A call centre in Cyprus was used as a front for an Israeli scam operation that appears to have targeted nearly 27,000 individuals around the world, convincing thousands of people to make “investments” of at least €230 mln on fake trading platforms from 2021 to 2024.
“They took everything from me,” said a Spanish architect in her 40s, identified as IGP, who was one of 26,810 victims.
She told investigative reporters that she “invested” €400,000 in crypto – mostly money from selling land she inherited from her mother. She lost her life savings within a month.
The network operated mainly from Cyprus, Israel, Bulgaria, Ukraine, Spain and North Macedonia, targeting would-be investors from call centres, and convincing them to make more and more deposits.
Until last year, the scam operation appears to have had a “Cyprus HQ,” and a call centre in Limassol. Most victims were in Canada, the UK, South Africa and western Europe.
A second group, using a call centre in Georgia, raised the total of victims to 32,000, and the scammed amount to €263 mln.
Scam Empire is a collaborative investigation by OCCRP, Swedish Television (SVT), and 30 other media partners, including the Cyprus Investigative Reporting Network (CIReN), that exposed the vast operation to allegedly scam thousands of victims.
SEE FULL INTERVIEW: Talking to OCCRP and CIReN investigator Andreas Cosma https://www.youtube.com/watch?v=TziRTr6UcI8
The CIReN team investigating this report includes Andreas Cosma, Christodoulos Mavroudis, Kyriakos Pieridis and Begoña P. Ramírez (InfoLibre).
Cyprus police did not reply to CIReN’s questions in time for publication.
Netting the victims
It was late October 2023 when IGP saw an online post featuring a popular Spanish TV host Pablo Motos who “let it slip” during an interview “that there were some ways to get money: if you invested €250 in a platform, little by little you would generate more money.”
The clip was fake. Similar ads on social media platforms used the likeness of tech billionaire-turned-Trump advisor Elon Musk and celebrity actor Ryan Reynolds, touting investment opportunities.
Clicking on an ad directs the victim to a landing page, where they’re prompted to enter their personal information. This generates an instant lead for affiliate marketers, who sell information about potential customers to paying clients, including call centres who target victims.
In IGP’s case, the affiliate marketer was Zeus Media, an apparent brand operated by a company called Sierra Media Ltd, based in the Bulgarian capital Sofia. According to leaked accounting records, Zeus Media was paid at least €1,000 for IGP’s details.
Marketers sell victim details
Records from more than half a million leaked internal documents and communications show that Sierra Media was paid €250,000 by one of the network’s call centres in the first nine months of 2023. Another affiliate marketer, Cryp, made over €800,000, according to internal expense reports. Some of the marketing firms were found to make millions of euros annually from their work with the alleged scammers.
The marketers signed contracts with EM Develop, which appears to be the scam center’s marketing company. It operates under the brand name Opulent Allies, has a Ukrainian address, and company records list its owner as Daryna Reznik. When reached by reporters, Reznik’s mother confirmed that her daughter had passed away in 2023, and claimed that she didn’t run any companies.
Though EM Develop is in Ukraine, it’s unclear where the marketing managers are based. Telegram conversations between the team members are conducted in Hebrew and English, suggesting they may be from, or based in, Israel.
Moving the Money
Reporters found that alleged scammers encouraged victims to set up accounts with electronic money services providers like Revolut, or online payment providers like Wise, that are not as strictly regulated as commercial banks.
Revolut told reporters in an email that it has “a sophisticated suite of financial crime detection systems, including customer due diligence and transaction monitoring,” and “a proven track record uncovering instances of financial crime.”
Wise said its verification processes, transaction monitoring, and account deactivations “help us prevent, detect and stop potential instances of financial crime and abuse of our services.”
IGP watched her investment grow on what appeared to be a legitimate trading platform, TIG Capital. It listed stocks, forex, crypto, currencies and commodities as options. Higher deposit accounts showed better returns, so IGP made eight deposits. But when she asked for documentation they just sent her what she saw on the platform.
TIGCap was named in a criminal complaint submitted by a Spanish lawyer on behalf of more than 70 victims, which was admitted by the nation’s High Court and is being investigated by prosecutors.
TIGCap is now the subject of warnings issued by securities commissions in Canada, Australia and Spain
The amount IGP lost is confirmed by records from a leaked database internally referred to as Predator, which the alleged scammers used to track victim details, including names, contacts, deposits, last successful call, IP address, and last online status.
“Cyprus HQ”
Leaked payroll spreadsheets and Telegram messages between call centre staff indicate there was a “Cyprus HQ” and a call centre nicknamed “Tesla,” which was likely located at the Victory House building in Limassol until at least mid-2024. Victory House is home to several serviced and virtual office space providers.
Expense records listed some €5,500 in relocation costs for “Moving of office from CY to Sofia” during that period. The call center is now believed to be operating from Bulgaria.
Economist Michalis Florendiades said that firms operating as call centres “should be under particularly close scrutiny because it is relatively easy for an experienced and well-trained call centre operator to manipulate and take advantage of an unsuspecting member of the public.”
Leaked records also listed payments for utilities to a director of a Cypriot company, Erynnis Limited, which was registered in December 2023.
Where does the money go?
It is difficult to trace where IGP and other victims’ money ended up. Some of it was channeled toward an online gaming platform, operated by a Curacao company with a Cypriot owner.
Creative Alliance was registered in Curacao in 2022, with a Cypriot national Theano Andreou as director. Leaked materials also identify her as the beneficial owner. Andreou could not be reached for comment.
According to expense records, the network spent €40,000 on a Curacao license to operate the online betting brand Betplays, €29,000 on affiliate marketer, and paid a monthly payroll of €70,000 in 2022.
Creative Alliance is now licensed in Anjouan, a tiny island in the southwestern Indian Ocean. Betplays has been blacklisted by authorities in Greece, Cyprus and Romania, and the subject of complaints from online players claiming to have been scammed, and being unable to withdraw their deposits or winnings.
Another Cypriot company called Prorole Enterprises Limited, received at least €127,000 in 2023 and 2024 from North Macedonian companies operated by the network. Prorole was set up in 2016 by Keith Ioakim, a South African with a track record of working for Cypriot trading firms that had been fined or banned by the Cyprus Securities and Exchanges Commission (CySEC). In July 2021, he transferred ownership of Prorole to his Cypriot wife.
When contacted by reporters, Ioakim confirmed that Prorole had provided the companies with services related to obtaining South African financial licenses for operating trading platforms (two of the platforms were licensed in South Africa). He claimed that Prorole received a total of €202,552 from the companies, but denied any involvement in or knowledge of Prorole’s client operations or links to fraudulent investment platforms.
Ioakim also claimed that the firms he previously worked for were charged and fined for offences that happened prior to or after his employment and that he had never been personally charged or convicted of any crime.
None of the companies in the leak were licensed by CySEC. However multiple individuals connected to the network had previously worked for companies that had faced administrative fines from CySEC, and in some cases faced criminal investigations.
Among CySEC’s duties is to provide appropriate protections for uninformed investors by ensuring those that participate in these markets appropriately explain the risks of such investments to their customers and don’t carry out aggressive marketing techniques or cold calling, said the regulator’s former chairman, Georgios Charalambous.
He told CIReN that problems in Cyprus’ financial sector can mainly be attributed to ineffective supervision.
Another former chairman, Marios Clerides, told CIReN that it is increasingly difficult to monitor activities of financial firms due to the increase in online scam networks using fake websites and credentials, adding that differences in priorities of specific countries’ regulators and law enforcement authorities cause additional difficulties in completing successful cross-border investigations.
In an emailed statement, a CySEC spokesperson told CIReN that the regulator “takes allegations of fraud, within the investment firms it supervises, extremely seriously.”
CySEC did not comment on the Cypriot entities identified by reporters.
