Fraud Factory Firms Traced to Penniless Proxies

Rita is almost 13,000 euros in debt and was convicted of shoplifting a bottle of gin. Ricardo is unemployed and has been arrested several times for drug possession and driving without a license. His mother, Silwia, stole a white sweater worth 16 euros from an H&M in Stockholm.

But all three of these struggling Swedish citizens own companies registered at a prime address in Tallinn, Estonia’s capital city. Even more improbably, they bought these Estonian companies through other firms they own in the tiny Caribbean nation of St. Vincent and the Grenadines.

They are part of a larger network of firms registered in the same distinctive way: Estonian companies owned by shell companies in St. Vincent and the Grenadines, largely owned by down-on-their-luck Swedes.

The reason for this unusual ownership pattern becomes clearer after a look at what these companies were used for: hawking get-rich-quick investment schemes online.

Many are tied to a Ukraine-based call center exposed in a series of articles by OCCRP and Swedish newspaper Dagens Nyheter (DN) in March. The center allegedly defrauded people across the world by convincing them they were making investments in stocks, bitcoins, and foreign currencies through legitimate financial firms. The scheme is currently under investigation in Sweden.

Hiding behind a web of foreign companies creates a veneer of credibility while obscuring the true beneficiaries of the scams and allowing them to move money internationally, Estonian police told OCCRP. If those companies are, in turn, owned by citizens of a wealthy Nordic nation, all the better.

This could explain why whoever registered the firms turned to over two dozen Swedish proxies such as Silwia and Ricardo. Some were aware they were lending their names to companies they had nothing to do with, but at least one person alleged that his identity was stolen with forged documents.

The Operation

Last year, a whistleblower approached Dagens Nyheter after he became concerned that his employer, a call center based in Ukraine’s capital, Kyiv, was committing major fraud under the guise of selling investments to vulnerable people around the world.

The whistleblower alleged that the call center, Milton Group, employed an army of young salespeople whose job was to scam victims, particularly pensioners, with promises of get-rich-quick schemes.

Reporters spoke to victims on four continents who had been lured in by what they believed were high-tech trading firms that would allow them to open web-based investment accounts and make a fortune.

These firms were operating under different brand names, complete with their own sleek websites and marketing campaigns, but all of them led back to Milton and its owners, who appear to have pocketed the millions of dollars “invested” with them.

One of the brands frequently mentioned by Milton’s victims was Vetoro Banc. The whistleblower told journalists that Vetoro had been entirely invented inside Milton’s offices in Kyiv, with the name chosen because it sounded “like one of the Italian banks.”

Vetoro’s website changes frequently, but at various times it has advertised being “owned and operated” by companies based in St. Vincent and the Grenadines called Hanabishi Partners Ltd and Gozala Enterprises, as well as their Estonian subsidiaries, Hanabishi Management and Gozala Services.

Both Hanabishi Management and Gozala Services were purchased on the same day in April 2019 from an agent in Tallinn by two hard-up Swedish women recently convicted of crimes. The women made the purchases through St. Vincent shell companies.

Funds for the purchase of Hanabishi were listed as coming from “business profits from Hong Kong,” despite the fact that its owner, Silwia, had been sued in a Stockholm district court the previous month for not repaying a 3,500-euro car loan.

Examining Milton Group records as well as code embedded in the brands’ websites, reporters discovered that the other three investment outfits named by the whistleblower as being sold from Kyiv — CryptoMB, Cryptobase, and Glad2Trade — were also part of the Estonia-St. Vincent network.

In total, at least 61 firms were registered between February 2018 and February 2020 at the same address in Tallinn, then quickly purchased by offshore firms from the Caribbean nation.

Most of them even share the same address: Suite 305, Griffith Corporate Centre in Kingstown, the capital of St. Vincent and the Grenadines.

Of those, 57 firms offer get-rich-quick investment services following a similar format to Milton Group’s schemes.

• At least 24 are linked to websites that have been blacklisted by authorities in at least one European country.

• 21 can be connected to Milton Group.

• Four are sold by a call center in Albania that reporters have also tied to Milton Group.

• 23 are currently accepting new investments through a Cyprus-based payment company called Naspay.

Naspay is owned by David Todua, a Georgia-born Israeli citizen who was identified by the whistleblower as one of the key figures behind Milton Group. (Todua denies holding any position in the company).

Milton Group in Kyiv, the linked call center in Albania, and the payment company Naspay all failed to respond to repeated requests for comment.

The Registration Agent

For years, businessman Argos Kracht has been one of Estonia’s most prolific formation agents, churning out new companies from his office adjacent to Tallinn’s City Hall.

For nearly as long, he’s been having run-ins with authorities who accuse him of setting up shell companies that can be used for tax evasion, money laundering, and other financial crimes.

Kracht makes it easy and relatively cheap for almost anyone to buy an Estonian company. He offers off-the-shelf firms for prices starting at 600 euros, and virtual office services, including a contact person and mail forwarding, for an additional 500 euros a year.

Kracht’s own company, KRM Holding Plus, set up all 61 Estonian firms identified by journalists as belonging to the network with ties to Milton Group.

In a response to questions from reporters, Kracht said he was shocked and surprised to learn that companies he created were being used for fraud.

“Based on the information that you provided, it seems that we have here a carefully prepared, disguised and premeditated action/pattern and also we have been taken advantage of,” said Kracht.

He said his firm was reviewing its client list and “will cancel them if needed,” and added: “It is possible that with such a legacy it is more purposeful to end our operations after all. There is no point in business if it carries so many problems with it.”

Kracht also filed a complaint with Estonian police, who launched an investigation last week into whether some of the documents used to open the companies were forged.

After receiving inquiries from journalists, Estonia’s Financial Intelligence Unit told OCCRP it would also look into the claims of fraud.

“We need to examine whether the organizers of an international fraud scheme have allegedly been using the services of an Estonian service provider,” said Madis Reimand, the head of the unit.

The Proxies

Twenty-five of the companies in the Estonia-St. Vincent network have Swedish directors or owners. Most of them hail from Stockholm or small towns nearby. Several are related to each other.

Rita, from the small town of Eskilstuna, is an amphetamine user with a string of minor drug and shoplifting convictions. She testified at a welfare hearing last year that she struggles to come up with the cash to pay her monthly rent and lives in fear of being evicted.

She is also the owner of the Estonian firm Zeus Partnership, which has been linked to several investment brands subject to regulatory warnings.

She told a reporter from DN that she had nothing to do with Zeus, but agreed to put her name to it after “a Russian man from Stockholm” offered to pay her 1,900 euros a month.

“My daughter's dad is sitting in jail and I only had my parental allowance, so I needed to get some money,” she explained. “They said there was no danger and that they would not offer this if it was something illegal because I have a daughter to think about.”

She declined to provide further information about who had induced her to buy the company: “Snitches don't make friends,” she said.

Rita insists she had no idea she was also the owner of a St. Vincent-registered company, or that both were being used to front shady investment schemes. She received one installment of 1,900 euros, but after that the payments came just “a little now and then — that was what felt a little rogue-like,” she told DN.

In January, fed up with the lack of payment, she tried to quit the arrangement. The Russian man was angry, she said. "Do you know what it costs to set up a company?" he demanded.

Although most Swedish company owners in the network were convicted of only petty crimes, two are wanted for more serious offenses.

Jan Fredrik Jarl and Karin Therese Hallkvist were arrested in November 2019 on suspicion of dealing 60 kilograms of amphetamine. Jarl remains the owner of Estonian firm Salamanca Corp Partnership, which operates Kronosinvest, a trading “brand” that lures would-be investors through a sleek website promising “the most recent-friendly-sophisticated technology in the online trading industry, low-cost commissions, and remarkable customer service.”

Swedish authorities last year warned against doing business with Kronosinvest, saying the brand was unlicensed and might not even exist.

Two of the Swedish proxies in the corporate network stand out for the opposite reason: They have no history of criminal activity. DN tracked down one of the owners, who told reporters that he had never signed up to own a company.

“I have no idea about this company — I have never heard about it,” said Magnus, a Swedish man who is the sole board member of W Rock Management OÜ in Estonia, at least on paper.

Maria Nilsson, a notary in the town of Eskilstuna who supposedly issued some of the documents used to form Magnus’s company, told DN they were fake.

Nilsson said her signature had been forged and the stamps were the wrong color.

“We have no documents regarding this person,” Nilsson said of Magnus, adding she would file a complaint with the police. Another company fitting the same pattern was also opened with apparently forged documents from Nilsson’s office, but reporters were unable to track down the owner.

Magnus has attempted to get both Swedish and Estonian police to investigate, but to no avail.

“I don’t know what to do,” he said. “It feels like a Kafka story. Someone might be using this company to commit crimes as we speak.”

The Victims

Magnus was more correct than he knew.

The Estonian company registered in his name, W Rock Management, has been listed online as owning and operating the investment site MyCapital.io, the subject of dozens of complaints on message boards related to dubious investment brands.

In August 2019, a German man named Peter registered his contact details on a website called Bitcoin Era after seeing an online ad featuring a popular German singer and a family of reality television stars marveling at how rich they had become investing in the cryptocurrency. (These celebrities and many others have complained that their likenesses are being stolen for such advertisements.)

Peter, a teacher in his 60s, asked not to have his full name revealed in this article.

Shortly after registering, he received a call from a man who identified himself as Stefan Arnold and claimed he was Peter’s broker from a different site, MyCapital.io.

Stefan was friendly, asking Peter about his family and sharing tidbits about his own. He convinced his new client to invest 2,000 euros. This quickly yielded a 250-euro profit that showed up on Peter’s MyCapital.io dashboard.

On the back of that success, Peter agreed to invest much more. He took out a loan from his local bank and deposited 50,000 euros into a cryptocurrency exchange account, as Stefan had instructed him to do.

By the end of January 2020, Peter found himself unable to withdraw funds from his MyCapital.io account because it was “blocked.” Stefan reassured him that with another 20,000 euros it could be unblocked, so Peter sent that money, too. Then he was convinced to send another 20,000. By the time he made his last transfer into his “account,” he had spent over 115,000 euros, he says. He was able to withdraw only a few thousand.

He began searching for more information about Stefan Arnold, and discovered a slew of online complaints about someone of the same name working for MyCapital.io.

The photographs of himself that “Stefan” had sent over WhatsApp were actually images of the Spanish football legend Victor Valdes. Even a snapshot of a little girl in a Santa hat, which Stefan claimed was his 7-year-old daughter “Melody,” had been filched from the Instagram account of Valdes’s wife.

In April, as Peter pressed “Stefan” to return his money, the broker dropped the facade.

“I bought a new car 2 weeks ago. Mercedes Maybach S-Class Limousine. Guess where I found the money?” he boasted.

“With my money?” Peter replied.

“Right!” Stefan said. “I just added 7000 myself. Thanks!”

Lindita Cela contributed reporting from Tirana, Albania.