turns out they were running a skimming operation