$4.2m COVID-19 scam