Reported by
It was Tuesday, and that meant payday. Logging into a series of chat groups on encrypted messenger app Telegram, Ben — not his real name, but an alias — reminded the marketers he was helping to oversee that it was time to claim their earnings.
“Share invoice plz,” he wrote in one group.
“Please do it as fast as possible,” he wrote in another. “We need to send u money.”
As invoices poured in, Ben posted an animated GIF from the 1970s Disney cartoon movie Robin Hood, showing the title character dressed as a beggar, asking for a few coins.
The invoices were for leads that the marketers had provided to Ben and his colleagues. In marketing, the term ‘lead’ usually refers to a potential client. But these leads were much more sinister. These were potential victims.
A screenshot showing "Ben"'s chat with the affiliate marketers he manages.
Ben and his colleagues worked for a group of call centers running a massive scam operation. The agents who worked there spent their days hoodwinking victims into believing they would make great returns if they invested in cryptocurrencies or other financial products on their platforms. This was a smokescreen — in reality, in the vast majority of cases reviewed by reporters, their money would simply vanish.
In order to keep the con going, the scammers needed a steadily incoming stream of potential victims.
An unprecedented leak from the heart of a merciless investment scam industry that stretches across the globe reveals how they get them: An ecosystem of marketing companies, known as affiliate marketers, serves up contact details in return for lucrative commissions.
The 1.9-terabyte leak that forms the basis of this investigation was obtained by Swedish Television (SVT) and shared with OCCRP and 30 international media outlets. It reveals the inner workings of two groups of call centers: One based in Georgia, and another much larger operation with at least seven offices in Israel, Bulgaria, Ukraine, Spain, and Cyprus.
The leaked records show that the marketers that supplied these scammers with leads were richly rewarded. Every lead who ended up making a deposit with the scammers was worth between $200 and $2,350, depending on which country they were from. Victims from wealthier nations like the Netherlands, Sweden, or Belgium were worth more.
Records found in the leak show that, in the first seven months of 2024, affiliate marketers working with Ben’s operation — the Israeli/European group — were paid at least $7.3 million for leads. Over the same time period in 2023, they earned more than $10.3 million.
About the 'Scam Empire' Investigation
Many of the details about the affiliate marketers come from this operation, because the leak contained hundreds of thousands of files relating to the work of its back-office staff, like Ben. The records reveal how Ben and the rest of the marketing managers recruited and oversaw affiliate marketers’ activities. This team signed vaguely-worded contracts with the marketers and maintained internal financial records, tracking successful leads and arranging the weekly payouts, which were always made in cryptocurrency.
It’s unclear exactly how many affiliate marketers worked with the scam operation. While over 300 of their names appear in the leaked materials, a single marketer often invoiced under multiple brand names. To complicate things further, the scam center used code names for some of the marketers.
But reporters were able to use the available records to connect several scam victims, some of whom lost their life savings, to the specific marketers that had been paid for providing their contact details.
The marketers’ tactics followed a broadly consistent pattern: Ads for phony get-rich-quick investment schemes, placed on mainstream websites and social media platforms, drew victims to sign-up pages touting advanced trading products. Fake news articles featuring imaginary celebrity endorsements were a favorite strategy. If the would-be investor signed up, their details were sent to the scammers.
Some of the ads and websites used to ensnare potential scam victims, found within the Scam Empire leak.
It’s not always clear from the leaked materials who is responsible for creating the ads themselves, but in traditional advertising arrangements the affiliate marketers would be responsible for creating, placing, and promoting them, as well as the landing pages these ads redirect people to.
It’s also unclear to what extent the affiliate marketing firms were aware they were servicing scammers. But there were multiple red flags about the operations, including the use of false claims and unauthorized celebrity endorsements and the fact that the brand names and products featured in the ads did not match the brands of the actual investment platforms offered by the scammers. (These were themselves mostly unlicensed and flagged by financial regulators around the world.)
Nino Goldbeck, a senior public prosecutor in the German state of Bavaria who specializes in cybercrime, said the daily supply of new leads is crucial for the scammers.
“All of these perpetrator networks rely on being constantly supplied with fresh customer data and leads being passed on to them,” he said. “And the entire online marketing machinery, which of course works in the same way in completely reputable areas, is also of great importance in this illegal area.”
Nino Goldbeck, a senior public prosecutor in the German state of Bavaria.
Paid For Victim Information, While Hiding Behind Aliases
The leaked files reveal that Ben was well rewarded for his work, earning almost 85,000 euros in bonuses alone in the 12 months from March 2023 to February 2024. His bonus was calculated based on the number of leads delivered by his affiliate marketers who actually made a deposit with the scammers.
The entire team, including Ben, used aliases in conversations on Telegram, and reporters could not connect him to a real person. Telegram chats between the team members are conducted in Hebrew and English, suggesting they may be from, or based in, Israel.
Ben’s team was led by a man using the alias James Collins whose signature appears on contracts signed on behalf of a company called EM Develop. Operating under the brand name Opulent Allies, this appears to be the scam operation’s marketing division. The company has a Ukrainian address, and its records list its owner as a woman named Daryna Reznik. When reached by reporters, a neighbor said that Reznik had passed away.
While Ben remains hidden behind his alias, reporters found clues suggesting James Collins’ real identity is a man named Ronen Kapeika: In a table titled “Employees Details,” James Collins is listed as the “nickname” of a man named “Ronen.” And in a Telegram conversation, when a marketing employee appears to ask James Collins to approve the sending of “10k,” the message “Approved” comes from a user called Ronen.
Kapeika’s full name appears, in Hebrew, on an internal spreadsheet, listed next to the word ‘headquarters,’ as well as on a record of employee pensions. According to his LinkedIn profile, Kapeika is based in Israel and previously worked as an affiliate manager at ROICollective, one of the marketing firms that has worked with the call center operation.
Kapeika and ROICollective did not respond to a request for comment.
In total, reporters reached 182 people targeted by the Israeli/European and Georgian call centers, using information within the leak to find them. More than 90 percent of them, or 166 people, said they had been scammed. Their total confirmed losses exceeded $21 million, and 85 of them told journalists that they had gone to the police.
One such victim was an architect from Seville in Spain, who asked to only be identified by her initials, IGP. She told reporters was surfing the internet when she came across an advertisement promising great returns on modest investments. The opportunity appeared to be backed by Pablo Motos, a popular Spanish TV personality — but in fact his image had been used without his knowledge or permission. (Motos did not respond to a request for comment.)
The trick worked, and IGP decided to take the plunge.
“I clicked on the link and entered my data, email, and phone number, and immediately, after three seconds, they called me,” she said.
The caller, who gave the name Álvaro Enrique Álvarez, encouraged IGP to make a first deposit of 250 euros. It seemed to go well, and she invested more. But over time Álvarez — seemingly an alias — became evasive when asked for his company’s credentials and other paperwork, she said. Soon, IGP realized she had been scammed. She lost 400,000 euros within just a couple of months.
Leaked internal documents reveal that IGP’s details were collected by a marketer called Zeus Media, which passed her details to the Israeli/European scam operation. Its agents did the rest.
According to accounting records in the leak, Zeus Media was paid $1,100 for IGP’s contact information.
The company is typical of the elusive nature of many of the affiliate marketers in the leak, whose work is carried out by people hidden behind Telegram handles, online aliases, and anonymous shell companies.
Zeus Media is not a company itself, but instead is a trading name or brand of a firm called Sierra Media Ltd, based in the Bulgarian capital Sofia. It also operates at least two other brands, Gladio and KOI Ads, whose names appear on invoices in the leak.
Sierra Media’s contract, found in the leak, loosely describes its services. The company conducts “marketing campaigns…[and] collects and processes statistical and marketing information through the promotion of the products.” The contract says Sierra Media will be paid upon provision of an invoice that describes the “provided services.” (Many of the other marketing contracts found in the leak are even vaguer, sometimes limiting descriptions to the provision of “services.”)
Tracing Sierra’s Owners
Sierra Media was a relatively active affiliate marketer, according to leaked financial data. In the first nine months of 2023, it was paid more than $260,000, according to an internal expense report. But that was dwarfed by a company called CRYP, which made the most money — almost $850,000 — from over that period.
Neither Sierra Media nor CRYP responded to requests for comment.
Fake News — and Fake Claims of Wild Profits
Many victims are ensnared by the scam operations after clicking on ads that make unauthorized use of celebrity images to give fake endorsements to phony investment platforms.
The ads appear to use celebrities targeted at specific countries. In the case of the Spanish architect it was Pablo Motos — well known in Spain, but less so internationally.
For retired Finnish scientist Helmer Södergård, it was his country’s former prime minister Sanna Marin and former president Sauli Niinistö. Södergård told reporters he clicked on an ad for a phony investment scheme after seeing images of the two politicians seeming to endorse it.
“My whole world collapsed,” Södergård, now 72, said in an interview with Finnish broadcaster Yle. The scammers raided his bank accounts, emptying them of savings that he’d intended to share with his six adult children, he said.
Södergård fell into a deep depression, unable to eat or look after himself, but is recovering now with the help of his family. He reported his case to Finnish police, but they dropped the investigation saying that the technical methods involved in such crimes made it “very unlikely that the criminal’s identity could be found.”
(Former Finnish Prime Minister Marin said she does not endorse any investment platform, had not authorized the use of her image in the ad, and had not been aware of it. A secretary for former Finnish President Niinistö’s said they were aware of cases in which his image had been “unlawfully used” and had reported them to the platforms involved. “Such frauds are difficult to trace,” they added.)
Recordings of phone calls between victims and call center agents, text chats, and other leaked files show that fake endorsements by Elon Musk appear to be a particularly popular tool for catching potential victims.
In one recording, a victim tells a call center worker he’d clicked on a purportedly Musk-backed Facebook advertisement for something called “Quantum AI.” In another, a victim says, “That’s what I want to be part of…the quantum algorithm thing that Elon Musk has advertised on Facebook and YouTube.”
Fake Elon Musk’s ‘Quantum Algorithm Thing’
Other celebrities’ images were also used to try to catch victims, sometimes in scarcely-believable fake news stories. One fabricated article, found among the leaked records, purported to be from a Canadian television network and falsely claimed actor Sandra Oh had revealed “details of a secret profit-making platform” in what looked like an interview on the Late Show with Stephen Colbert.
The article claimed the “Canadian Security Commission” shut down the live show at the urging of Malaysian billionaire Robert Kuok in order to keep the platform secret. At the bottom of the article, readers were prompted to “fill out the registration form provided by Sandra Oh.”
Journalists reached out to the celebrities whose names were used in these ads, but none responded to a request for comment.
Scam Ads Frequent on Facebook
The ad that brought Södergård to the scammers had appeared to him on Facebook, he said.
This isn’t uncommon: many victims fell prey to scams after clicking on ads on Facebook or other major social media platforms.
According to internal financial records and chats, an affiliate marketing firm called Oray Ads charged the Israeli/European call center operation more than $105,000 in the first seven months of 2024 for a “Facebook Advertising Budget.” It also delivered successful leads: Leaked records and online conversations show Oray Ads providing more than 160 leads for over $146,000 in 2023 and 2024 — though this is not a complete picture.
Oray Ads also worked in Georgia, starting in October 2023, according to records found in the leaked data. For that operation, the company initially concentrated on Swedish and Norwegian target audiences before refocusing on Canada, Ireland, and the United Kingdom. Some months, the company earned between $20,000 and $30,000 from the Georgian call center.
Among the victims whose details were sold to the scammers by Oray Ads was retired Swedish journalist Annika Gustafson, who was scammed by agents working in the Georgian operation. She was also drawn into a scam through an ad she saw on Facebook, using the image of a famous Swedish television presenter. She eventually lost all her savings, was plunged into debt, and even considered suicide.
Oray Ads didn’t respond to a request for comment.
Oray Ads’ Fake Employee Profile
Meta, the parent company of Facebook and Instagram, has faced criticism over the spread of scam advertising on its platforms. The company has been sued in the United States, Ireland, and Poland by wealthy or prominent people who say their likenesses have been misused; some of those cases are still ongoing and several have led to settlements.
In the U.K., well known financial commentator Martin Lewis — whose image has been used without authorization by scammers — settled a lawsuit with Meta in 2019 over its alleged failure to shut down scam advertising after Meta agreed to add a one-click reporting button for scams and donate 3 million pounds to an anti-scam project in the U.K.
Goldbeck, the prosecutor from Bavaria, said social media platforms had taken steps to combat scam advertisements and that “things have already become significantly better than they were three, four, five years ago.”
In response to a request for comment, Meta said the promotion of ads pushing or facilitating scams is “against our policies… These criminals target people and services across industries using sophisticated schemes — and addressing this requires cross-industry collaboration of banks, governments, law enforcement, and telecoms.”
The issue is “high on the agenda” of social media platforms, Goldbeck said. “But I think there is still room for improvement there. … [The platforms] know that they also have a responsibility and that the whole thing is simply a major gateway for this fraud machine. And in this respect, we very much hope that this will continue to be actively addressed and that these options will be limited as best as possible.”
Affiliate Marketers Party in 'Sin City'
While affiliate marketers may not publicize their names on the ads they promote, they do have a more public profile at industry conferences held around the world every year.
One of the most prominent is called Affiliate World, and dozens of marketers identified in the leak have attended its regular events.
Over a third of the official sponsors of Affiliate World Asia’s 2023 conference appear in the Israeli/European operation's internal records. Gladio, the Sierra Media brand that passed on the contact information of Spanish architect IGP to a call center, co-sponsored an event at Affiliate World Dubai in 2023.
In response to a request for comment, Affiliate World said it “categorically” does not “promote, endorse, or encourage illegal activity” and that it requires “all attendees, exhibitors, and sponsors” to abide by the law. “Participation in our conferences…should not be interpreted as an endorsement or verification of any individual, company, product, or service,” it added.
Another marketer that appears in the data is MGA Team, notable for providing the contact details of an especially lucrative victim: A Spanish doctor who went on to lose a million euros.
MGA Team, which did not respond to requests for comment, sponsored several Affiliate World conferences and associated events in Bangkok and Dubai in 2023 and 2024.
The company also co-sponsored an exclusive party dubbed Fridman Tower — ”a unique event for affiliate marketing leaders and top industry executives” — at a five-star Bangkok hotel not far from last year’s Affiliate World event. The event site promised “epic parties, top-tier networking, and an unforgettable atmosphere.”
Representatives of Fridman Tower did not respond to requests for comment.
One of those “epic parties” was branded ‘Sin City.’ A promotional video for the party, posted on Fridman Tower’s Instagram account and opening with the caption “MGA Team Presents Sin City,” shows partying crowds and women in vinyl lingerie writhing on a stage.
A screenshot from a promotional Instagram post for the "Sin City" party.
But even as marketers partied in 'Sin City', victims were being harassed by the scammers their contact details had been delivered up to.
The same month the party was held, the Spanish doctor whose details were provided by MGA Team said he was receiving relentless phone calls, pressuring him to continue investing and stringing him along with promises of great returns.
“All this money was my life savings,” he told reporters.
