping empty boxes or Photoshopping false labels — and simply input a scan of a box that doesn’t exist, then change its status from “In transit” to, say, “An emergency situation or severe weather condition has delayed delivery.” Voilà — the scammer can demand a refund. Fraudsters are constantly testing retailers to see how much they can get away with buying without sparking an investigation. But still, many investigations into refunding operations are currently underway, in part thanks to a former cybercrime fraudster turned FBI consultant named Brett Johnson.

In 2022, at one of his regular check-ins with FBI agents in Alabama, Johnson mentioned the surge in refunding fraud he’d begun seeing on Telegram. The agents were intrigued. The sheer volume of the crime, and the brazenness with which its practitioners were discussing it, opened up a potential enforcement gold mine. “They see that, Well, shit, it’s pretty easy to identify these guys,” Johnson told me. “Operational security is very low. They talk too much: They post screenshots of actual orders, they share drop addresses, real names — things like that.” The agents began trawling through the underbelly of the fraud internet, identifying major players. According to Johnson, their list eventually grew to more than 300 people, including Matt Bergwall.

Bergwall’s alleged refunding operation was fairly sophisticated. When his indictment was unsealed on November 9, it revealed he’d allegedly facilitated nearly 10,000 fraudulent returns between December 2021 and April 2022, which “resulted in more than $3.5 million in lost product and sales revenue to victim-retailers.” (More recent court filings list the total value at $5 million.) The indictment also alleged that Bergwall got high on his own supply, so to speak: He refunded a number of products for himself, including a “$41,000 Rolex President Day-Date watch, a $600 TeamGee H20 Electric Skateboard, a $350 Samsung 43-inch Smart UHD TV, and an $80 pair of Reebok shoes.” His alleged operation, called UPSNow, was run, like most refunding operations, on Telegram, where he went by the pseudonym MXB and worked alongside a number of unindicted co-conspirators. He specialized in FTID with a powerful edge: The government claims that Bergwall hacked into five employees’ back-end accounts at “a multinational shipping, receiving, and supply chain management company” confirmed by sources to be UPS.

An archive of the UPSNow Telegram channel shows the complexity of running a business like his. “Our infrastructure is that of a legitimate company,” MXB bragged in the channel. “We have 8 full time employees and have the ability to scale.” Still, there were challenges. Primarily that his customers seemed to be young scammers themselves — and could be incredibly demanding when it came to updates on their orders. Over time, they seemed to drive MXB up a wall. “I want to apologize for snapping at you guys, but please realize what is on our plate right now. We do not have the time to be asked ‘yo ETA on scans?’ or ‘r scans online?’” MXB posted in the channel in March 2022. “So, we will be continuing to be assholes to those who deserve it. Customer service skills are out the window until our service gets resolved. Sorry. Not here to make friends.” Or: “Oops i just woke up, late night at the clubs, will be going thru dms shortly.” MXB often seemed overwhelmed — not surprising given that he was allegedly overseeing a multimillion-dollar fraud ring while juggling school, VC networking, and a highly active social life. “Y’all mfs start assuming shit’s patched sooo fast,” he wrote on March 7, 2022, when customers were complaining about delays in service. (By “patched,” he meant UPS resolving his insider access.) “Shit ain’t patched trust me i’d tell you if it was. give me a sec to finish giving the UPS ceo a handjob so we can get it back up and running.” A few minutes later: “wishing i was the ceo of ups .”

Three days later, he posted a long message. “I have an unfortunate announcement to make. UPS has started to catch on to our little scheme here,” he wrote, urging patience. “If people freak out like they did last time claiming the world was burning, I won’t be as transparent with you guys. We are the ONLY service currently up and running for UPS instant scans. There is quite literally NO alternative for you guys to go to, so just be patient.” He continued, “We are fighting a company with hundreds of employees whose sole purpose is to prevent the fraud we are doing.” Later, he reminded everyone, “Working against a billion dollar company is quite the hard thing to do.” He signed it “mxb .”

Eventually, the stress caught up to him. “im literally going to scream,” he wrote on March 29. On April 3, a post in the channel announced “the acquisition of UPSNow” by another fraud company called iFruit Services. Seemingly unable to deal with everything on his plate, MXB sold his black-market company and left the business. It was a year and a half before his arrest.

One of Bergwall’s closest college friends had kept in touch with him in the months following the indictment. “I’m obviously concerned, as I would be for anyone else. You know, make sure he’s doing all right, check in where I can,” he said. He kept conversations casual: “Just shoot the shit, you know, be boys, and try to make the time go by, be as normal as you can be, as it was prior.” According to Fromer, the recent graduate who had a class with Bergwall, students were generally impressed by his entrepreneurial moxie. Fromer summarized the reaction as: “So yeah, he’s a scammer, but good for him.” He added, “This type of fraud, at that high of a level, obviously would have come from UM.”

On Telegram, the reaction was less sympathetic. “Looks like twerp,” one user wrote in a fraud channel with a screenshot of Bergwall’s LinkedIn profile picture. “Timmy turner ass.” Another user posted a meme of a stick figure standing in the corner of a party Photoshopped with Bergwall’s face, captioned “THEY DON’T KNOW I HACKED UPS.”

Posters speculated on how he’d gotten himself arrested: “I’m betting that $40k watch got him some attention too. SMH🙈,” one wrote. “Damn I finessed 4 of those same TeamGee H20s,” posted another. Everyone seemed to be wondering who might be next: “After bergwall got clipped they lookin prolly in every chat,” one wrote. “More than 200 feds in here.”

That poster is broadly right. Soon after Bergwall’s arrest, the FBI announced a major anti-refunding sweep called Operation Chargeback and indicted the members of several large refunding crews. And in December, Amazon filed a lawsuit against one in particular, called REKK. The suit, which named more than 20 people, accused REKK of marketing itself on Telegram as a service “offering fraudulent refunds to individuals around the world.” It also claimed that REKK paid thousands of dollars in bribes to seven Amazon “insiders” to help them process refunds.

According to one person I spoke to, Amazon was one of the companies allegedly defrauded by Bergwall, and it supplied information to investigators to help corroborate their findings. (While court filings don’t list any of his targets, more advanced refunders like Bergwall tend to go after places like the Home Depot, Nike, and, yes, Amazon — large international companies, with customer-friendly return policies, selling items with a high resale value.) When I reached out to Amazon for comment, its vice-president of business conduct and ethics offered me this: The company is addressing this issue “head-on” through “the development of tools that use machine learning models to proactively detect and prevent fraud.” Plus, the VP told me, Amazon is turning people in whenever it can. “When bad actors attempt to evade our controls, we take action and work with law enforcement to hold them accountable.” The problem for it is these “bad actors” don’t seem to care much. “They immediately reoffend the moment they can get out on bail,” said Allison Nixon, chief research officer at the cybersecurity firm Unit 221B, who has investigated young cybercriminals. Nixon said she understood the popularity of refunding and similar scams within the larger “make money online” ecosystem, popularized by people like Andrew Tate. These young scammers are, to her mind, looking at their lives and making a fairly rational set of economic calculations. Bergwall is not the only one who doesn’t want to be a “slave for Google.” Google laid off 12,000 people last year. AI is rapidly rendering these once-valuable jobs useless. And sitting at a desk coding all day can start to seem kind of ridiculous when — with the right skill set and some daring — there are so many different ways to avoid sitting at a desk coding all day. And make much more money.

Bergwall has pleaded not guilty. Although he hasn’t been a student at UMiami since spring 2023, according to the school, he seems to be living like everything is copacetic, going to nightclubs with college buddies and recently popping up in a friend’s photo at Ultra Music Festival, a Miami EDM fest. His girlfriend (now ex) told sorority sisters after he was arrested that she expected everything to get sorted out. Which might still happen. In December, he was granted permission by the judge to leave Florida to visit his family in Connecticut for the holidays. Johnson, the former fraudster, believes that such lenient treatment is a sign of a cooperation agreement. “So far, the numbers of those refunders choosing not to cooperate can be counted on one hand,” he said.

And then there’s Bergwall’s public activity on the coding website GitHub, where I have watched him in recent weeks posting regular updates to a project titled “Telegram-monorepo.” This appears to be an AI bot designed to trawl Telegram for information. Buried in the code is a list of scam-affiliated keywords the bot seems to be hunting for. (For instance: logs, ftid, scans, refund, refunds, flights, uber, airbnb, rental.) In other words, Bergwall has built a tool to scour Telegram for people committing some of the very crimes he’s currently facing charges for and denying participation in. The existence of the tool raises the possibility that he’s working with the FBI to identify new targets as part of a cooperation agreement, though his lawyer declined to comment on this and the project was scrubbed the day after I asked about it. (His lawyer also declined to comment when I asked if the case would go to trial. He did say that several claims in this story were inaccurate but declined to specify which.)

Even without Bergwall, refunding rolls on. Recently, I messaged iFruitVouches, an account seemingly affiliated with the one MXB sold his channel to. I asked if the company still offered refunding services. “Yes I do Ups insider scan,” it replied minutes later. “I’m always available.”