Andrew Therrien was getting dunned for payment on a loan he never took out, so he went on a one-man vendetta against loan sharks. He had special skills: not guns, but persistence and persuasion, and he eventually tracked down the company and the man who had made millions by inventing fake debt and selling it to collection agencies.

Therrien soon obtained two crucial sets of documents to that end. In March 2016 he flew to California to meet a debt broker, who handed over some contracts Tucker had signed. Separately, Therrien received an email from the manager of a collection agency, to whose conscience he’d spent weeks appealing. The email, whose subject line read “Have faith in the good in heart,” included actual phantom-debt files, with names and Social Security numbers. The metadata yielded a new name: Rob Harsh, Tucker’s IT guy. (The author of the email died of a drug overdose a few months later.)

In May 2016, Therrien emailed his discoveries to the FTC. A lawyer replied right away: “Andrew, we need to talk about this.” Therrien also gave his intel to some private lawyers who were going after Tucker in Texas. They contacted Harsh, and in August 2016 he submitted an affidavit to the court. Harsh, who declined to comment for this story, testified that Tucker had asked him to manipulate a database of almost 8 million payday-loan applications, writing in a made-up lender and adding an amount owed of $300 for each person.

Therrien had been right all along.

What’s discouraging, though, is that there were all these cracks in government regulation in the first place, and that the agencies that should have been hunting down and crushing these cockroaches weren’t getting anywhere.