THE MILKING

7 March 2025

The Scam Empire leaked material contains more than 20,000 hours of voice calls between agents and victims, screen recordings of staff members’ desktops, team chats, invoices and contracts. Thanks to the anonymous leak, we have managed to get a good understanding on how the call centers operate and who the people behind them are.

This article aims to shed light into how a scam call center is operated and how the staff is trained to reach the ultimate goal – scam each victim to its last penny.

The business units can be divided in two large functional departments – the “Call Center” (blue) and the “Back Office” (green).

THE CALL CENTER

The Conversion Department – the enrollment

When a potential victim applies to take part of the “investment opportunity”, an agent responsible for enrollment to the platform calls back within a day. But it is not uncommon that if the person applies during business hours, a conversion agent calls back the victim within minutes.

This agent – a so called “Conversion agent” – is friendly, helpful and has unlimited patience with people struggling to log in, change password or upload documents. The agent presents himself or herself as coming from one of the companies (brands) run the scam network like Golden Currencies, FX Admirals, Onyx Traders or BitcoinHunters. In this initial contact, the victim is often confused as the pages they signed up coming from an affiliate campaign in social media use another names, like BitApp24 or Bitcoin360Ai.

A Conversion Agent is likely a “junior” position in the organization and it is unclear whether they are fully aware of the extend of the ongoing scam. They are guided by a written script, where the compliment “Oh, your voice sounds much younger!” is always given as a response to the question about the victim’s age.

After listening to several hundreds of phone calls from the different call centers and reviewing several manuals available in the leak we have no doubts that call centers receive training to operate as members of a “franchise”.

In summary the enrollment process includes the following steps:

• Personal information: The agent collects basic information about the victim
  • Age: There are no off-limits in terms of upper age, as we have seen people over 80 years with being targeted without mercy. A victim with age 21 quickly got dropped by her agent, assumable since the chance of her having money was slim.
  • Occupation: Gives an indication on the victim’s financial capacity.
  • Annual salary: Gives an indication on the victim’s financial capacity.
  • Nationality: Some nationalities are “off-limit” (for example US, Israel, Russia, Germany). US, Israel and Germany are likely avoided due to the increased risk of lawsuits. Call centers tend not to scam people in the same country as they physically operate from. The scammers ask the victims for second nationality to be 100% sure that are eligible.
  • Investment target: Another way to measure their financial capacity.
  • Previous experience: The vast majority of victims has no previous experience of online trading, which is “no problem” at all, since they will get a “trading agent” assigned to them. Some of them has even been scammed in the past, but want to try again, with a serious company.
• Identity verification: The victim must verify its identity by uploading a copy of its identity card, driver license or passport to the platform, as well as a utility bill to verify its home address. The verification process is important to the scammer, and must be fully completed before trading can start. Blurry images are not accepted and this process is often lengthy and needs to be repeated.
• Platform access: The agent helps the victim to access to its account on the trading platform and to change the default password (123456).
• Deposit: The victim must transfer the initial investment (the deposit) of 250 USD (or equivalent in its local currency) to the trading account. Initially the victim tries with a credit card payment via its bank but that often fails and they switch to an online payment platform setup by the scammers where the victim simply enters its credit card details.

Conversion agent “Thomas Clarke” enters the following details about its latest victim in the Customer relationship management (CRM) system:

Once the enrollment process is completed the victim is handed over to the “Retention Department” where the scam continues. The conversion department is divided into a number of Teams or Desks. The division is often based on language (English, Spanish, French, Russian, etc.) and/or the “brand” of the investment fraud. Each team/desk has a Team lead and a Conversion Manager that overlooks the complete operations in the department.

According to the data available in the leak, 1 out of 14 persons that register in a fraudulent investment platform makes a first deposit. In another words, 7% of the leads brought by affiliate marketers make a first deposit (conversion).

The Retention Department – where money is lost

Once the enrollment process is completed, the victim is quickly transferred to the Retention Department and its personal “Trading expert” makes the first call the very next day. This person – internally called “Retention Agent” – seeks to establish a personal relationship with the victim by keeping track of the victim’s hobbies, family and work situation etc. Many victims are in contact with its trading agents for six months or more and spends countless hours together over the phone.

The trading expert introduces the victim to the world of binance accounts, crypto-wallets, spot price, spread, commission, credit and positions. The victims lack experience of online trading and even if they ask questions to the agent, the nitty gritty details of each deal is left out so the victim can fall in the trap later on.

The trading expert explains his/her model of commission. Most agents take a percentage (1,2%) of each “position”, the amount the victim invest in a certain resource, meaning that they do not gain anything from their profit, or withdrawal of funds. Other agents earn a percentage (~5%) of the victim’s profit.

Trading experts that are new on the job are supported by a “whisperer“, a senior staff member that listens to the conversations with the victim and have also access to the computer screen. The “whisperer” gives live instructions to the agent on what to say. The feedback provided by the “whisperer” is then repeated to the victim word-by-word.

The trading platform is complex and the victims need constant help to operate and find the different options. They are instructed to install AnyDESK for remote access so that the agent can help them to navigate. Since the victim is moving between the trading platform, its personal mail and its online bank, the agent is able to see the financial capacity of the victim. The victim is always in charge of the actual trading and transfer of funds between bank, trading platform and crypto-wallets, but the agent oversees the processes.

The trading experts are all based in noisy call centers with other agents talking, yelling and playing “reggaeton” music in the background. Few victims asks about the noise, but a surprising amount of victims do not seem find it inappropriate. When asked, agents justify the music due to privacy concerns. A few calls from the trade experts have no background noise which indicates that they are made from a home office.

The trading experts are all young, men and woman in the age of 20-30 years. They manage victims in several countries simultaneously, and are struggling to keep track of the timezone of their victims so they call on the agreed time. They seem to have no prior experience in online trading, and many of them start the day at Investopedia to gather investment pitches to the upcoming calls.

The trading expert acts a bit as a “saving angel” to the victim in the beginning of the scam. The balance of the victim’s trading account might turn negative due to “poor decisions” and the agent manages to make it positive with a bit of tweaking. The agent also offers company credits (loans) to the victim as “favors” when they are short on cash to invest in “profit-proof” resources.

The agent quickly encourages the victim to upgrade from Beginner level to Silver, Gold and even Platinum, to increase the profit margins and gain access to better deals. However, this step-up requires larger investments, anything from 10,000 EUR and up. In a few months, the victims are dealing with hundreds of thousands of EUR/USD in their trading account. For many, it is even unclear how much money they have invested, how much they have borrowed on credit and what the actually own themselves.

There are many different “plots” used by the agents, but they all have one thing in common – the victim always needs to invest more in order to withdraw their funds. Some of those that have a positive balance on their trading account are suddenly “under investigation” for money laundry by “the regulators” and must (for unexplained reasons) deposit more money in order to stop the investigation. Unexpected taxes, commission charges, blockchain hickups are part of a large number of excuses to ask to transfer more money

The agents also plays with the victim’s emotions. A young girl, like Mary Roberts or Vivien Victoria West, is often sent in to charm the client of a male colleague has gotten stuck. From what we have seen, the average victim is male and over 50 years old.

Retention Agent “Hans Soller” have email accounts for both Golden Currencies (gc.soller.hans@gmail.com) and FX Admirals (hans.soller.fxadmirals@gmail.com).

Retention Agent “Lana Lehmans” enters the notes “callback today to proceed with scam, there is no other option at this moment.“, and “he known I am scammer” into the CRM, and before handing over to another colleague.

The victim, a middle-aged Canadian man is not willing to invest more. “Maybe he will open up with a girl” suggests team lead Hans Soller.

In some cases, the victim that realizes that it has been scammed, confronts its agent. Some agents choose to play innocent and pretend to be offended for the lack of personal trust, while others strike back and insults the victim for being stupid to fall for the scam.

The audio clips below include a few examples of scammers being confronted.

Often, when the tension arises and things get ugly, the trading (retention) expert is replaced with a more senior sales expert or someone from the “finance department”. In this step, the agents show absolutely no mercy and do not fear to push a victim over the brink. They provide them with information where to obtain quick loans, ask them to borrow money from friends, sell properties or assets etc. There is absolutely no limit for the agents when they must back off.

Recruitment and training staff

The call centers are in constant need of new human resources – but how do you recruit staff to organized crime? Job offerings are often advertised online to the public, but recruitment is likely done internally as well, between friends and family members. The applicants must go through a polygraph test during the application process to make sure they are not connected to law enforcement or have otherwise “evil” purposes. The screenshot below show how a new person has been recruited to the tech team although his brother is a lawyer and he had many questions about the company during the polygraph test.

Testimonials from call centers reveals that the scam was not obvious for them during the application process but became clear once they went through the initial training. In the leak we can find how staff from Israel travels to the European call centers to train their staff.

Once a new staff member has been enrolled, it is given a new name, a pseudonym, to protect its real identity. For retention agents, fake passports are also created which they can share with the victims to strengthen the level of trust with them. The images used in the passports are either taken from the Internet or created by use of AI tools.

Motivation and monitoring of agents

The agents are kept under constant surveillance by the management team. Voice calls with victims are being recorded, their screens activity is recorded and their calling activity is being monitored with number of minutes spent on each client. They are being evaluated and coached by the superiors in terms of language skills, sales pitch, how pushy they are and how they relate to their victims. They instruct female agents to be sweet to older men, share personal pictures with them. The call centers have quite booths in case the agents are too shy to sweet-talk their victims in the public call center office.

The achievement of each agent – how much money they manage to steal from people – is carefully monitored and publicly shared to motivate other agents. The “leaderboard” shows the most successful agents and their work is rewarded with bonuses in form or cash, luxury watches, or cars.

Get to know the retention agents

Two of the retention agents that have been identified in the Georgian “A.K. Group” call center are “Mary Roberts” and “Veronika Nowak”, two sisters by the names Mari Charchiani and Veriko Charchiani. “Mary Roberts” is known for establishing personal bonds to her victims, shares (fake) pictures of herself and presents herself as a young single mother. In real life, Mari (26y) is newly married and have no children. Her social media accounts showcase a lavish lifestyle filled with frequent travels to Dubai, Mykonos, and Paris, along with indulgent shopping for luxury items. Mary is a high performance “sales” agent, and has received bonuses for her achievements.

“Veronika Nowak” is another successful agent at the A.K Group. In real life, Veriko (22y) shares the same lavish lifestyle as her older sister Mari. Their social media accounts speak for themselves.

Source: Facebook profile of Mari Charchiani

Mari celebrating her birthday in Greece, July 2024.
Source: Facebook account of Mari Charchiani

Mari showing her shopping bags from Forum des Halles (Paris, France).
Source: Instagram account of Mari Charchiani

Veriko Charchiani (“Veronika Nowak”) Nov 2024 (Paris)
Source: Facebook account of Veriko Charchiani

Veriko Charchiani (“Veronika Nowak”),Mykonos, Greece
Source: Facebook account of Veriko Charchiani

Mari (left) and Veriko (right) with their parents. Family photos of the Charchiani sisters suggest that they come from a modest home.

The Recovery Department – the final twist

In a few cases the show goes on and on even after the scam has been revealed. The victim of a scam is moved to a “Recovery Department”. During our investigation we found that the “A.K. Group” received data of victims already scammed by other brands in other call centers. Victims personal data is traded.

Some victims are contacted by a representatives from the “Financial Action Task Force“, the “Block Chain” or the “Prudential Regulation Authority. They explain that the victim has been scammed by a criminal organization who have used his funds to trade without his knowledge. The good news is that they have not been able to withdraw the funds as they lack proper identification and the funds have been confiscated. The next step is to arrange a withdrawal which of course involves an additional deposit from the victim.

The screenshot below shows a desperate attempt of the scammers to impersonate the Prudential Regulation Authority (PRA) from the British Bank. PRA has been able to identify an extraordinary volume of cryptocurrency transactions made in the victim’s name the past month to a total of 0,33 BTC, which is his to claim after completing an authentication verification process.

Another plot from the “Recovery Department” is to have a “lawyer” to reach the victim claiming that he can recover the funds. The lawyer charges 10% of whatever he can recover, and this funds must be paid upfront before the withdrawal of funds can be made.

The “Recovery Department” does not seem to be very successful in its attempts to scam the victims on more funds, as there are simply no more funds available and the victim’s are more aware of scammers.

The trading experience for the “depositors” ends the very same way – as a great financial loss and emotional stress. Based on leaked financial records, just only 2% of the deposits are withdrew by victims, 98% is pure profit.

THE BACK OFFICE

Management and ownership

The back office includes the management of the overall scam operations. A back office operates one or more physical call centers. “The AK Group Network” operates no less than three call center in Tbilisi, Georgia and while the Israeli “Sapphire Network” operates or have operated call centers at least in Israel, Cyprus, Ukraine, Spain and Bulgaria.

The company that operates the Georgian call centers is the A.K. Group, owned by a 36-year-old woman named Meri Shotadze. Mari goes under the alias “Kseniya Koen” (K.K.) in the call center to protect her real identity. She seems to be more of an Operations Manager and handles the daily business on one of the call centers in Tbilisi.

However, internal communications show that Mari is the second-in-command and the man she refers to as her boss is a 33-year-old man named Akaki Kevkhishvili. Akaki lives a family life with wife and two young children. He has a “thief in law” eight-pointed star tattooed on his left knee, which is a criminal tattoo associated with the Russian prison and organized crime culture. The thief in law is a high-ranking member of the Russian criminal underworld, following a strict code of conduct.

Neither Meri nor Akaki have chosen to respond to the consortium’s Request for Response (RoR). All social media accounts under their names have been closed down since the RoRs were sent.

Akaki Kevkhishvili (left), Meri Shotadze (center), and Kevkhishvili’s bodyguard posing at an A.K. Group event.
Source: Social media account of Meri Shotadze

Meri Shotadze (alias Kseniya Koen (K.K.) social media profile page.
Source: Social media account of Meri Shotadze.

Akaki Kevkhishvili posing with weapons, wears a “thief in law” tattoo on his left knee.
Source: Social media account of Akaki Kevkhishvili

Akaki posing in social media driving Rolls Royce and Lamborghini.
Source: Telegram account of Akaki Kevkhishvili

Mari Shotadze and Akaki Kevkhishvili at a company event.
Source: Social media account of Akaki Kevkhishvili.

The Departments

The back-office is specialized in human-resource functions including recruitment and payrolls but also administrative, legal and support tasks such finance, accounting, IT support and legal services associated with company creations.

The back office is organized with a a number of “departments” that interact with the daily operations of the call-centers using several Customer Relationship Manager (CRM) systems.

The following table summarizes the different departments found in the “Sapphire Network”

THE OFFICE BUILDINGS

Thanks to some “in-house CSI work” and the old-school field work by Consortium members across Europe, we have managed to identify several the physical locations of the call centers in Israel, Georgia, Cyprus, Spain and Bulgaria.

The Sapphire Network had their Israeli call center located in the Sapphire Tower (Sapir Tower), an office skyscraper in the Diamond Exchange District of Ramat Gan, in Tel Aviv. The call center was abandoned three months before the release of this investigation, likely due to the suspicion that they were under investigation.

The Sapphire Network operated call centers in at least two offices in Sofia (Space Tower and Mandarin Tower) until they moved out in December 2024 and relocated to the office complex Interpred Boyana in Sofia.

Sapphire Tower, Tel Aviv, Israel

Picture from inside the call center in the Sapphire Network, Tel Aviv, Israel

Mandarin Tower, Sofia, Bulgaria.

Space Tower, Sofia, Bulgaria

Interpred Boyana, Sofia, Bulgaria. The active call center location of the Sapphire network in Bulgaria.

The Victory House, Limassol, Cyprus.