HARRISBURG, Pa. (AP) — A theft ring stole nearly $2 million from bank customers in central Pennsylvania in an elaborate scheme in which the scammers, posing as bank employees, tricked people into giving up their account information, the attorney general’s office said Friday.

The suspects disguised their phone numbers to make it seem as if the calls were coming from the banks’ phone numbers, and asked victims to provide their online banking login, debit card number and other information. Victims then got locked out of their accounts.

Banks and hundreds of bank customers in Cumberland, Dauphin, Lancaster and York counties were targeted.

The scam netted at least $1.8 million, with at least $1.3 million stolen from customers of Enola-based Members 1st Federal Credit Union, according to court documents. “The loss amount and number of identified victims is expected to increase as records from additional financial institutions are secured,” investigators wrote.

The suspects used social media to recruit people to allow their bank accounts to be used as intermediary accounts for the stolen money in exchange for a split of the profits, according to charging documents. The suspects sought to conceal the thefts through the bulk purchase of gift cards from various retailers, authorities said.

Two alleged members of the theft ring have been arrested and charged so far, the attorney general’s office said Friday. At least 11 people were involved, and charges are expected against additional suspects, authorities said.

Tyreese Lewis, 22, and Carl A. Gonzalez, 19, were charged with corrupt organizations, identity theft, bank consumer impersonation, access device fraud, computer trespass and other offenses. Lewis, of Harrisburg, was jailed without bail. Gonzalez, of Highspire, was released on $10,000 unsecured bail. Court documents do not list attorneys who could speak on their behalf.