Scam Empire (Part One): Inside the dark heart of a multinational investment scam
A data leak has unmasked a global network of alleged professional scammers drawing would-be investors into dodgy trading platforms on an industrial scale. A group of South Africans features in parts of the business â and the South African public is prominent among the victims.
A little-known Bulgarian entrepreneur named Boris Kodzhov has, since 2023, quietly made mammoth strides in the South African fintech sector.
Kodzhov seemingly launched not one but three multimillion-rand online trading platforms for complicated financial products called âcontracts for differenceâ (CFD). Their defining characteristic is that you can very rapidly lose all your money, but the potential rewards, marketers will tell you, are boundless.
One of these platforms, SkyMT, briefly shot the lights out before going out of business early last year after roping in estimated deposits of R30-million.
The other two platforms, however, Finbok and Finxo Capital, have gone from strength to strength, collecting deposits of more than R240-million from aspirant traders since September 2023.
The problem is, the âfintech mogulâ Kodzhov was until recently actually a cleaner working in Bulgariaâs capital Sofia for a modest salary of about R6,800. He has since retired to care for his sick mother and now lives off a government grant. Kodzhov doesnât speak English and says he has never heard of either his South African companies or those he supposedly owns in other countries.
Another arrival in the local online trading scene is one Diana Gugles, who, as purported owner, sits behind the company Libra Wealth and its trading platform VP Trade.
The platform has roped in at least 2,000 traders, who have between them deposited R64-million â and thatâs just since April last year.
Gugles, a professional model, also struggled to recall her fintech start-up which, while based in South Africa, targets investors in South America.
By all appearances, Kodzhov and Gugles have either been the victims of identity theft or have allowed their identities to be used for setting up companies halfway across the world.
Either way, by using the sleek platforms presented by Kodzhovâs and Guglesâs alleged companies, aspirant traders could deal in crypto currencies, foreign exchange, commodities and other things besides, all aided by friendly finance whizzes over the phone.
Or so they thought. They, in this case, are several thousand South African âtradersâ who would in almost all cases never see their money again.
These South African victims have fallen under the sway of the rapidly expanding local leg of a staggering international enterprise simultaneously managing more than 70 online trading platforms across the world from a mysterious âback officeâ spread between Cyprus and Israel.
This nameless multinational syndicate has a staff complement of nearly 500 people targeting aspirant investors everywhere from Australia and Canada to Poland and Japan. If this were not enough, it appears that the organisation has branched out into an online âtrading academyâ as well as online gambling.
Victims have included South Africans from all walks of life, from pensioners who pinned their hopes on R3,500 investments to business owners who signed over millions.
And on the rare occasion someone got âprofitâ out, the evidence suggests that this was just bait to keep them putting in more.
Investments from South Africa and elsewhere mostly disappeared into a network of apparent fraud and subterfuge involving shell companies, offshore bank accounts and crypto currency exchanges.
Companies ostensibly run by the unemployed cleaner and model we mentioned at the outset are only the tip of the iceberg.
Beneath the surface lies a spectacular labyrinth of deceit.
This and other minutiae of this clandestine networkâs operations have been laid bare in a monumental leak of data originally provided to Sveriges Television, the Swedish national broadcaster, to which amaBhungane has gained access as part of a global consortium of media organisations coordinated by the Organized Crime and Corruption Reporting Project (OCCRP).
The leak contains thousands of recordings from call centres, screenshots from the computers of individuals managing the scheme as well as many thousands of documents and detailed spreadsheets tabulating everything from the global income of the various âteamsâ through to the office party expenses of call centre employees.
What emerges is a dark and cynical business, hidden behind the fig leaf of cutting-edge fintech, churning out what the conspirators call trading âbrandsâ â each with a dedicated website and staff.
The brands supposedly belonging to Kodzhov and Gugles sit among dozens the managers of the scheme can monitor at the same time using a back-end dashboard.
Based on our calculations from data in the leak, these centrally controlled âbrandsâ appear to have collected deposits from tens of thousands of individuals across the world since the schemeâs relatively modest beginnings in 2021.
Records show that by the end of last year the total had swollen to at least $247-million â well over R4.4-billion.
Crucially, throughout the voluminous recordings, spreadsheets and other documents in the leak, there is very little proof that any of this money was actually used to trade anything.
Where trading seemingly did occur, the leak suggests that it was manipulated and under the control of a âdealing deskâ. In a document describing âroles within the companyâ, the powers of this desk are said to include the ability âto make changes in ongoing trades,
open/close, adjustment of pricing and even deleted ones when neededâ.
Another major clue that these âinvestmentsâ are very likely bogus is the negligible level of withdrawals or cash-outs that are reflected. Our interactions with victims suggest these are hard won and sometimes only follow complaints of fraud.
While effortless withdrawals are always part of the pitch for new recruits, the reality is that there are a host of ways to block these, often by claiming that victims have an âopen positionâ on the market and have to wait a few days. After this wait they are either told that the âmarket went against themâ or get cajoled into a new investment.
Our data shows that the systemâs overall deposits of $247-million were followed by withdrawals of only $7-million globally over 70-odd platforms. Thatâs 3%.
South Africa has been a prominent target, but the available evidence shows that it has also played an outsized role in the larger international schemeâs tangled financial arrangements. Managers of the network also include a number of South African expats now based in Cyprus and Israel.
AmaBhungane will lift the veil on the wizards in the backroom and the complex fronts they have constructed in Part Two of this exposé.
For now, we will explore what for lack of a formal name we will call Scam Empire.
Step one: bait and switch
Clickbait ads are so ubiquitous that many of us simply accept them as an online nuisance, but the leak shows how shockingly effective this kind of online bait can be and how organised and cynical this opaque world is.
This completely unregulated business involves companies based far and wide.
Records in the leaks show that the companies that captured the most South Africans are based in Bulgaria, Israel, Singapore and the Czech Republic, among other places. More on them below.
For many victims of Scam Empire their ordeal started with an online ad featuring fake celebrity endorsements.
One South African who lost over R300,000 told us his involvement began with a fake video of Elon Musk on YouTube. Musk is in fact a ubiquitous fake feature, sometimes presented as punting the notorious and entirely fictitious âQuantum AIâ trading robot.
Another victim who lost R400,000 says she was caught, ironically, by a Facebook ad featuring prominent local consumer rights journalist Devi Govender.
According to the victim, âDeviâ was punting effortless risk-free income âfrom the comfort of your bedâ.
Govender told us she has come across numerous scams using her name, so many in fact that she had to give up trying to stem the tide: âDonât fall for it,â she warned.
These ads are the handiwork of so-called âaffiliate marketersâ who, in the parlance of the business, âsell trafficâ to the online trading platform sites.
Since the marketers are independent of the client and unregulated, they can essentially make any ludicrous claim they want, without consequences.
Itâs a big business, replete with international expos and networking events.
While there are legitimate reasons to fish for eyeballs online, the more than 160 marketers feeding victims to Scam Empire are being handsomely rewarded for this complicity, and often resort to naked lies.
Records in the leak show that when a new trading client makes a âfirst time depositâ the affiliate marketer pockets at least $750 (about R13,900). Tellingly, a South African âscalpâ is generally worth $800, while a Canadian earns you closer to $ 1,100.
This is expressly set out in one marketing agreement in the leak where South Africa is relegated to âTier 2â â one step above âLatamâ (Latin America).
This seems to suggest that the majority of small one-time investors, the people putting in less than this fee, are actually loss-making for the trading platform scammers.Â
The whole model relies on repeat investors, often âwhalesâ who put in ruinous amounts. The records show that there are, however, plenty of these. While half the deposits in 2024 were âfirst timeâ, follow-up investments make up 97% of the value.
Itâs all about getting people hooked.
For the affiliates, these per capita payments rapidly add up as thousands of people sign on.
By January 2024, Scam Empire had probably spent between $36-million and $50-million (which is to say nearly R1-billion) âbuying trafficâ, a rough estimate arrived at by multiplying the number of victims by the lower and higher ends of the prices that generally apply.
Since then, it has spent another $11-million, according to amaBhunganeâs partners in the Organized Crime and Corruption Reporting Project consortium who calculated this figure by analysing the cryptocurrency wallets almost universally used for payments.
Recall the trading platforms ostensibly controlled by the unemployed Bulgarian Boris Kodzhov: Finbok and Finxocap.
These two platforms are operated by âhisâ South African company Vector Financial Services, much like the Romanian model Guglesâs Libra Wealth operates VP Trade.
Before this, Kodzhov also seemingly owned the ill-fated SkyMT.
The real hands controlling these operations are the subject of Part Two, but for now the basics are important.
Vector and Libra are what are known as juristic representatives. They piggyback on the financial services provider (FSP) licence of another company â in this case Astrix Data. This is legal.
As an aside, this structure was apparently very recently abandoned, but we will get to that in Part Two.
Finbok and Finxocap are big players and have seemingly left destruction in their wake.
They have taken in deposits of at least $13.4-million while allowing withdrawals of $1.3-million. Half of these withdrawals belonged to just two extremely large depositors, both of whom have proven hard to get hold of. Most victims are in South Africa, although the records show Finbok more recently branching out overseas.
By and large, everyone loses their money.
While the Financial Sector Conduct Authority said last year that it was investigating complaints from investors struggling to withdraw their âinvestmentsâ from Finbok, it appears that the regulator is not aware that it is scratching the surface of a colossal international enterprise.
The investigation, we are told, is ongoing.
When it comes to Scam Empire, however, these South African companies are exceptional in a number of ways.
For one thing, they are actual companies with actual licences. Much of the larger scam consists of phantom platforms with no underlying legal entity, platforms that operate without licences or platforms that have licences in relatively lax island jurisdictions.
The South African ones in fact fall under a special âdivisionâ of the organisation named âZA_Regulatedâ.
Dustan Cornelissen, the local director of Vector Financial Services, Libra Wealth and Astrix Data (he was not involved in SkyMT), told us everything was above board.
He states that he provides regulatory compliance but does not control the companies or the platforms which, he insists, are just portals the traders use to access markets.
On his version they knowingly expose themselves to high-risk trading and sometimes lose: âLosses are an unfortunate reality in any speculative financial activity, whether it be trading, online casinos, or sports betting. The individuals in question were traders, not âwould-be investorsâ. Their decision to engage in trading was voluntary and based on their own risk assessment.â
Cornelissen told our partners at the Organized Crime and Corruption Reporting Project, âI have personally resolved every complaint lodged in South Africa by presenting a portfolio of evidence to the relevant authorities, including banks, the Financial Sector Conduct Authority, and the Ombudsman. To date, we have not lost a single case.â
We will consider Cornelissenâs role in more detail in Part Two. His assertions will need to be tested against evidence revealed in the leak concerning the wider network, evidence that indicates the use of front companies, suspicious financial arrangements, fake documents and fraud claims.
The leak also shows call centre âaccount managersâ pushing clients into investments they barely understand, as well as the ubiquitous use of misleading advertising to lure in new âtradersâ.
Step two: Into the rabbit hole
The fake ads lead investors to the engine room â call centres.
First, they will land on the site of the trading platform âbrandâ. In the case of South Africans this would be Finbok and Finxocap (after the short-lived SkyMT bit the dust).
As a potential investor, you will be asked to fill in your details, and before long someone will call.
And call and call and call.
Everyone we and our partners spoke to cited the pushiness and incessant harassment they suffered or continue to suffer. Internal guidelines direct agents to call each assigned client three times per shift.
The sources of the calls are disguised, and you would most likely see a South African number on your phone.
The leak, however, has made it possible to track down the real physical locations from where agents call the various countries targeted by Scam Empire.
If you have ever received a call from Finbok it probably came from a Bulgarian office that is, confusingly, codenamed âSerbiaâ.
In âSerbiaâ there are subdivisions. Finbok is only one of the operations housed there, in an office our Organized Crime and Corruption Reporting Project partners recently visited only to be told it had been hastily evacuated in December.
Inside this âSerbiaâ office, the South African operation (Finbok) had two further codenames â âBentleyâ and âD&Jâ.
And then there is Finxocap.
If you received a call from them before October last year it most likely came from a Cyprus office codenamed âTeslaâ.
This then moved to the âSerbiaâ office and was renamed âRolls Royceâ.
The South Africa-based VP Trade platform â which targeted South Americans â was also in âSerbiaâ, but for at least a small period shifted to Barcelona, presumably because of a need for native Spanish-speaking agents.
Extensive records for the call centres reveal a shocking hothouse of bullying and deceit.
The leak contains thousands of hours of recorded calls and evaluations of individual calls where âagent riskâ and âclient riskâ (for instance a client who might lay complaints or sue) had been identified.
Perhaps most telling are actual manuals and presentations on how to deal with hesitant âtradersâ.
The mostly East European agents have seemingly been carefully coached to push inexperienced clients towards often ruinous âinvestmentsâ, but first they must test the waters and secure the first deposit.
In chat groups the prospective investorsâ profiles are posted as they come in, including telegrammatic notes on whether they had any experience with financial products and whether they had income or savings or, for instance, assets they could conceivably borrow against.
These are in many ways the most pointed demonstration of the cynicism roiling in the back room, especially since selling complex financial products to people with zero experience and little money is extremely unethical even before fraud enters the picture.
Some egregious examples of how new investors were described stand out:
âReally bad experience⊠part timer at some low-life job,â reads one of these missives about a 62-year-old who did make an investment.
âNote: most of his family members have died and heâs doing this with high hopes to have a better legacy to leave his children.â
Another note, dealing with a 45-year-old âclientâ who made a deposit with Finbok, reads:
âUnemployed, sells food for a livingâ
âNote: wants to build a houseâ
The supposed finance whizzes on the phone who were making these notes did also, however, make efforts to befriend victims.
And there is a playbook for that.
Contained in the leak are a variety of training materials, including a âbible of rebuttalsâ that gives country-specific advice on talking past people who object on the phone.
The instructions are straightforward and include, for instance: âWe will ignore what the client says and keep talking fluently without stopping â here we must talk about profits and try to create a âhookâ for the client to âbiteâ and then he will move on and forget the rebuttal.â
According to the âbibleâ, South Africans often lie that they donât have their bank card on them. As a response, the manual suggests using âammunitionâ such as âyou want money for your new baby on the wayâ. Another option is to âstress him outâ by claiming there are limited licences for the trading software left, or that some major event is imminent that could create profits.
If someone says they are afraid of being scammed, the agent should try âempathyâ by saying âI was also scammed once long agoâ.
If someone has previously lost money in a scheme: âReally (be a bit surprised) Iâm so sorry to hear that!â
The agents working for the regulated South African companies are trained to avoid certain legally dangerous formulations. Specifically, they can never outright promise profits, but rather say something like âthe majority of traders made around 30-40% returns last monthâ.
Even though fake celebrity endorsements are used via the affiliate marketers the agents themselves are supposed to avoid doing the same: âThe agents must avoid direct affiliation with famous names or companies the customers see on the ads.â
This rule is broken often in practice.
Possibly the most damning evidence of how agents are taught to lie or withhold information comes from an âoffice rules and guidelinesâ document dealing specifically with VP Trade, the platform of South Africa-based Libra Wealth.
A draft is in the leak showing how a manager added comments for changes.
One of the rules is that âoffice location cannot be sharedâ, to which the manager added a comment: âRemove â you donât want this document to land in the hands of a third party â this must be conveyed orally.â
In a section titled âbenefits of the regulationâ agents are told they can inform clients that they can complain to the regulator. However, according to the manager they should guide the complainants to the FAIS ombud and not to the Financial Service Conduct Authority, which could suspend licences while conducting investigations.
âYou donât want clients to approach the FSCA â this way we got more control over the complaints and there is less chance the complaint will affect the activities negativelyâ
In a note that seems to indicate that the trading platforms are simply fake and do not âfacilitateâ investments is a âfrequently asked questionsâ entry titled âHow are you making money?â.
The draft claimed that âVP Trade makes a small commission (â 0.5-2%) on every position you open on the market!â
The manager, however, ordered this to be scrapped and said that âinstead of mentioning commission we should rather explain how VP Trade makes moneyâ.
In other words, the platform was choosing between two completely different options on what to tell prospective investors â an indication that perhaps neither is true.
While agents are meant to build up a personal rapport, they also use fake âstage namesâ that are formally assigned. Tellingly, these often replace agentsâ clearly Eastern European names with more Western-sounding ones.
Some agents have three different names they use with different clients.
According to the leak, there are close to 490 agents involved in the Scam Empire network. Those who manage to shake loose enough deposits are handsomely rewarded with bonuses and even gifts of expensive watches.
One particularly extreme case was an agent for one of the major unregulated platforms who seemingly received a Rolex, along with $130,000 in bonuses, after scamming Briton Stuart Daburn out of $5-million.
Tellingly, a record of office expenses contains the line item âPolygraph, fixed toilet, taxi for securityâ, as well as a number of party-related costs, including âdeposit for midgetsâ.
Despite the careful coaching, agents often go off script. The leak contains masses of call reviews where agentsâ problematic claims are highlighted.
By and large, these involve promising absurd profits or lying that Elon Musk is somehow involved and that there is some or other AI-powered trading robot doing all the work, which would be false even if there was real trading going on.
Scam Empireâs financial arrangements are convoluted, opaque and heavily reliant on cryptocurrency. From the leaks, however, it is possible to paint a picture of how layers of fronts move money across the world.
As mentioned earlier, there is little sign that any money is actually invested in the things clients believe they are trading.
But before you get the money out you need to get the money in.
Setting up payment service providers for the various brands is a constant preoccupation, and all the platforms in Scam Empire have numerous ones â the records reflect up to 300 different services being used to collect money from âtradersâ.
The South African platforms seemingly made use of a number of extremely suspicious payment service providers that appear to have been stopgaps after more established ones withdrew due to fraud complaints.
For instance, a formal provider named Swiffy provided payment services for the SkyMT and Finbok platforms from May until November 2023.
In response to questions, it told us that it had terminated its services to these platforms due to fraud concerns. A âmonitoringâ spreadsheet in the leak shows at least three serious fraud allegations involving payments through Swiffy.
Swiffy added that âat the time of KYC checks both merchants were licenced with the Financial Sector Conduct Authority under the correct class of licence according to their stated business activitiesâ.
Worryingly, one payment service provider that took Swiffyâs place was in fact a scrap metal dealer â in Part Two, we will deal with this and other dodgy payment service providers used by SkyMT and Vector.
Another established payment provider said they had no problems with Finbok, one of the brands linked to Vector.
They told us: âWe have no recorded instances of fraud linked to this merchant⊠We note that the Financial Sector Conduct Authority has stated in its latest communication that its investigation is ongoing and that no findings have been made against any of the involved parties.â
The online âtradersâ also paid a total of R68-million straight into the accounts of Astrix Data â the financial services provider behind Vector.
Apart from the massive payments for online advertising, it is not easy to discern where the money goes.
The sole director of Astrix in South Africa is Cornelissen.
In his version of how the platformsâ financial arrangements worked, traders would deposit their investments with Astrix either directly or indirectly through payment services like those mentioned above.
Even though the money is in Astrixâs account, the company ânever holds clientsâ fundsâ.
âPractically how this happens is that clients deposit funds via EFT or payment gateways which eventually settle to the Finbok/Finxocap accounts. These funds are then credited immediately to their trading profile by our liquidity providers. All funds deposited are reflected on their trading profile â clients have the ability to withdraw all their funds via card refund or EFT directly to their bank accounts, or they have the ability to trade. As such, we never hold clientsâ funds.â
We have partial records for the accounts held by Vector and Astrix Data (the financial services provider behind it).
Payments from investors can be seen streaming in constantly. The only significant âexitâ point discernable is payments to a Cape Town crypto payment provider named Xago Technologies.
Investorsâ funds are regularly sent to Xago from Astrix. Xago keeps accounts in the UK and Switzerland.
Xago did not answer detailed questions but told us: âWe categorically deny being complicit in or enabling fraudulent or money laundering operations. We are fully cooperative and willing to engage with any investigations launched by regulators or authorities.â
This company has cropped up in several places in the Scam Empire leak, as well as elsewhere.
Like the payment service providers mentioned above, Xago also directly channelled investment payments from a handful of large depositors, including a number of South African investors, to the online trading platform companies.
Xago has also come up in a court case launched by one of the victims in the UK: the aforementioned Stuart Daburn, who has lost several million pounds.
According to the particulars of his claim, he was told to pay Bitcoin into his investment account using Xago. He then paid ÂŁ100,000 (almost R2.4-million) via this Cape Town company, with this becoming part of his loss.
This is a very partial window on the South African division of Scam Empireâs financial arrangements. As we will see in Part Two, however, it is indivisible from the larger global enterprise.
AmaBhungane and its Organized Crime and Corruption Reporting Project partners have contacted dozens of investors in Scam Empire platforms worldwide and they almost universally now claim it is a scam.
There are common experiences, including being frantically pushed to make new and different investments as soon as possible. When the investor signals that they want to take cash out of their trading account they suddenly unaccountably lose everything in a turn of supposed bad luck.
One victim who lost R1-million told us that after getting sucked into Finbok by a celebrity ad, his online âagentâ, who went by the stage name âGeorge Weberâ, first pushed him into oil, then stocks, then foreign exchange, until he had essentially lost all his money.
The agent did remember to repeatedly quote the playbook mentioned above, advising the investor that âthey make their profit on the spreadâ.
âItâs a total scam,â the âinvestorâ told us.
His agent George seemingly often went off script with investment advice and once told a client he doesnât âgive a ratâs assâ about his negative experiences in the past, according to reviews in the leak.
Another victim mentioned earlier who lost R300,000 was likewise talked into one investment after another â oil then cocoa then sugar. He says he tried to withdraw R75,000, but 45 minutes later it had disappeared.
He insists that his trades were manipulated, saying that the prices he could see on the chart presented to him were not the ones reflected in his trades. According to him he suffered âdeliberate sabotageâ and was told it would take three days to get his money out. He suffered his âlossesâ during this period.
The calls between him and an agent were reviewed, and at one point the agent tried to push his wife to get a home improvement loan to invest with.
The âtraderâ laid a complaint and before long received a call from a man who will feature extensively in Part Two â the seeming legal head of Scam Empireâs South African division who calls himself âPaul van Rensburgâ.
âVan Rensburgâ made the hapless investor an offer: R100,000 credit, non-withdrawable, so he could keep going. Essentially a loan.
This seems like something âVan Rensburgâ does according to documents in the leak where other traders are made similar offers, which are called âbonusesâ.
In one case where an investor complained he was offered either a R100,000 âbonusâ or R40,000 cash to walk away.
But these âtradersâ have something in common with a few hundred others who were allowed to withdraw at least some of their funds from Finbok: for some reason the company seemingly tried to disguise the fact that it had happened.
In the leak there are hundreds of clearly fake invoices. They each have a Vector Financial Services letterhead but all the letterheads are wrong and have wildly different designs.
The invoices are all addressed to investors who had got withdrawals, and match the amounts and dates of those withdrawals.
But for some reason, all these invoices claim to be bills for âonline marketing servicesâ.
Even more confusingly, they state that the investor is to pay Vector but give the investorâs bank details for payment.
We spoke to some of the people these invoices are addressed to and they expressed complete ignorance. They had neither seen the documents nor ever provided âonline marketing servicesâ.
It is hard to know what to make of these invoices, which effectively create accounting cover for payouts to âinvestorsâ by describing them as business expenses.
This is, however, speculation, because with Scam Empire nothing is ever really straightforward.
Cornelissen told our partners at Organized Crime and Corruption Reporting Project that âthe claim that invoices for marketing services matched withdrawals from Finbok is incorrect. If there was a template error in any invoice, it was an administrative oversight, not an attempt to misrepresent transactions.â
Stay tuned for Part Two of Scam Empire, where we will pierce the veil of fancy websites and call centre soothsayers to find the hidden hands behind the system.
The question is: who are these people? DM
