— A collaborative investigation by 32 media outlets around the world, is based on files leaked by a whistleblower to Swedish Television (SVT) and coordinated by OCCRP, a global investigative journalism organization.
We are witnessing how disinformation and fake news are tainting the integrity of journalism. To disrupt the operations of these actors, Qurium has been exposing companies and their accomplices who facilitate the spread of disinformation. One year ago we revealed that three public affiliate marketing companies were not only facilitating the spread of disinformation, but also advertising a wide range of online scams. However, we did not have access to their victims and did not know who ultimately was benefiting from their marketing campaigns.
About the same time, the Swedish Television (SvT) received a 1.9TB leak containing information about two large networks of fraudulent call centers operating from Europe. These call centers had scammed more than 32,000 victims, persuading them to ‘invest’ in cryptocurrency schemes—investments that never existed, with the scammers pocketing all the money. The victims were lured by fraudulent advertisements created by affiliate networks.
It did not come as a surprise to us that TrafficON, Supreme Media and ROI Collective, the actors that we previously had exposed – those that denied our claims and threatened with legal measures – were important players in the Scam Empire operating these call centers. The difference is that this time we have witness statements from thousands of victims which reveal where the scam advertisements can be found.
The scale of the scam operations is immense – one of the networks dubbed by the consortium as “Sapphire Network” run call centers with offices in Israel, Cyprus, Ukraine and Bulgaria. The “Sapphire Network” generated no less than 247 million USD in deposits from 27,000 victims in 30 countries during the past four years (2021-2024). The Georgian call center, run by the A.K. Group, has squeezed 35 million USD from 6,000 victims from their Tbilisi office employing no less than 85 people.
The victims have been lured by fraudulent advertisements – created by affiliate networks promoted by social media platforms as Meta – to invest in fictitious trading platforms. The call centers are staffed with young and inexperienced “trading agents” that are trained and rewarded with hefty bonuses – Rolex watches and trips – for profitable victims.
These call centers make millions of calls per year via five common VoIP-providers that receive payments in crypto currency or wire transfers using proxy companies.
The back-offices of the call centers use a handful of Customer Relationship Managers (CRM) to keep track of victims profiles, trading agents’ performance, deposits and withdrawals among other things. The CRMs are customized to fit the needs of the call centers and the services. “Predator” is one of their internal systems that is only accessible by the management of the criminal organization. “Predator” is responsible of keeping track of company profits and victims personal data
The “profit” of the “Sapphire network” – the savings of the victims’ – is washed via regular bank transfers to fake companies established in several European countries. AML procedures are bypassed by hundreds of legally registered companies.
Qurium’s investigation aims to uncover the building blocks of these investment frauds and expose the technologies and service providers that are fundamental to its very existence.
The investment fraud can be divided in three major building blocks, Victims, Call Centers and Money, which Qurium will cover in the reports The Hunt, The Milking and The Washing.
The Hunt
Affiliate Marketing
Learn about how the call centers reach thousands of potential victims across the world via Affiliate Networks and turn them in to cash-cows in less than 20min. The approach is not sophisticated but successful considering that 32,000 victims were found in the leak.
Report (8 min read)
The Milking
The Call Centers
Welcome to visit a scam call centers’ office and learn from the inside how their operations is coordinated. Meet greedy “trade experts” that builds long-term relationships with their victims to achieve their final goal – empty their bank accounts.
The Washing
Financial Laundering
Learn how the victim’s deposits are washed via crypto-wallets to bank accounts in respected European banks via fictitious companies. Strict AML rules in Europe does not seem to be a hurdle to turn dirty money into shining profits.
Coming soon
Facts about the Scam Empire
The Scam Empire is a complex eco-system of criminal actors and third party players with lack of KYC and AML procedures in place. The consortium of journalists have therefore put together an explainer with answers to the most common questions.
All you need to know about the Scam Empire
The Accomplices – serving organized crime
The investment scams rely on a number of fundamental building blocks, each of them are connected to industries that benefit from the frauds.
Affiliate networks
A business that is specialized in promoting the brands used by the fraudsters and provide “leads” (victims) to the scammers. To achieve the goal they target their advertisements with paid ads in social media or they use other sources of spam traffic such as ‘push notifications’. Affiliate networks and their clients make use of specialized software (CRM) to find the offers to promote and jointly track the performance of their campaign promotions.
VoIP Providers
The call centers run by the fraudsters place phone calls and send SMSs to the victims. The telephony providers provide Voice over IP services to the call centers including the ability to spoof numbers, numbers for inbound calls and the smooth integration of their voice services with the customer relationship management (CRM) software run by the investment brands.
CRM providers
The call centers manage the database of victims and their deposits (funds) in customized Customer Relationship Management (CRM) systems. These investment platforms provide means for the fake brokers (scam agents) to simulate a credible investment environment with similar tools used in real trading platforms.
Bullet-proof Hosting providers
The different software components involved in the investments scams such as affiliate tracking, brands landing pages and CRM, must be hosted somewhere. These hosting providers often provide additional services to the scammers such as as virtual private networks (VPN) and the storage of customer data or the recording of phone calls.