Ingrid Hernvall was scrolling through Facebook when she saw exciting news.
It was a story — laid out just like an article in a proper newspaper — featuring two of Sweden’s biggest television personalities. The two men spoke of a fantastic new Bitcoin investment opportunity that was almost certain to make you rich.
Her daughter had seen the same “article.” Both women trusted the TV stars, Fredrik Skavlan and Filip Hammar, and were intrigued by the prospect of making so much money. Hernvall, 57, is a ceramic artist in Stockholm, while her daughter had spent long stretches out of work due to illness.
When her daughter clicked through and quickly started to make money — at least virtually — Hernvall was convinced. She took the plunge and invested the proceeds of the sale of her house, which represented her life’s savings.
It took her four months to realize she’d been duped. By then, she had lost over US$300,000.
The “news story” she’d seen was one among hundreds of thousands of fabricated advertorials claiming celebrity endorsements of get-rich-quick schemes that do not exist.
Those drawn in by the familiar faces and promises of wealth are redirected to brokers. Some of these are licensed, but many are questionable, and in some cases they are downright criminal, harassing their victims until they agree to pay up.
This is what happened to Hernvall. Entering her contact information on a website earned her a call from a smooth-talking salesman, who kept insisting the story about Bitcoin was true and she’d make a fortune — if she just kept sending him money.
“You know the whole time that everything is wrong,” she recalled. “But it goes so fast and you don’t have time to stop and reflect.”
While the flood of these fake stories is already documented and the subject of regulatory warnings in many countries, the business continues to boom.
Now an investigation by an international consortium of reporters, led by OCCRP and Swedish daily newspaper Dagens Nyheter, drawing on a cache of 800,000 leaked advertisements analyzed by OCCRP’s data team, can sketch out the ecosystem around these fabricated news stories for the first time.
The ads are targeted to local markets: British readers may see the face of business mogul Elon Musk, while the French get football star Kylian Mbappé. Marketing firms then exploit loopholes on Facebook and Google to get them in front of users’ eyes.
They direct excited readers to sites in their own languages touting “crypto robots” or “crypto trading bots” — supposedly computer programs that use a cutting-edge algorithm to automatically trade cryptocurrencies.
In reality, these pages are just marketing tools that make lavish promises to entice users to hand over their contact information. Once they do, would-be investors are funneled towards a variety of online investment brokers who have purchased their contact details.
Some are offering legitimate, if extremely risky, investments. But others represent a darker world of fraud, where users are badgered into making deposits, then adding more and more funds, sometimes under extreme pressure. They never get them back.
Genius Trading Robots, or Marketing Ploys?
What makes this so confusing for users — and hard to crack for anti-cyber-crime investigators — is that the online world of crypto-robot portals is so multifaceted. Even Bitcoin Revolution, one of the best known “brands,” has a multitude of different web addresses run by different people.
"This very protean character is important to understand," Claire Castanet, an official at France's financial regulator, told OCCRP partner Le Monde.
"If there is an evolution in scams, it is this permanent agility. Before, it was forex, then it was the investment diamond, today cryptocurrencies. … It is formidably effective."
The websites tend to use similar tactics and, at a glance, might appear legitimate.
At the top of a “crypto robot” page, the visitor will usually be greeted by a video including short clips from well-known figures extolling the virtues of Bitcoin. A range of fake testimonials about their money-making successes usually follows, as well as other unsubstantiated claims about how the robot works.
Investors are then told to sign up in order to make an initial $250 deposit. At this stage their details are passed onto to a trader, often in the risky online forex market.
In finance “forex” simply refers to the foreign exchange market, where currencies are traded. But online forex brokers often flog an arrangement called “contract for difference,” in which participants bet on whether a given currency or cryptocurrency will rise or fall in value.
These types of investments are extremely risky, with around four in five people losing money even when they work with legitimate brokers. But they’ve also attracted many fraudsters who game the system so the investor is almost guaranteed to lose.
Contract-for-difference investments for retail investors are largely banned in the U.S. Those tied to cryptocurrency investments will be outlawed in the U.K. starting January 6, 2021.
The Fraud Funnel
Online investment platforms have proliferated in recent years, but many of them aren’t what they seem. OCCRP and its partners have unpicked how consumers from around the world are being funneled from harmless-looking ads towards risky, sometimes fraudulent, investments. Here’s how the entire process could work for an unsuspecting user:
The Search Engine
Google’s motto for years may have been “don’t be evil,” but evidence collected by OCCRP and partners reveal it is a superspreader in the world of fake celebrity endorsements.
The tech giant offers two main types of ads: display, which appear on websites, including those of major publishers, and keywords, which appear on the Google search page when certain terms are entered.
Crypto-schemers use both.
Their display ads usually feature a celebrity urging readers to check out a new investment opportunity. Sometimes they look like stories from trusted newspapers or magazines.
Earlier this year, for example, Google ads were displayed on the websites of newspapers across the U.K., including The Daily Mail and The Guardian, with headlines suggesting celebrity finance expert Martin Lewis had died. Those who clicked were redirected to fake cryptocurrency investment sites.
Another ad, laid out like a story in The Mirror, claimed Lewis had invested 1.2 million British pounds in one of the most widely touted “crypto robots,” Bitcoin Revolution, which touts itself as “software which enables anyone to trade Bitcoin profitably.”
In one case, an advertisement falsely using Lewis’ image was displayed next to a Guardian story about how the star had publicly blasted internet companies for the proliferation of fake ads using his image.
Despite the complaints, these advertisements continue to appear. One Google ad in The New York Times in October led to a false news story claiming Canadian Prime Minister Justin Trudeau had endorsed the fake “crypto robot” Bitcoin Up, which promises clients can make $17,000 per week with almost no effort.
Google’s revenues from keyword search tied to the fake ads are more difficult to discern but OCCRP and partners found evidence that they are substantial.
Customers who search Google for the names of Bitcoin sites looking for more information are often shown ads that direct them to dubious news stories, or even questionable review sites that offer glowing reviews of the portals.
A search for “bitcoin trader scam,” for example, may show you an ad for an investment review website that gives Bitcoin Trader, the subject of fraud warnings in Australia, a five-star review. There are even dozens of positive — and entirely misleading — advertorials for Bitcoin Trader and other crypto robot portals on the website of the Associated Press, one of the world’s leading newswire services.
A spokesman for AP defended the practice, saying the agency “makes clear that these press releases are paid content from … third-party providers.”
But because the AP is seen as a trusted source by Google, the search engine sometimes even highlights these reviews in what’s known as a “snippet box” on the search results page, giving them further prominence.
“While the vast majority of featured snippets work well, they will never be perfect and occasionally we’ll show information from sources that do not meet our high standards when it comes to authoritativeness,” said Mark Janson, a spokesman for Google, in response to questions from OCCRP.
Ingrid Hernvall, the Swedish woman who lost her savings, said she had tried to verify the company she was investing with before depositing any money. But a Google search for her broker’s name returned a flood of positive information, including an article claiming the company was owned by a well-known Estonian technology firm.
“That makes [it seem like] there’s a credibility in this company, and that was one of the things that made me dare to invest,” she said.
OCCRP and its reporting partners looked at four of the biggest spenders on keyword searches related to Bitcoin and cryptocurrencies in 2020: a regulated broker based in Cyprus, a “crypto robot,” and two questionable review sites that give high marks to crypto-bots. Together, the four sites have spent close to $20 million on Google keywords so far this year, according to data from the marketing tool Semrush.
ForexTB, a licensed forex broker in Cyprus, was the biggest spender of the four, pouring close to $9 million into Google keywords. These included search terms appearing to target children, such as “how to make easy money as a teenager” and “how to make money as a kid online.”
ForexTB also paid for keywords including “bitcoin filip hammar” and “bitcoin trader dragons den,” which appear to target people searching to learn more about the fake celebrity endorsements.
The company did not respond to requests for comment.
Google received more than a $1 million in keyword advertising this year from the website revolution-bitcoin.net, an iteration of the notorious "Bitcoin Revolution."
The internet giant did not just turn a blind eye to the suspicious keywords. It actively encouraged them though a service that suggests additional search terms to buyers to help them garner clicks.
When a reporter tried to buy search terms related to the hit BBC business-pitching reality show “Dragons’ Den,” for example, Google suggested also buying up the names of the show’s famous judges. A search for Skavlan yielded suggestions for other celebrities who frequently appear in fake news stories flogging Bitcoin scams.
Google told OCCRP and its reporting partners that it had taken down 50 million “sensationalist ads” in 2019 and was reviewing the examples uncovered by journalists, including celebrities whose names were “recommended unwittingly for cryptocurrency promotions within our keyword tool.”
“This is a cat-and-mouse game: scammers are constantly evolving their approach to try to beat our systems, but we remain committed to fighting them,” said Jansen, the Google spokesperson.
“We have thousands of people working to improve our enforcement technology and develop new policies to address these threats as they emerge.”
He did not respond to specific questions on whether the company had a responsibility to victims who lost money as a result of scams spread via Google Ads.
The Ads
In an empty office on the 12th floor of a San Diego skyscraper, "Do good things" is scrawled across a wall. The trendy decor is all that remains to bear witness to the youthful buzz of what was once the headquarters of Ads Inc.
For years, the firm made millions offering “paid traffic,” and “vertical opportunities.” In reality, it was in the business of selling lies.
A 2019 investigation by OCCRP partner BuzzFeed News revealed its business model: using fake celebrity news planted on Facebook to induce people to sign up for expensive, hard-to-cancel subscription services for products of dubious worth, like pills that supposedly cured erectile dysfunction.
Ads Inc was “renting” accounts in bulk to launch the ads across the social network, allowing it to skirt Facebook’s quality controls.
BuzzFeed’s earlier investigation focused on ads for sham products, but a new analysis of the 800,000 fake news stories obtained by OCCRP shows that almost 15,000 are related to fake cryptocurrency investments, promoting notorious fake crypto bots such as Bitcoin Revolution, Bitcoin Evolution, Bitcoin Code, Bitcoin Loophole, and Bitcoin Trader. At least 10 of the 17 brands promoted in the Ads Inc stories are subject to financial regulatory warnings.
They were written in 11 different languages and faked the endorsement of dozens of celebrities, targeting countries all over the world. Many purported to come from mainstream media organizations.
Internal documents obtained by BuzzFeed News and shared with OCCRP reveal that by mid-2019, “crypto” had become Ads Inc’s most profitable line of business. The report covering results for the second quarter notes that revenue from crypto advertising had been $1.15 million, with a return-on-investment of 120 percent, the highest of any sector.
According to the documents, Ads Inc planned to push these fake ads even more in the coming months, but dark clouds were already brewing over the California-based firm. Its founder, Anders “Asher” Burke, had died at the age of 27 in March 2019 in a helicopter crash in Kenya.
Seven months later, BuzzFeed’s expose was published. In response to the findings, Ads Inc announced that it would shut down in October 2019.
But the online library of fake ads run by the company kept growing, OCCRP has discovered. Analysis of the archive reveals that additional “news stories” were added until April this year, including a number of fake reports using the coronavirus pandemic to sell medical supplements and promote Bitcoin bots.
It is not clear whether Ads Inc or its former employees are still active in the field. (Those contacted by reporters did not respond to requests for comment.) But they remain on Facebook’s radar, according to leaked internal correspondence seen by OCCRP and obtained by Buzzfeed News.
The message from October notes that Facebook is “still investigating the former employees to understand the current state of their operations."
Rob Leathern, Facebook’s director of product management, told reporters: “We don't want ads seeking to scam people out of money on Facebook — they aren’t good for people, erode trust in our services and damage our business.
“To fight this, we work not just to detect and reject the ads themselves, but block advertisers from our services and, in some cases, take them to court. While no enforcement is perfect, we continue to investigate new technologies and methods of stopping these violating ads and the people behind them.”
Still, reporters were able to identify dozens of recent examples on the social media platform as recently as August. In one, an ad used a headline about Croatian Prime Minister Andrej Plenković’s “latest scandal” to draw people to Bitcoin Code.
The Marketing Firm
From an office on Lower Thames Street, overlooking London Bridge, tech start-up Finixio Ltd promises to “drive targeted traffic and customers to your brand” in the field of “finance, cryptocurrency & technology.”
Founded in 2018 by entrepreneur Adam Grunwerg, the firm claims it already has a yearly turnover of 15 million British pounds. On its website, it touts the perks it provides its staff: fresh fruit, weekly takeout lunches, and team-building outings.
“We are a fun, fast paced and growing company. There are no ego's [sic], and no red tape, but plenty of opportunity on offer,” the website boasts.
Finixio operates 15 websites promoting cryptocurrency and investment options, but lists just five on its homepage. One that it does not boast about is wealthadvisor.me, which provides reviews of investment platforms, including a number of crypto-robots.
Despite the fact that Bitcoin Revolution and its ilk do not exist as investment vehicles, wealthaadvisor.me gives them stellar reviews.
Perhaps more troubling is its use of fake celebrity endorsements. At least two pages on one of Finixio’s websites claimed, inaccurately, that celebrities such as TV hosts Martin Lewis and Jeremy Clarkson had supported a specific sham “crypto robot.” The pages were edited to remove the claims after reporters sent Finixio questions about them.
Marketing emails sent out by Wealthadvisor have also linked to false claims that celebrities like football star Marcus Rashford and singer Adele were endorsing “Crypto Engine” or “Bitcoin Up.”
The marketing email even played on Rashford’s recent charitable work campaigning for the U.K. government to help children in poverty during the coronavirus pandemic. “From Free School Meals To Helping Thousands Gain Financial Freedom!” the subject line read.
Although relatively new, both of these websites have all the hallmarks of the usual sham investment platforms, according to an expert from the Finnish Cyber Security Authority who spoke to OCCRP’s partner Helsingin Sanomat.
Both websites make misleading claims about the extraordinary profits that can be made through signing up with them, such as: “Bitcoin Up members typically profit a minimum of $1,300 daily.”
When reporters entered their contact information into Crypto Engine in an attempt to sign up for this “state-of-the-art technology,” they were automatically enrolled with different forex brokers, including two offshore operators subject to U.K. regulatory warnings. Their information was also sent to the Cyprus-licensed firm ForexTB.
FOREX TB
In a written response, Finixio’s CEO, Grunwerg, admitted to running a number of sites he described as “bitcoin landing pages” that funneled users to online brokers. But he insisted he only worked with regulated companies such as ForexTB.
“There are tons of fully regulated brokers using these types of funnels,” he said.
“I don't think the issue is the Bitcoin landing pages themselves, but some of the brokers that other advertisers work with as well as the Ad Platforms that allow them to advertise,” he said, referring to companies such as Google and Facebook.
When told that reporters following links provided by his firm in marketing emails had been signed up with two offshore brokerage firms subject to warnings, he said he had no direct relationship with them.
He added that any celebrity endorsements would be removed.
“In our company and throughout our websites we make it very clear that celebrities do not endorse these products,” he said. “Any celebrity endorsements would be a mistake and unaware of by management, but we have sent a communication out to the team to ensure this no longer happens anywhere.”
They were pressuring me to invest so hard I could not breathe. They were calling all the time. At one point I watched the movie ‘Wolf of Wall Street’ and I realized that this is just like that movie. ... They ruined my life. It’s sick how good they are at this.”
A Swedish man who lost money through ForexTB
The Fraud
Finixio insists its own Bitcoin landing pages always send customers to legitimate brokers. But it concedes there are issues with fraud in the industry.
Earlier this year, OCCRP, with media partners from across the world, published a series of investigations revealing how hundreds of people lost their life savings and pensions through fake investment scams sold through call centers in Ukraine run by a firm called Milton Group.
Milton Group was also linked to call centers in Georgia and Albania, and the scheme is now part of an EU-wide police investigation.
Victims interviewed by OCCRP were often confused about how they had initially signed up for the Milton Group’s scam investments, but many said their first contact was through online ads, particularly ones they saw on Facebook, and celebrity endorsements.
In an undercover recording taken at a Milton Group-linked Tbilisi call center, the trainers said that they used different advertising sources to obtain leads to sign up customers, including Bitcoin Revolution. A source from the Albanian call center also told reporters they received leads through the same websites.
Among the questionable brands sold by the center was CryptoKartal, an offshore broker that has been the subject of multiple official warnings. Italian regulators earlier this year found that CryptoKartal had been using another fake “crypto robot,” Bitcoin Code, to generate leads, according to a report obtained by OCCRP’s Italian partner IRPI.
Milton Group was not alone in using these fake sites and celebrity endorsements to harvest investor details.
France’s financial regulator told OCCRP partner Le Monde that in 2019, its hotline received complaints over a total of 72 million euros lost to scams, of which about half was specifically related to cryptocurrency. The cryptocurrency security firm Chainalysis put the global figure for crypto scams in 2019 at $4 billion.
In August, the U.K.’s Financial Conduct Authority said it had removed more than 300,000 links to investment scams with fake endorsements from celebrities including Sir Richard Branson, Ed Sheeran, and Martin Lewis.
Despite these findings, there has been little action against the trendy tech firms pushing this content.
Meanwhile, victims of these frauds are still struggling to dig themselves out of debt.
In just four months, Ingrid Hernvall lost nearly all her assets — and even went into debt in order to keep up with her broker’s demands for more money. Her salary is now being garnished and she’s surviving on a pittance. She says Swedish police can’t help her, and she’s not eligible for debt restructuring.
Hernvall recently came across another advertisement for a cryptocurrency investment scheme featuring Filip Hammar. She was furious. She says she can’t understand why Facebook and Google aren’t doing more to curb this practice.
"How can you let a company just slip away with enormous amounts of money, [while] claiming they are doing everything they can?”
“It’s awful, and now you can sit here and laugh and get upset, but at the same time, sometimes when you are weak and fragile then you are ashamed,” she said. “You feel incredible guilt and shame.”
Dada Lyndell, an ICFJ Knight Fellow at OCCRP, contributed research and data analysis.
