The alleged scammers would create transactions and then claim they were unauthorized, converting bank refunds into crypto.