A mother and son stole more than $2 million in expensive toys by stashing them inside the boxes of cheaper products that they purchased at Toys R Us stores across the U.S., authorities say.

According to an article from the Orlando Sentinel, Broward County Sheriff’s deputies say Michael and Margaret Pollara then sold the big ticket-items online, according to an arrest affidavit. They were arrested Thursday and face multiple theft charges.

Reportedly, the duo visited 139 Toys R Us stores in 27 states, including California, Hawaii and New York, buying almost $7,000 worth of less expensive items to fuel the scam, and authorities tracked Michael Pollara’s purchases across the country because he used a Toys R Us rewards card for nearly all his purchases, the article says.

According to authorities, the Pollaras looked for inexpensive toys that come in large boxes. They would allegedly empty the contents and fill the box with more expensive toys, including $150 Lego sets and Leapster Pads, each worth $99. The 70-year-old Margaret Pollara often worked as a lookout, the arrest report states.

Michael Pollara, 46, had more than $900,000 in eBay and PayPal accounts, the report says.

Authorities began following the two in May, the Sentinel  article reports, after an employee in a South Florida store noticed several large Lego boxes were missing even though she had seen them on the shelf earlier that day. Store surveillance video showed Michael Pollara carrying the Lego box in the toy aisle, but the video did not show him actually removing the contents, the article says.