What is the ‘Scam Empire’ investigation and what does it reveal?
Scam Empire is a collaborative investigation by OCCRP, Swedish Television (SVT), and 30 other media partners from multiple countries. Based on 1.9 terabytes of leaked data, reporters expose two groups of call centers, based in Israel, Eastern Europe, and the country of Georgia, whose employees have convinced at least 32,000 people across the world to make “investments” totalling at least $275 million.
These operations have all the hallmarks of a massive scam: The call center agents use false identities, forged paperwork, and deceptive advertising; “investors” were systematically prevented from withdrawing their money; and almost all of the investment “products” on offer were unlicensed and had official warnings from authorities.
The leaked data provides unprecedented insight into the inner workings of an insidious cyberfraud industry that police officials say costs the public hundreds of billions of dollars a year.
The leaked data, which includes over 20,000 hours of phone calls and tens of thousands of screen recordings, shows how call center employees hawk sophisticated trading technologies to convince their victims they’re on their way to fulfilling their financial dreams. But when the “investors” try to withdraw their “profits,” the scammers typically invent pretexts to explain why the money can’t be sent — they then try to trick them into sending more.
Though the scammers’ methods are crude, their work is highly organized, operating out of city offices on a commercial scale. They use client management software, collaborate with external marketers, and provide days-long trainings for “client”-facing staff — who are backstopped by human resources, quality control, and IT departments.
These schemes are extremely lucrative. The scammers — whose efforts are tracked on leaderboards and who celebrate their wins with animated gifs — are rewarded with lavish parties, generous salaries, and performance bonuses.
On the other end of the phone line are ruined lives. Some victims are driven to thoughts of suicide; many end up with crippling debt, trauma, and an inability to trust strangers. And the vast majority get no justice, as the perpetrators are very difficult to find, expose, and prosecute.
How many scam operations did you uncover? Are they connected to each other?
The Scam Empire exposes two separate call center operations:
“A.K. Group” had at least three offices in Tbilisi, the capital of Georgia, and employed around 85 people, including back-office staff, as of April 2024.
The other operation is much larger and more diffuse. It is divided into three broad business units with their own management structures, and has had at least seven offices in Israel, Bulgaria, Ukraine, Spain, and Cyprus that employed at least 480 people as of August 2023. These divisions recorded payments from “investors” centrally and appear to be working under the direction of a management team in the Tel Aviv metropolitan area. The leaked data does not reveal whether one or multiple people are behind this operation.
Though completely separate, these two operations appear to be running essentially the same scam, using similar training materials, scripts, and contracts with vendors. They even use some of the same service providers, including Voice over IP (VoIP) services, cloud hosting solutions, affiliate marketing companies, and payment processors.
What’s in the leak, and how did the investigation come about?
The Scam Empire is based on two sets of internal data obtained from the call centers: about 1.14 terabytes from Georgia and 765 gigabytes from the Israeli/European operation.
The data consists primarily of internal computer files — and in the case of the Georgian operation, some 20,000 screen recordings and over 20,000 hours of audio calls — and was shared with reporters at Swedish Television (SVT) by an anonymous source.
The size and wide geographical scope of the leak made it clear that a proper journalistic investigation would require media outlets in multiple countries to join forces. That’s why SVT partnered with OCCRP to organize Scam Empire, a collaborative effort that includes 30 other media partners around the world.
Reporters spent over six months poring over the leaked files to piece together how these operations work, contacting and interviewing victims, identifying scammers, researching court cases, speaking with experts and police officials, and tracing, to the extent possible, the vast flows of funds involved.
Who leaked the data and why?
The data was leaked by an anonymous source who told reporters they were motivated by a desire to end impunity for scammers.
“Fraudsters can operate almost openly, without anyone stopping them,” the source wrote. Almost none of these crimes ever get resolved because of the difficulties in investigating crimes across borders. … Without real international change, this will never go away.”
“By turning over the material to the media, I/we hope this issue gets enough attention for authorities to take action against these criminals. This problem is not impossible to solve. We all just need to care enough to do something about it.”
What is the scale of these operations? How much money do the scammers make?
The leaked data is limited in scope, making it impossible to calculate the full scale of these operations. Still, the sums are impressive.
Between May 2022 and February 2025, the Georgian operation received $35.3 million from over 6,000 people via four language desks: German, English, Spanish, and Russian.
In the Israeli/European operation, reporters counted over $247 million sent by nearly 27,000 people from over 30 countries between January 2021 and December 2024.
Experts caution that the overall size of the online scam industry is difficult to estimate due to underreporting and differing definitions. But it is said to rival the illegal drug trade in magnitude. According to Jürgen Stock, the former secretary general of Interpol, online scams generate about $500 billion per year.
What exactly are these call centers selling? Could these be real investment platforms? What’s the evidence that they’re scams?
The call centers offered their targets the opportunity to trade on one of dozens of branded investment platforms.
These platforms — each with their own logo, website, and advertising copy — purported to be advanced brokers that would allow even novice clients to invest in cryptocurrency, stocks like Tesla, or other trendy financial products. Reporters identified 79 platforms used by the Israeli/European operation and 7 used by the Georgian group.
It is impossible to definitively state what happened to each of the tens of thousands of “clients” who appear in the call center data as having joined these platforms. But there is every indication that both operations were designed to scam large numbers of people.
The statistics speak for themselves: Reporters reached 182 people who were listed in the data as having “invested” money. More than 90 percent of them, or 166 people, said they had been the victims of a scam. Their total confirmed losses exceeded $21 million, and 85 of them told journalists that they had gone to the police.
But perhaps the most compelling evidence of fraud comes from a trove of over 20,000 hours of recorded phone calls made by agents from the Georgia-based A.K. Group. These lay bare the deception and cruelty they brought to bear on their victims, in some cases openly taunting them for having been scammed.
Screen recordings and computer files complete the picture, showing Georgian call center agents using fake email addresses to impersonate legitimate financial institutions and creating fraudulent documents. They also show the agents’ inter-office chats, in which they openly referred to themselves as scammers and mocked their victims.
A smaller collection of several hundred recorded phone calls from the Israeli/European operation offer a more limited but still vivid picture of the often-fantastical claims made by call center agents. In one conversation, an agent tells a reluctant potential client that his platform would make her money automatically using an “AI-based system.”
“It's trading for you automatically. You don't really need to understand how it all works, because that's the job of the system,” the agent said. “Once the train is at the station, just jump on it and then basically enjoy the ride. Believe me, you are going to be making a ton of money.”
Reporters also identified other red flags. The vast majority of the branded platforms did not advertise any license that would allow them to offer financial products, and many said they were based in Switzerland — a country where, according to the available internal data, the call centers do not have any employees.
Of the 79 platforms used by the Israeli/European operation, 65 carry at least one official warning from a regulator, and many have been flagged more than once.
Finally, the operations appeared to close when reporters reached out to them. Their employees avoided speaking and were protected by security guards. In Georgia and Bulgaria, entire offices appeared to empty after reporters made contact.
Were any of the trading platforms licensed by the authorities?
There is one category of brands that deserves special mention. Four of them were operated by companies that did have official licenses in South Africa.
The available internal data shows that, of the $247 million taken in by the Israeli/European operation, $18.5 million, or just over 7 percent, came in through these licensed brands.
The data also shows that, for these brands, a higher proportion of incoming money was withdrawn by clients — about 10 percent, compared to 2 percent for the unregulated brands.
Reporters spoke with several clients of these brands who did not consider themselves to have been scammed, though they felt they had been badgered into investing funds they could ill afford.
Who is behind these call centers?
The call center employees take extensive measures to hide their identities, using pseudonyms even in their internal communications.
In the case of the Georgian operation, reporters were able to identify many of the scammers from clues in their chat conversations, cross-checking them through social media posts and other publicly available information.
On paper, the company that owns this operation, A.K. Group, is owned by a 36-year-old woman named Meri Shotadze. In practice, internal communications show, she appears to be second-in-command. The man she refers to as her boss is a 33-year-old man named Akaki Kevkhishvili. But though he appears to enjoy a relatively luxurious lifestyle, recently acquiring a $100,000 Range Rover, it is unclear whether someone else stands behind the operation. Neither Shotadze nor Kevkhishvili responded to requests for comment.
A.K. Group rents its offices through two other firms owned by people who appear to be proxies: one is an internally-displaced person from the Republic of Abkhazia, the other is his mother-in-law.
The people behind the sprawling Israeli/European operation, which encompasses three business units, dozens of corporate entities, and a shifting number of offices, are likewise unknown. Until April 2024, it rented space in the Sapphire Tower, a glitzy office skyscraper in Ramat Gan, Israel, which appeared to be the operation’s Israeli headquarters. Though the leak reveals the names of many of the operation’s managers, the founders or main beneficiaries remain unknown.
How do people make payments to these scammers? Why don’t their banks stop them?
Commercial banks will not easily allow their clients to wire large amounts of money to foreign countries on the promise of too-good-to-be-true investment returns. But the scammers have developed creative methods to skirt these obstacles.
Many victims make their payments using cryptocurrencies. Others are convinced to open new accounts at financial institutions that are less strictly regulated, such as digital-first “neobanks.” To ensure victims’ transfers aren’t blocked, the scammers coach them on how to justify them to banking staff. For example, they may be instructed to claim they are paying for theater tickets.
The scammers direct victims to send their money to a company that is part of a network of companies stretching across multiple countries, making it nearly impossible to trace. Sometimes they hire dedicated service providers who provide them with front companies and facilitate the transactions to evade banking scrutiny. Fake invoices are sometimes used to justify the transactions.
These money trails are so convoluted that it is usually impossible to determine their final destination. In one money-moving scheme traced by reporters, victims’ funds were sent to a group of firms registered in Spain and the United Kingdom, who moved it among themselves before routing it to a second tier of firms, mostly in the UK, the United Arab Emirates, and Hungary. The money then flowed to other firms, disguised as consultancies, in Cyprus and North Macedonia, before the trail was lost.
What is the history of this kind of scam?
The forerunner of the modern online “investment” scamming industry emerged in Cyprus and Israel in the mid 2000s, as “retail Forex,” a legitimate but high-risk form of currency speculation that was newly made available to the general public.
Israeli media, especially the Times of Israel, covered this industry extensively as Israel became its epicenter, particularly in the 2010s, when the country also saw a boom in online gambling.
The Times’ coverage shows that some companies operated legally but exploited unsophisticated investors, while others appear to have manipulated their platforms to ensure victims lost out. Over time, these schemes began to offer binary options, CFDs (Contracts for Difference), and eventually crypto-inspired scams, all of which followed the same playbook — offering a supposedly sophisticated financial product that was often just a simulation designed to steal victims' money.
Israel finally outlawed binary options trading in 2017. But the ban did not dismantle the industry. Instead, many scammers moved their operations to Eastern Europe, setting up new call centers in countries like Ukraine, Bulgaria, Georgia, and Albania.
Despite law enforcement efforts, these scams continue to evolve. The industry thrives because of its ability to cross borders with little effort — scammers can quickly switch servers, move money through a web of international transactions, and target victims in far-away countries. Platforms like Google and Facebook have also played an unwitting role in the industry’s success, profiting from ads that funnel victims into these schemes. With enforcement fragmented across jurisdictions, the battle against online investment fraud remains an uphill struggle: For every network that gets dismantled, another seems to emerge.
(In response to requests for comment, a Google spokesperson wrote: “We expressly prohibit scam ads on our platforms and take swift action to suspend the offending advertiser’s account when applicable.” Meta, the parent company of Facebook, wrote: “It is against our policies to run ads that promote or facilitate scams. … We stand ready to review and take action if we find violations of our policies.”)
What can you do to avoid being scammed?
Investment scammers use sophisticated techniques, honed over years of work. Recognizing these is the key to staying safe.
Most victims are lured in by online advertisements that appear in the usual places, like Google, Facebook, or YouTube. These ads promote advanced investment products and use lots of high-tech buzzwords. Any reference to “quantum computing,” “artificial intelligence,” bitcoin, or cryptocurrency — or any implications that these technologies will make you rich — should put you on your guard. Be immediately suspicious.
Some victims are lured in by fake news articles that promote these same products, often citing a celebrity endorsement. Always check if the celebrity has actually spoken about this product on their real accounts. And if the “news article” links to a sign-up page for the product being described, that’s a huge red flag. Always verify the source before engaging.
Once you’ve signed up, you’ll get a call from an agent urging you to make an initial “investment” of a few hundred dollars. They often emphasize ease-of-use, explaining that their product — which, again, probably uses some advanced trading technology — is intended for beginners. They’ll promise huge profits and might try to exploit your financial worries or dreams. Be cautious of time-sensitive “exclusive” deals, as legitimate investment firms don’t rush you into decisions. If a caller asks about your financial situation or pressures you to act quickly, it's a strong warning sign. The best response? End all contact and report the scam.
Another warning sign is if your “agent” starts to get a little too creative about how to send them money. In particular, they may steer you away from your usual bank, coaching you on how to convince them to approve transactions, push you to open new online bank accounts, or move your funds into cryptocurrency. Once you invest, the scammers won’t stop there. They’ll invent reasons your funds can’t be withdrawn, pressure you to invest more, or say that additional deposits are required just to retrieve what you’ve already sent.
Once you’ve caught on, some scammers will reach out to you posing as government officials, offering to help you track down your money, but using fear tactics to keep you on the hook. Real representatives of government agencies don’t demand money over the phone.
Be aware that this is just one pattern. Though these exact techniques have ensnared tens of thousands of people, there are many other scams in the world.
