GRAYSON COUNTY, Texas – October 24, 2026 (STL.News) A Texas man has been sentenced to 20 years in prison for his involvement in an elaborate PayPal refund scam that defrauded five victims across Texas of nearly $150,000, according to prosecutors.
Bryan Brundige, 54, of Killeen, Texas, received the prison sentence this week following an investigation into a fraud operation that used deceptive emails, fictitious refunds and cash couriers to obtain money from unsuspecting victims.
The investigation exposed a scheme in which criminals impersonated PayPal representatives, convinced victims their accounts had been incorrectly charged, and then persuaded them to return money they had never received.
One of the victims was a 93-year-old Grayson County woman who lost more than $19,000. Her daughter’s decision to photograph the license plate of a person collecting the money helped investigators identify individuals connected to the operation.
The case shows how online financial fraud can extend beyond computers and phone calls, involving organized networks that collect and transport stolen money.
How the PayPal Refund Scam Operated
According to KXII-TV reporting, investigators said the operation began with emails that appeared to come from PayPal.
The messages falsely told recipients their PayPal accounts had been charged for purchases they hadn’t authorized. Victims were instructed to call a telephone number to obtain a refund.
The apparent opportunity to reverse an unauthorized charge was actually the first step in the fraud.
Once victims contacted the number, scammers directed them through what appeared to be a legitimate refund process.
Victims were shown forms that looked authentic and instructed to enter the amount of their supposed refund.
However, investigators said the displayed amounts were manipulated.
For example, when a victim entered a refund amount of several hundred dollars, two additional zeros appeared, making it seem that a much larger refund had been processed.
The scammers then claimed that the victim had received too much money and was obligated to return the difference.
In reality, no refund had been deposited.
The criminals used the fictitious overpayment to persuade victims to withdraw their own money and transfer it to the fraud operation.
In some instances, victims were instructed to deposit cash into Bitcoin kiosks, transferring the money to cryptocurrency accounts controlled by the scammers.
In other cases, scammers dispatched individuals to collect cash directly from victims.
Using physical couriers created an additional layer between the people orchestrating the deception and those handing over their money.
A 93-Year-Old Victim Helped Break the Case
One of the most significant developments in the investigation involved a 93-year-old woman living in Grayson County.
Prosecutors said a driver arrived to collect more than $19,000 from the woman as part of the fraudulent refund operation.
Her daughter photographed the vehicle’s license plate.
That photograph provided investigators with evidence they could use to trace the person collecting the money.
Authorities subsequently connected the investigation to Brundige in Killeen, a city in Central Texas.
The Grayson County Sheriff’s Office worked to identify those involved in the operation.
The incident shows how a seemingly minor piece of evidence, such as a vehicle registration number, can become key to investigating a financial crime.
It also highlights the vulnerability of older Americans to fraud operations that rely on urgency, confusion, and the appearance of legitimate financial transactions.
Although people of all ages can become victims, older individuals may face particularly serious consequences when substantial savings are stolen.
For someone living on retirement income, losing thousands of dollars can affect housing security, medical expenses, and other essential financial obligations.
Prosecutors Identify Brundige’s Role
Investigators said Brundige was paid to coordinate the drivers who collected money from victims.
His alleged operational role distinguished him from those who directly contacted victims through fraudulent emails and phone calls.
The investigation revealed a system in which different participants handled the online deception and the physical collection of money.
This arrangement can make financial fraud harder to investigate because the person who receives the cash may not be the one who initially contacted the victim.
According to KXII, prosecutors identified five victims across Texas, including individuals in Sherman and Gordonville.
Combined losses approached $150,000.
Brundige received a 20-year prison sentence during the week of October 19, 2026.
Investigators have identified three other defendants in connection with the investigation, though the initial news report did not disclose their names. Their cases remain pending.
The allegations against those defendants should not be treated as findings of guilt. Each is presumed innocent unless and until proven guilty in court.
The reporting reviewed for this article did not include the precise criminal charges, court case number, or written sentencing judgment for independent confirmation.
Investigators Recover Assets for Possible Restitution
Authorities also reported seizing assets that could help compensate victims.
Prosecutors said the Bell County Sheriff’s Office seized cash, gold, and motor vehicles connected to the investigation.
Officials said they would sell the assets, with proceeds intended to provide some restitution to victims.
However, the amount ultimately available for repayment has not been established.
Restitution matters in financial fraud prosecutions because a prison sentence does not automatically restore money victims lose.
Even when authorities successfully identify and prosecute those responsible, recovering stolen funds can be difficult.
Money transferred through cryptocurrency transactions, withdrawn in cash, or distributed among multiple participants can be especially hard to trace and recover.
Seizing physical assets can provide a source of compensation, but it does not guarantee victims will recover their full losses.
PayPal Was Not Involved in the Criminal Scheme
Prosecutors emphasized that PayPal itself was not involved in the fraudulent operation.
The criminals allegedly exploited the company’s recognizable name to make their communications appear trustworthy.
This distinction matters because the case involved impersonating a legitimate payment platform rather than wrongdoing by the company.
Fraudsters frequently use the names and logos of established businesses, financial institutions, and government agencies to make fraudulent communications appear credible.
An email containing a familiar company logo does not establish that the message originated from that company.
Similarly, a telephone number included in an email may connect a recipient directly to a criminal operation rather than to an authorized customer service representative.
Consumers should access their financial accounts independently through official websites or applications rather than relying on links or phone numbers in unexpected messages.
Local Prosecutors Warn of Widespread Financial Fraud
Grayson County prosecutors described the volume of attempted financial scams as a continuing challenge for law enforcement.
Assistant District Attorney Don Hoover told KXII that one bank branch in Denison identifies approximately 100 potential scams each month.
The figure refers to potential scams encountered at that particular branch, not a verified countywide total.
Nevertheless, the observation shows how often financial institutions encounter suspicious transactions and customers who may be responding to fraudulent demands.
Grayson County District Attorney John Kermit Hill also warned about the pressure tactics criminals use.
Scammers often try to convince victims they must resolve an immediate financial problem before serious consequences occur.
The perceived emergency can discourage victims from consulting relatives, financial institutions, or law enforcement before transferring money.
Capt. Mark Kosemund of the Grayson County Sheriff’s Office advised consumers to avoid engaging with unexpected communications and suspicious links.
Fraudsters can disguise telephone numbers and email addresses, making messages appear to originate from trusted businesses.
The combination of impersonation and urgency is particularly dangerous because victims may believe they are protecting their money when they are actually transferring it to criminals.
Federal Officials Warn About Refund Scams
The Federal Trade Commission has repeatedly warned consumers about refund and recovery scams.
According to the FTC, criminals may impersonate legitimate companies, government agencies, or consumer protection organizations and claim individuals are entitled to refunds.
The scammers often demand advance payments, sensitive financial information, or transfers through methods that are difficult to reverse.
These methods can include cryptocurrency, gift cards, wire transfers, and cash.
In the Grayson County case, the perpetrators allegedly used a variation involving a fictitious overpayment.
Rather than simply demanding an upfront fee, they made it appear that victims had received more money than they were entitled to.
The supposed accounting mistake then became the justification for demanding repayment.
The critical distinction is that the victims were returning money that had never been deposited into their accounts.
Federal consumer protection guidance advises people to independently verify refund claims and avoid sending money in response to unexpected communications.
Consumers should also be suspicious when someone claims to represent a legitimate business and demands repayment through a Bitcoin kiosk or an individual arrives to collect cash.
How Consumers Can Protect Themselves
Financial fraud investigators and consumer protection agencies recommend several precautions when responding to unexpected refund notices.
Verify the transaction independently. Anyone receiving an email claiming that a PayPal account has been charged should sign in through the official PayPal website or application and review account activity.
Do not call numbers contained in suspicious messages. Fraudulent emails frequently include telephone numbers that connect directly to scammers.
Never return an unverified overpayment. If someone claims they accidentally deposited too much money, contact the financial institution independently and confirm the funds were actually received.
Treat cryptocurrency payment demands as a warning sign. Legitimate refund corrections generally do not require consumers to deposit cash into Bitcoin kiosks.
Avoid rushed financial decisions. Scammers frequently create artificial deadlines or threaten negative consequences to prevent victims from seeking advice.
Consult a trusted person. Discussing an unexpected financial demand with a family member, bank employee or other trusted individual can help identify inconsistencies.
Preserve evidence. Emails, telephone numbers, transaction records, messages, and descriptions of vehicles or individuals collecting money can assist investigators.
Report suspected fraud. Consumers can submit complaints to the FTC at ReportFraud.ftc.gov and notify local law enforcement.
Anyone who has already transferred money should contact the relevant bank or payment provider immediately to determine whether the transaction can be stopped or reversed.
Financial Fraud Extends Beyond Texas
Although this prosecution originated in Grayson County, investigators’ tactics are not unique to Texas.
Consumers throughout the United States encounter fraudulent emails, text messages, and telephone calls involving unauthorized purchases, account problems, and supposed refunds.
The increasing use of electronic payment systems gives criminals opportunities to imitate legitimate financial communications.
However, this case also demonstrates that some operations still depend on traditional methods of collecting money.
Involving drivers who physically retrieved cash from victims allowed the criminals to obtain funds without relying entirely on online transfers.
That combination of digital deception and physical collection creates challenges for law enforcement agencies investigating crimes that may involve participants operating in different communities.
The Grayson County investigation shows how cooperation between victims, family members, prosecutors, and sheriff’s offices can help identify individuals involved in these operations.
A 20-Year Sentence and an Ongoing Investigation
Brundige’s 20-year sentence represents a substantial punishment for his reported role in a scheme that caused nearly $150,000 in losses to five Texas victims.
The investigation also resulted in the seizure of assets that authorities hope will provide some financial relief to those affected.
However, the criminal proceedings are not entirely concluded.
Three additional defendants reportedly remain involved in pending cases, and the ultimate amount of restitution has not been determined.
For consumers, the case warns of the methods criminals use to turn a routine-looking refund notification into a significant financial loss.
An unexpected email, a fabricated accounting error, and a demand for immediate repayment were enough to persuade victims to surrender thousands of dollars.
The investigation also demonstrates the importance of reporting suspicious activity and preserving evidence.
In this case, a photograph taken by the daughter of a 93-year-old victim helped authorities trace the operation and identify an individual who ultimately received a lengthy prison sentence.
The broader lesson is straightforward: a legitimate company refund should never require consumers to surrender their own money based solely on an unexpected email or telephone conversation.
Source and reporting note: This article is based on KXII-TV’s October 22, 2026, report, which included statements from Grayson County prosecutors and sheriff’s officials. General consumer protection guidance was obtained from the Federal Trade Commission. The written sentencing judgment and complete court record were not independently reviewed. Local reporting provides details on Brundige’s sentence, the reported losses, and pending cases.
