Scam Empire (Part One): Inside the dark heart of a multinational investment scam
A data leak has unmasked a global network of alleged professional scammers drawing would-be investors into dodgy trading platforms on an industrial scale. A group of South Africans features in parts of the business — and the South African public is prominent among the victims.
A little-known Bulgarian entrepreneur named Boris Kodzhov has, since 2023, quietly made mammoth strides in the South African fintech sector.
Kodzhov seemingly launched not one but three multimillion-rand online trading platforms for complicated financial products called “contracts for difference” (CFD). Their defining characteristic is that you can very rapidly lose all your money, but the potential rewards, marketers will tell you, are boundless.
One of these platforms, SkyMT, briefly shot the lights out before going out of business early last year after roping in estimated deposits of R30-million.
The other two platforms, however, Finbok and Finxo Capital, have gone from strength to strength, collecting deposits of more than R240-million from aspirant traders since September 2023.
The problem is, the “fintech mogul” Kodzhov was until recently actually a cleaner working in Bulgaria’s capital Sofia for a modest salary of about R6,800. He has since retired to care for his sick mother and now lives off a government grant. Kodzhov doesn’t speak English and says he has never heard of either his South African companies or those he supposedly owns in other countries.
Another arrival in the local online trading scene is one Diana Gugles, who, as purported owner, sits behind the company Libra Wealth and its trading platform VP Trade.
The platform has roped in at least 2,000 traders, who have between them deposited R64-million — and that’s just since April last year.
Gugles, a professional model, also struggled to recall her fintech start-up which, while based in South Africa, targets investors in South America.
By all appearances, Kodzhov and Gugles have either been the victims of identity theft or have allowed their identities to be used for setting up companies halfway across the world.
Either way, by using the sleek platforms presented by Kodzhov’s and Gugles’s alleged companies, aspirant traders could deal in crypto currencies, foreign exchange, commodities and other things besides, all aided by friendly finance whizzes over the phone.
Or so they thought. They, in this case, are several thousand South African “traders” who would in almost all cases never see their money again.
These South African victims have fallen under the sway of the rapidly expanding local leg of a staggering international enterprise simultaneously managing more than 70 online trading platforms across the world from a mysterious “back office” spread between Cyprus and Israel.
This nameless multinational syndicate has a staff complement of nearly 500 people targeting aspirant investors everywhere from Australia and Canada to Poland and Japan. If this were not enough, it appears that the organisation has branched out into an online “trading academy” as well as online gambling.
Victims have included South Africans from all walks of life, from pensioners who pinned their hopes on R3,500 investments to business owners who signed over millions.
And on the rare occasion someone got “profit” out, the evidence suggests that this was just bait to keep them putting in more.
Investments from South Africa and elsewhere mostly disappeared into a network of apparent fraud and subterfuge involving shell companies, offshore bank accounts and crypto currency exchanges.
Companies ostensibly run by the unemployed cleaner and model we mentioned at the outset are only the tip of the iceberg.
Beneath the surface lies a spectacular labyrinth of deceit.
This and other minutiae of this clandestine network’s operations have been laid bare in a monumental leak of data originally provided to Sveriges Television, the Swedish national broadcaster, to which amaBhungane has gained access as part of a global consortium of media organisations coordinated by the Organized Crime and Corruption Reporting Project (OCCRP).
The leak contains thousands of recordings from call centres, screenshots from the computers of individuals managing the scheme as well as many thousands of documents and detailed spreadsheets tabulating everything from the global income of the various “teams” through to the office party expenses of call centre employees.
What emerges is a dark and cynical business, hidden behind the fig leaf of cutting-edge fintech, churning out what the conspirators call trading “brands” — each with a dedicated website and staff.
The brands supposedly belonging to Kodzhov and Gugles sit among dozens the managers of the scheme can monitor at the same time using a back-end dashboard.
Based on our calculations from data in the leak, these centrally controlled “brands” appear to have collected deposits from tens of thousands of individuals across the world since the scheme’s relatively modest beginnings in 2021.
Records show that by the end of last year the total had swollen to at least $247-million — well over R4.4-billion.
Crucially, throughout the voluminous recordings, spreadsheets and other documents in the leak, there is very little proof that any of this money was actually used to trade anything.
Where trading seemingly did occur, the leak suggests that it was manipulated and under the control of a “dealing desk”. In a document describing “roles within the company”, the powers of this desk are said to include the ability “to make changes in ongoing trades, open/close, adjustment of pricing and even deleted ones when needed”.
Another major clue that these “investments” are very likely bogus is the negligible level of withdrawals or cash-outs that are reflected. Our interactions with victims suggest these are hard won and sometimes only follow complaints of fraud.
While effortless withdrawals are always part of the pitch for new recruits, the reality is that there are a host of ways to block these, often by claiming that victims have an “open position” on the market and have to wait a few days. After this wait they are either told that the “market went against them” or get cajoled into a new investment.
Our data shows that the system’s overall deposits of $247-million were followed by withdrawals of only $7-million globally over 70-odd platforms. That’s 3%.
South Africa has been a prominent target, but the available evidence shows that it has also played an outsized role in the larger international scheme’s tangled financial arrangements. Managers of the network also include a number of South African expats now based in Cyprus and Israel.
AmaBhungane will lift the veil on the wizards in the backroom and the complex fronts they have constructed in Part Two of this exposé.
For now, we will explore what for lack of a formal name we will call Scam Empire.
Step one: bait and switch
Clickbait ads are so ubiquitous that many of us simply accept them as an online nuisance, but the leak shows how shockingly effective this kind of online bait can be and how organised and cynical this opaque world is.
This completely unregulated business involves companies based far and wide.
Records in the leaks show that the companies that captured the most South Africans are based in Bulgaria, Israel, Singapore and the Czech Republic, among other places. More on them below.
For many victims of Scam Empire their ordeal started with an online ad featuring fake celebrity endorsements.
One South African who lost over R300,000 told us his involvement began with a fake video of Elon Musk on YouTube. Musk is in fact a ubiquitous fake feature, sometimes presented as punting the notorious and entirely fictitious “Quantum AI” trading robot.
Another victim who lost R400,000 says she was caught, ironically, by a Facebook ad featuring prominent local consumer rights journalist Devi Govender.
According to the victim, “Devi” was punting effortless risk-free income “from the comfort of your bed”.
Govender told us she has come across numerous scams using her name, so many in fact that she had to give up trying to stem the tide: “Don’t fall for it,” she warned.
These ads are the handiwork of so-called “affiliate marketers” who, in the parlance of the business, “sell traffic” to the online trading platform sites.
Since the marketers are independent of the client and unregulated, they can essentially make any ludicrous claim they want, without consequences.
It’s a big business, replete with international expos and networking events.
While there are legitimate reasons to fish for eyeballs online, the more than 160 marketers feeding victims to Scam Empire are being handsomely rewarded for this complicity, and often resort to naked lies.
Records in the leak show that when a new trading client makes a “first time deposit” the affiliate marketer pockets at least $750 (about R13,900). Tellingly, a South African “scalp” is generally worth $800, while a Canadian earns you closer to $ 1,100.
This is expressly set out in one marketing agreement in the leak where South Africa is relegated to “Tier 2” – one step above “Latam” (Latin America).
This seems to suggest that the majority of small one-time investors, the people putting in less than this fee, are actually loss-making for the trading platform scammers.
The whole model relies on repeat investors, often “whales” who put in ruinous amounts. The records show that there are, however, plenty of these. While half the deposits in 2024 were “first time”, follow-up investments make up 97% of the value.
It’s all about getting people hooked.
This seems to suggest that the majority of small one-time investors, the people putting in less than this fee, are actually loss-making for the trading platform scammers.
The whole model relies on repeat investors, often “whales” who put in ruinous amounts. The records show that there are, however, plenty of these. While half the deposits in 2024 were “first time”, follow-up investments make up 97% of the value.
It’s all about getting people hooked.
For the affiliates, these per capita payments rapidly add up as thousands of people sign on.
By January 2024, Scam Empire had probably spent between $36-million and $50-million (which is to say nearly R1-billion) “buying traffic”, a rough estimate arrived at by multiplying the number of victims by the lower and higher ends of the prices that generally apply.
Since then, it has spent another $11-million, according to amaBhungane’s partners in the Organized Crime and Corruption Reporting Project consortium who calculated this figure by analysing the cryptocurrency wallets almost universally used for payments.
Enter Vector
Recall the trading platforms ostensibly controlled by the unemployed Bulgarian Boris Kodzhov: Finbok and Finxocap.
These two platforms are operated by “his” South African company Vector Financial Services, much like the Romanian model Gugles’s Libra Wealth operates VP Trade.
Before this, Kodzhov also seemingly owned the ill-fated SkyMT.
The real hands controlling these operations are the subject of Part Two, but for now the basics are important.
Vector and Libra are what are known as juristic representatives. They piggyback on the financial services provider (FSP) licence of another company — in this case Astrix Data. This is legal.
As an aside, this structure was apparently very recently abandoned, but we will get to that in Part Two.
Finbok and Finxocap are big players and have seemingly left destruction in their wake.
They have taken in deposits of at least $13.4-million while allowing withdrawals of $1.3-million. Half of these withdrawals belonged to just two extremely large depositors, both of whom have proven hard to get hold of. Most victims are in South Africa, although the records show Finbok more recently branching out overseas.
By and large, everyone loses their money.
While the Financial Sector Conduct Authority said last year that it was investigating complaints from investors struggling to withdraw their “investments” from Finbok, it appears that the regulator is not aware that it is scratching the surface of a colossal international enterprise.
The investigation, we are told, is ongoing.
When it comes to Scam Empire, however, these South African companies are exceptional in a number of ways.
For one thing, they are actual companies with actual licences. Much of the larger scam consists of phantom platforms with no underlying legal entity, platforms that operate without licences or platforms that have licences in relatively lax island jurisdictions.
The South African ones in fact fall under a special “division” of the organisation named “ZA_Regulated”.
Dustan Cornelissen, the local director of Vector Financial Services, Libra Wealth and Astrix Data (he was not involved in SkyMT), told us everything was above board.
He states that he provides regulatory compliance but does not control the companies or the platforms which, he insists, are just portals the traders use to access markets.
On his version they knowingly expose themselves to high-risk trading and sometimes lose: “Losses are an unfortunate reality in any speculative financial activity, whether it be trading, online casinos, or sports betting. The individuals in question were traders, not ‘would-be investors’. Their decision to engage in trading was voluntary and based on their own risk assessment.”
Cornelissen told our partners at the Organized Crime and Corruption Reporting Project, “I have personally resolved every complaint lodged in South Africa by presenting a portfolio of evidence to the relevant authorities, including banks, the Financial Sector Conduct Authority, and the Ombudsman. To date, we have not lost a single case.”
We will consider Cornelissen’s role in more detail in Part Two. His assertions will need to be tested against evidence revealed in the leak concerning the wider network, evidence that indicates the use of front companies, suspicious financial arrangements, fake documents and fraud claims.
The leak also shows call centre “account managers” pushing clients into investments they barely understand, as well as the ubiquitous use of misleading advertising to lure in new “traders”.
Step two: Into the rabbit hole
The fake ads lead investors to the engine room — call centres.
First, they will land on the site of the trading platform “brand”. In the case of South Africans this would be Finbok and Finxocap (after the short-lived SkyMT bit the dust).
As a potential investor, you will be asked to fill in your details, and before long someone will call.
And call and call and call.
Everyone we and our partners spoke to cited the pushiness and incessant harassment they suffered or continue to suffer. Internal guidelines direct agents to call each assigned client three times per shift.
The sources of the calls are disguised, and you would most likely see a South African number on your phone.
The leak, however, has made it possible to track down the real physical locations from where agents call the various countries targeted by Scam Empire.
If you have ever received a call from Finbok it probably came from a Bulgarian office that is, confusingly, codenamed “Serbia”.
In “Serbia” there are subdivisions. Finbok is only one of the operations housed there, in an office our Organized Crime and Corruption Reporting Project partners recently visited only to be told it had been hastily evacuated in December.
Inside this “Serbia” office, the South African operation (Finbok) had two further codenames — “Bentley” and “D&J”.
And then there is Finxocap.
If you received a call from them before October last year it most likely came from a Cyprus office codenamed “Tesla”.
This then moved to the “Serbia” office and was renamed “Rolls Royce”.
The South Africa-based VP Trade platform — which targeted South Americans — was also in “Serbia”, but for at least a small period shifted to Barcelona, presumably because of a need for native Spanish-speaking agents.
The boiler room
Extensive records for the call centres reveal a shocking hothouse of bullying and deceit.
The leak contains thousands of hours of recorded calls and evaluations of individual calls where “agent risk” and “client risk” (for instance a client who might lay complaints or sue) had been identified.
Perhaps most telling are actual manuals and presentations on how to deal with hesitant “traders”.
The mostly East European agents have seemingly been carefully coached to push inexperienced clients towards often ruinous “investments”, but first they must test the waters and secure the first deposit.
In chat groups the prospective investors’ profiles are posted as they come in, including telegrammatic notes on whether they had any experience with financial products and whether they had income or savings or, for instance, assets they could conceivably borrow against.
These are in many ways the most pointed demonstration of the cynicism roiling in the back room, especially since selling complex financial products to people with zero experience and little money is extremely unethical even before fraud enters the picture.
Some egregious examples of how new investors were described stand out:
“Really bad experience… part timer at some low-life job,” reads one of these missives about a 62-year-old who did make an investment.
“Note: most of his family members have died and he’s doing this with high hopes to have a better legacy to leave his children.”
Another note, dealing with a 45-year-old “client” who made a deposit with Finbok, reads:
“No Exp”
“Unemployed, sells food for a living”
“Note: wants to build a house”
The supposed finance whizzes on the phone who were making these notes did also, however, make efforts to befriend victims.
And there is a playbook for that.
The scammer’s manual
Contained in the leak are a variety of training materials, including a “bible of rebuttals” that gives country-specific advice on talking past people who object on the phone.
The instructions are straightforward and include, for instance: “We will ignore what the client says and keep talking fluently without stopping — here we must talk about profits and try to create a ‘hook’ for the client to ‘bite’ and then he will move on and forget the rebuttal.”
According to the “bible”, South Africans often lie that they don’t have their bank card on them. As a response, the manual suggests using “ammunition” such as “you want money for your new baby on the way”. Another option is to “stress him out” by claiming there are limited licences for the trading software left, or that some major event is imminent that could create profits.
If someone says they are afraid of being scammed, the agent should try “empathy” by saying “I was also scammed once long ago”.
If someone has previously lost money in a scheme: “Really (be a bit surprised) I’m so sorry to hear that!”
The agents working for the regulated South African companies are trained to avoid certain legally dangerous formulations. Specifically, they can never outright promise profits, but rather say something like “the majority of traders made around 30-40% returns last month”.
Even though fake celebrity endorsements are used via the affiliate marketers the agents themselves are supposed to avoid doing the same: “The agents must avoid direct affiliation with famous names or companies the customers see on the ads.”
This rule is broken often in practice.
Possibly the most damning evidence of how agents are taught to lie or withhold information comes from an “office rules and guidelines” document dealing specifically with VP Trade, the platform of South Africa-based Libra Wealth.
A draft is in the leak showing how a manager added comments for changes.
One of the rules is that “office location cannot be shared”, to which the manager added a comment: “Remove — you don’t want this document to land in the hands of a third party — this must be conveyed orally.”
In a section titled “benefits of the regulation” agents are told they can inform clients that they can complain to the regulator. However, according to the manager they should guide the complainants to the FAIS ombud and not to the Financial Service Conduct Authority, which could suspend licences while conducting investigations.
“You don’t want clients to approach the FSCA — this way we got more control over the complaints and there is less chance the complaint will affect the activities negatively”
In a note that seems to indicate that the trading platforms are simply fake and do not “facilitate” investments is a “frequently asked questions” entry titled “How are you making money?”.
The draft claimed that “VP Trade makes a small commission (≈ 0.5-2%) on every position you open on the market!”
The manager, however, ordered this to be scrapped and said that “instead of mentioning commission we should rather explain how VP Trade makes money”.
In other words, the platform was choosing between two completely different options on what to tell prospective investors — an indication that perhaps neither is true.
While agents are meant to build up a personal rapport, they also use fake “stage names” that are formally assigned. Tellingly, these often replace agents’ clearly Eastern European names with more Western-sounding ones.
Some agents have three different names they use with different clients.
According to the leak, there are close to 490 agents involved in the Scam Empire network. Those who manage to shake loose enough deposits are handsomely rewarded with bonuses and even gifts of expensive watches.
One particularly extreme case was an agent for one of the major unregulated platforms who seemingly received a Rolex, along with $130,000 in bonuses, after scamming Briton Stuart Daburn out of $5-million.
Tellingly, a record of office expenses contains the line item “Polygraph, fixed toilet, taxi for security”, as well as a number of party-related costs, including “deposit for midgets”.
Despite the careful coaching, agents often go off script. The leak contains masses of call reviews where agents’ problematic claims are highlighted.
By and large, these involve promising absurd profits or lying that Elon Musk is somehow involved and that there is some or other AI-powered trading robot doing all the work, which would be false even if there was real trading going on.
Step three: The money
Scam Empire’s financial arrangements are convoluted, opaque and heavily reliant on cryptocurrency. From the leaks, however, it is possible to paint a picture of how layers of fronts move money across the world.
As mentioned earlier, there is little sign that any money is actually invested in the things clients believe they are trading.
But before you get the money out you need to get the money in.
Setting up payment service providers for the various brands is a constant preoccupation, and all the platforms in Scam Empire have numerous ones — the records reflect up to 300 different services being used to collect money from “traders”.
The South African platforms seemingly made use of a number of extremely suspicious payment service providers that appear to have been stopgaps after more established ones withdrew due to fraud complaints.
For instance, a formal provider named Swiffy provided payment services for the SkyMT and Finbok platforms from May until November 2023.
In response to questions, it told us that it had terminated its services to these platforms due to fraud concerns. A “monitoring” spreadsheet in the leak shows at least three serious fraud allegations involving payments through Swiffy.
Swiffy added that “at the time of KYC checks both merchants were licenced with the Financial Sector Conduct Authority under the correct class of licence according to their stated business activities”.
Worryingly, one payment service provider that took Swiffy’s place was in fact a scrap metal dealer — in Part Two, we will deal with this and other dodgy payment service providers used by SkyMT and Vector.
Another established payment provider said they had no problems with Finbok, one of the brands linked to Vector.
They told us: “We have no recorded instances of fraud linked to this merchant… We note that the Financial Sector Conduct Authority has stated in its latest communication that its investigation is ongoing and that no findings have been made against any of the involved parties.”
The online “traders” also paid a total of R68-million straight into the accounts of Astrix Data — the financial services provider behind Vector.
Apart from the massive payments for online advertising, it is not easy to discern where the money goes.
The sole director of Astrix in South Africa is Cornelissen.
In his version of how the platforms’ financial arrangements worked, traders would deposit their investments with Astrix either directly or indirectly through payment services like those mentioned above.
Even though the money is in Astrix’s account, the company “never holds clients’ funds”.
“Practically how this happens is that clients deposit funds via EFT or payment gateways which eventually settle to the Finbok/Finxocap accounts. These funds are then credited immediately to their trading profile by our liquidity providers. All funds deposited are reflected on their trading profile — clients have the ability to withdraw all their funds via card refund or EFT directly to their bank accounts, or they have the ability to trade. As such, we never hold clients’ funds.”
We have partial records for the accounts held by Vector and Astrix Data (the financial services provider behind it).
Payments from investors can be seen streaming in constantly. The only significant “exit” point discernable is payments to a Cape Town crypto payment provider named Xago Technologies.
Investors’ funds are regularly sent to Xago from Astrix. Xago keeps accounts in the UK and Switzerland.
Xago did not answer detailed questions but told us: “We categorically deny being complicit in or enabling fraudulent or money laundering operations. We are fully cooperative and willing to engage with any investigations launched by regulators or authorities.”
This company has cropped up in several places in the Scam Empire leak, as well as elsewhere.
Like the payment service providers mentioned above, Xago also directly channelled investment payments from a handful of large depositors, including a number of South African investors, to the online trading platform companies.
Xago has also come up in a court case launched by one of the victims in the UK: the aforementioned Stuart Daburn, who has lost several million pounds.
According to the particulars of his claim, he was told to pay Bitcoin into his investment account using Xago. He then paid £100,000 (almost R2.4-million) via this Cape Town company, with this becoming part of his loss.
This is a very partial window on the South African division of Scam Empire’s financial arrangements. As we will see in Part Two, however, it is indivisible from the larger global enterprise.
Get out
AmaBhungane and its Organized Crime and Corruption Reporting Project partners have contacted dozens of investors in Scam Empire platforms worldwide and they almost universally now claim it is a scam.
There are common experiences, including being frantically pushed to make new and different investments as soon as possible. When the investor signals that they want to take cash out of their trading account they suddenly unaccountably lose everything in a turn of supposed bad luck.
One victim who lost R1-million told us that after getting sucked into Finbok by a celebrity ad, his online “agent”, who went by the stage name “George Weber”, first pushed him into oil, then stocks, then foreign exchange, until he had essentially lost all his money.
The agent did remember to repeatedly quote the playbook mentioned above, advising the investor that “they make their profit on the spread”.
“It’s a total scam,” the “investor” told us.
His agent George seemingly often went off script with investment advice and once told a client he doesn’t “give a rat’s ass” about his negative experiences in the past, according to reviews in the leak.
Another victim mentioned earlier who lost R300,000 was likewise talked into one investment after another — oil then cocoa then sugar. He says he tried to withdraw R75,000, but 45 minutes later it had disappeared.
He insists that his trades were manipulated, saying that the prices he could see on the chart presented to him were not the ones reflected in his trades. According to him he suffered “deliberate sabotage” and was told it would take three days to get his money out. He suffered his “losses” during this period.
The calls between him and an agent were reviewed, and at one point the agent tried to push his wife to get a home improvement loan to invest with.
The “trader” laid a complaint and before long received a call from a man who will feature extensively in Part Two — the seeming legal head of Scam Empire’s South African division who calls himself “Paul van Rensburg”.
“Van Rensburg” made the hapless investor an offer: R100,000 credit, non-withdrawable, so he could keep going. Essentially a loan.
This seems like something “Van Rensburg” does according to documents in the leak where other traders are made similar offers, which are called “bonuses”.
In one case where an investor complained he was offered either a R100,000 “bonus” or R40,000 cash to walk away.
But these “traders” have something in common with a few hundred others who were allowed to withdraw at least some of their funds from Finbok: for some reason the company seemingly tried to disguise the fact that it had happened.
Fake trail?
In the leak there are hundreds of clearly fake invoices. They each have a Vector Financial Services letterhead but all the letterheads are wrong and have wildly different designs.
The invoices are all addressed to investors who had got withdrawals, and match the amounts and dates of those withdrawals.
But for some reason, all these invoices claim to be bills for “online marketing services”.
Even more confusingly, they state that the investor is to pay Vector but give the investor’s bank details for payment.
We spoke to some of the people these invoices are addressed to and they expressed complete ignorance. They had neither seen the documents nor ever provided “online marketing services”.
It is hard to know what to make of these invoices, which effectively create accounting cover for payouts to “investors” by describing them as business expenses.
This is, however, speculation, because with Scam Empire nothing is ever really straightforward.
Cornelissen told our partners at Organized Crime and Corruption Reporting Project that “the claim that invoices for marketing services matched withdrawals from Finbok is incorrect. If there was a template error in any invoice, it was an administrative oversight, not an attempt to misrepresent transactions.”