In Parts One and Two we introduced the international syndicate running over 70 suspected fraudulent online trading platforms worldwide, as well as a special ”regulated” South African division making use of real financial service provider licenses.

Despite the veneer of legitimacy provided by these licenses we saw how thousands of people invested millions of rands and, nearly always losing all of it after being misled and harassed into disastrous and possibly fictitious investments.

Underneath it all lies a financial architecture for collecting money from these aspiring traders that is built on fake and fly-by-night money movers, alleged money launderers and other shady ”high risk” offshore entities.

At the other end, as we will see, massive amounts of money flow through a dizzying network of crypto wallets.

Like any online retailer, each platform requires payment service providers (PSP’s) that link clients, in this case the aspirant traders, to the oftentimes opaque ultimate destination of their funds.

Within Scam Empire, finding PSP’s to move money has been a perennial concern, with dedicated chat groups constantly updating managers on the ”integration” of new ”solutions” to match the need for large and frequent transfers in multiple currencies across multiple countries.

All told, the platforms seem to have used over 200 distinct payment methods, many of them obscure and short-lived.

In South Africa a bizarre procession of these ”solutions” show how the trading platforms, behind the veil of fancy websites and seeming regulatory compliance, had one foot planted firmly in the illicit financial system.

”High risk”

Around August 2023 SkyMT, one of the South African platform ”brands” featured in our previous instalments, ran into a serious problem. Its PSP for collecting deposits from ”traders” was raising red flags and getting worried about its own exposure to legal risk.

The provider in question was Durban-based Swiffy which had signed ”high risk merchant” agreements with both SkyMT and the larger local Scam Empire offering Finbok.

”High risk” agreements are an industry standard for specific kinds of clients, including those involved in foreign exchange and online gambling. Part of the deal is a hard limit on how many fraud or bank complaints can be received before the relationship is terminated.

 At Swiffy, this limit was reached before very long.

Documents in the leak show that by November 2023, Swiffy decided to withhold deposits that were due to be transferred to SkyMT, as well as Finbok.

In the case of Finbok, Swiffy was sitting with R2,8-million it had not paid onwards after three fraud complaints reflected in a statement of account.

On 17 November, SkyMT and Vector sent identical letters to Swiffy promising it ”full and irrevocable indemnity against all losses of whatsoever nature, past present or future as may be incurred…by virtue of rendering its payment platform services to ourselves.”

In return, Swiffy would have to pay over whatever it owed within 24 hours, which it did.

And that was seemingly the end of Swiffy’s work for Scam Empire.

The important part, however, is how the platforms dealt with what was immediately an existential threat.

Without a payment system they would simply be unable to take people’s money.

What followed was a scramble for stopgaps that would see traders’ money enter a system bristling with red flags.

Plan B

When SkyMT lost access to Swiffy it started using an entity named Astra Neo Enterprises to collect deposits. Would-be traders were directed to deposit their funds into one of this entity’s bank accounts at Standard Bank, Nedbank or ABSA.

The problem with this is that Astra is not a payment service provider at all, but instead a scrap metal company in Benoni.

In Scam Empire’s records, payments to Astra are, with telling vagueness, called ”Fin Solution”.

It was, however, a short-lived stopgap. Contained in the leak of documents from the global Scam Empire syndicate there are letters from both Nedbank and Standard Bank to Astra Neo informing it that its accounts are getting shut down.

From the Standard Bank letter, we can see that the account in question was only opened in September 2023, which indicates that it was possibly created especially for collecting SkyMT deposits. The account was closed on 5 November, with the bank citing ”fraudulent activity investigated by SAPS, SARS”.

A month later Nedbank came calling, citing ”high fraudulent activity in your account” and ”a few” SAPS cases.

It is not clear what has happened to Astra Neo’s ABSA account.

However as soon as ”Fin Solution” was shut down, SkyMT turned to another payment service which the records vaguely refer to as ”SA Banking Solution”. The only clue as to what this entailed is a handful of proof of payment slips we could match to transactions ascribed to this solution.

The recipient was something named Hampton Capital.

This company, which has no public presence and was deregistered shortly after having done work for Scam Empire, belongs to one Muaaz Rajah, apparently an employee of FNB.

We asked Rajah for comment but were met with a spokesman who later ceased communications.

SkyMT collapsed at the end of 2023 – a development very possibly linked to it being cut off from payment services.

As we reported previously, however, SkyMT was just a dress rehearsal for the major Scam Empire endeavour in South Africa, Vector Financial Services and the two platforms it operated: Finbok and Finxocap.

The Nigerian connection

Judging by records in the leak, the Finbok trading platform got off the ground in September 2023 with only one PSP onboard – a Nigerian company named OnlineNaira.

While OnlineNaira is a real company, Finbok clients were not really paying their deposits to it.

Instead, they were directed to pay into the accounts of three obscure local entities named KB Auto Sales, BBS Concepts and Online Rands and Naira. These belong to husband-and-wife team Kabir and Yinka Adalemo, who themselves run a modest remittance business between South Africa and Nigeria.

According to Kabir Adalemo, he was approached by OnlineNaira’s owner in Nigeria Kayode Adesiyan to accept deposits from South African clients and pay out Nairas back home.

This arrangement was allegedly brokered by the consultancy Clearsky Solutions, a Hong Kong-based company affiliated to the Israeli law firm Porat Group. Readers might recall from Part Two of this investigation how these two entities appeared to set up seemingly fabricated ownership structures for trading platforms that included SkyMT.

We approached Clearsky for comment, but none was forthcoming.

In any case, we can see from records in the leak that ”OnlineNaira” did in fact channel South African ”traders’” money to Nigeria.

One of the key figures in the financial management of the syndicate is Israeli Eduard Brovshtein who is, in internal chat groups, referred to as ”CFO”.

In a leaked spreadsheet, evidently authored by Brovshtein, payments received via OnlineNaira are given in Naira and match Rand deposits tabulated elsewhere in the leak.

It is not clear why Finbok would need South African Rand deposits converted to Naira, but according to Adalemo, the funds would ultimately be converted into cryptocurrency.

Adesiyan did not respond to questions.

The leak shows that the ”OnlineNaira” payment system was shut down after a number of fraud complaints from Finbok investors, including a SAPS complaint that was withdrawn after the complainant received a small payout of R15 000.

The Kenyan ”money launderer”

The use of payment services that self-evidently aren’t above-board represents just a small part of the money that has flowed through the Scam Empire system in South Africa.

The sprawling spreadsheets in the leak exhaustively detail dealings with traders and note the relevant PSP for every transaction with platforms like SkyMT, Finbok and Finxocap.

These include many ”high risk” providers that are on the face of it legitimate but which have already had run-ins with the law abroad.

Among the many agreements in the leak is a tripartite ”merchant acquiring service agreement” between Vector (that is, Finbok and Finxocap) and service providers named Ellerman Labs and Brighter Technologies.

Traders making deposits using ”Brightcard” would in fact be using Ellerman, a Kenyan payments company with a presence in several African countries.

Ellerman is a subsidiary of another Kenyan company named Virtual Pay Holdings, which has also provided payment solutions to other parts of Scam Empire. Virtual Pay Holdings in turn belongs to Virtual Pay International, also in Kenya.

Behind it all sits Kenyan businessman David Morema Obangi, whose companies were last year found by a Kenyan court to have, ”on balance of probabilities”, engaged in money laundering.

Specifically, the parent company of Ellerman (the Scam Empire PSP) seemingly laundered funds through a separate Obangi vehicle named Virtual Financials International under the guise of salaries and allowances.

The funds in question were moved in 2023 and would most likely not include the deposits made by Finbok victims, but having a case of money laundering hanging around your neck seems to be par for the course for operators within the financial architecture of Scam Empire.

The Ukrainian illegal gambling laundry

One of Vector Financial Services’ major payment solutions was an obscure entity trading as Interkassa. While Interkassa is registered in the Marshall Islands as International Company Limited, the company itself is based in Ukraine and acts as an aggregator for payment systems.

Since 2022 Interkassa has formed part of a Ukrainian police investigation into illegal online gambling and, more pertinently, the laundering of the proceeds of that gambling to the Russian operators of the ”casinos”.

In a search-and-seizure application to a court in Kyiv prosecutors claimed that “funds received from the illegal activities… are withdrawn from the territory of Ukraine to the territory of the Russian Federation according to the following mechanism: funds from illegal online casino and gambling activities are accepted through payment systems: “Interkassa”, “Tranzzo” and “FourBill”… after which they are credited to the personal accounts of the participants in the illegal mechanism” [translation from the original Ukrainian].

Interkassa’s role in Scam Empire is complicated, with the company effectively hiding behind another equally obscure Dubai-based – but apparently Armenian-owned – payment aggregator named Lasur IT Holdings, trading as Multihub.

On Finbok and Finxocap ”traders’” deposit slips, as well as in the main tabulations of Scam Empire transactions, payments reflect ”Multihub” as the recipient.

Elsewhere in the leak, however, it is revealed that the real payment provider in these cases is Interkassa. There are even invoices addressed to Vector by Multihub, charging it fees for facilitating these Interkassa payments.

The exact nature of payments through Interkassa seems to confuse even the managers of Scam Empire at times. In a chatgroup called ”Multihub-Finbok Support+Tech” someone named ”Dan Sus” tells ”Michael_F” (who we have previously identified as Eduard Brovshtein) that ”we work with the Interkassa provider and do not know who is behind them, since such information is not disclosed”.

We reached out to Interkassa and received no response.

With Multihub we ran into a perculiar situation when the apparent director Leonardo Henrique first told us that “Our company is not related to the company lasur it”.

When we pointed out that the Lasur IT (Multihub) agreement with Vector was signed by Karen Mikayelyan, a partner of Henrique’s in other ventures – and then asked for their contact details – he replied that “we cannot disclose personal data, it is against the law”.

Catch me if you can

We asked the South African Reserve Bank (SARB) about the seeming cross-border free-for-all described above.

While the SARB said that it is ”not at liberty to disclose information regarding any entities that we may be investigating,” it suggested that the arrangements we’ve exposed are unlikely to be above board.

Any payment service provider in South Africa is meant to follow a directive issued back in 2007 on third party conduct within the national payment system.

In the case of scrap metal dealer Astra Neo for instance, the company may very well have run a legal payments side-business, but that would have required a separate legal entity meeting the requirements of the National Payment System Act. This was not the case.

When it comes to entities owned by people allegedly guilty of money laundering abroad, this does, as one would expect, ”raise concern” in the eyes of the authorities.

As the SARB notes: ”Engagement in illicit activities such as money laundering, whether within South Africa or abroad, may raise serious concerns regarding an entity’s fitness and propriety to operate in the South African financial sector. In such cases, the SARB, in collaboration with relevant Regulators, may assess the implications for the entity’s continued authorisation or registration, in line with applicable regulatory frameworks.”

A more dangerous regulatory lacuna, however, is consistently exploited by Scam Empire.

Cashing out

While the South African trading platforms forming part of the Scam Empire syndicate used these and more questionable methods to bring money in, what happens next is infinitely more complicated, not least because the myriad entities in the network almost exclusively use cryptocurrencies.

The leak contains roughly 77 000 unique crypto wallet addresses. These are the ”bank accounts” used by the syndicate’s various component parts, investors who paid with crypto as well as the service providers who accepted crypto as payment.

The flows within the system are chaotic and – for now – mostly untraceable despite payments being painstakingly recorded in hundreds of tables.

There are, however, a number of major identifiable nodes. One of these is the South African division, which seems to have handled far more than its share of the cash flowing through the system.

In particular, we have been able to unravel payments to and from Vector, the operator of Finbok and Finxocap.

First, and unusually within the overall scheme, the leak contains bank account statements for Vector at FNB and ABSA.

Vector also seemingly roped in third parties to open accounts in its name. In the leak there is an invoice from an accountant in Dubai named Ben Feivel who charged Vector EUR3 500 to open a ”client facing” FNB account in January 2024, which corresponds to the starting date for the statements.

While this is not illegal, it is unclear why a South African company would pay an offshore service provider over R70 000 to open a South African bank account for them.

Nonetheless, in the statements we can see a steady stream of inflows from individual “traders” as well as the small number of payouts to these investors. We can also see incoming payments from some of the PSPs we looked at above.

The main exit point for money coming into Vector’s accounts is a Cape Town-based crypto company named Xago Technologies.

We mentioned Xago in Part One of this investigation and showed how it was not only used in South Africa but also received direct deposits from “traders” in other countries, including from a man who appears to be Scam Empire’s single largest victim, UK citizen Stuart Daburn.

The company has bank accounts at local, Swiss and British banks into which deposits were made.

Daburn has launched a massive court case trying to reclaim several million pounds he lost to the syndicate and in court papers he identifies Xago as one of the companies he was told to make deposits with by the scammers.

In South Africa the single largest victim, Seumas Reynolds, also made his deposits through Xago.

Xago, in turn, apparently sent deposits to a Polish crypto company named 4Word Solutions that also crops up several times in the leak.

As reflected in our previous story, Xago strenuously denies ”being complicit in or enabling fraudulent or money laundering operations”.

According to the SARB “while the current exchange control framework does not yet provide for direct oversight of crypto asset service providers (CASPs), important safeguards do exist”.

It appears, however, that this does not go much further than crypto exchanges being ”accountable institutions” that are obliged to self-declare suspicious transactions to the Financial Intelligence Centre.

The widespread use of cryptocurrency makes much of Scam Empire’s finances incredibly hard to untangle.

Vector, however, represents one case where the veil can be partially lifted.

The cryptosphere

From the leak we have been able to identify eight of the crypto wallets used by Vector to send and receive payments.

We also managed to track payments through one of these wallets, which gives us an idea of how the company fits into the wider syndicate.

Incoming payments are unfortunately all from either crypto exchanges (which does not allow us to identify the actual source) or wallets we can’t identify.

Outgoing payments, however, can to some extent be traced due to the presence in the leak of other financial records identifying the same wallets.

We can see that Vector, for instance, made payments from the wallet we analysed to  voice over internet protocol (VOIP) providers. These are the companies that allow the call centres (based largely in Bulgaria) to call victims from sham ‘local’ phone numbers.

The same wallet also made contributions to something called ”Headquarters” in Israel and to ”Cy HQ” – a Cyprus-based part of the network hosting a call centre operation codenamed ”Tesla” that targeted mostly South Africans.

The most important destination of Vector crypto payments, however, at least from this wallet, was to a Ukrainian company known as EM Develop.

This company is a hub for paying so-called affiliate marketers, the advertising companies that create the often entirely false and misleading online ads featuring bogus celebrity endorsements and outlandish claims about (ficitious) AI-powered trading bots.

These marketers are key to the entire syndicate, as well as other legitimate online businesses that require traffic to be guided to their doors.

What is interesting about Vector’s expenditure on EM Develop services is that the payments bear no relationship at all to the amount of business Vector’s trading platforms do.

The mysterious money

Vector’s two platforms, Finbok and Finxocap, pulled in investor deposits of just over $12-million in 2024.

The money paid to EM Develop from the single wallet we analysed since April 2024 came to $7,5-million, or 60% of all deposits from ”traders”, while Vector still had to cover operational costs such as its share of the Scam Empire call centre operation, salaries for agents and other sundries.

The Money being sent to EM Develop is also far higher than the total advertising expenditure claimed by Vector’s own director Dustan Cornelissen, who told us it was ”nearly $2-million”.

When we asked him about the disparity he did not answer us.

Vector’s outsized expenditure on marketing leads to two possible inferences.

On the one hand, it might be that Vector is for some reason picking up the bill for the larger syndicate’s advertising – possibly because, unlike many of the platforms within the network, it is actually a real company brandishing the apparent legitimacy of a financial services license.

Alternatively, the payments could be for something in addition to advertising. It is hard to say, because while onwards payments from EM Develop can be seen to largely go to identifiable affiliate marketers, a lot of it goes to unidentifiable crypto wallets.

The overall design of the Scam Empire system, however, can be at least partially untangled from the warren of crypto payments detailed in the leak.

Details in a spreadsheet named ”Headquarters Operation Report” show how all the ”units” pay regular contributions to the running costs of the central office.

These units are codenamed ”Serbia”, ”GB” and ”Zebra”. The South African operations mostly fell within Serbia which, confusingly, refers to a call centre operation based in Bulgaria.

Inside the operation report there are minute details of some $17-million in onward payments, almost a third of which consisted of salaries. While the names of staff are often only given as their first names or pseudonyms, the job titles are often interesting. On the staff list, for instance, is someone named ”Superman” whose job is ”polygraph”, i.e., lie detector.

One of the employees at HQ is Gershon Bresler, the legal troubleshooter we encountered in Part Two, who deals with litigious traders in South Africa under the pseudonym ”Paul van Rensburg”.

Also visible is ”Eduard”, who is most likely the aforementioned Eduard Brovshtein.

A separate operations report for one of the subsidiary units includes line items for ”South Africa regulation”, on which $120 000 was spent in November 2023.

There remain, however, thousands of other payments we have yet to trace.

As we mentioned, the bulk of the money flows within Scam Empire are obscured by the use of cryptocurrency. AmaBhungane is hard at work piercing this final veil. Look out for what we have found in Part Four of this investigation.

The post Scam Empire Part 3: Money in, money out appeared first on AmaBhungane Centre for Investigative Journalism.

What we have dubbed “Scam Empire” is a multinational syndicate operating some 79 seemingly fraudulent online trading platforms across the world, including in South Africa.

The “SA division” has been rapidly expanding with at least seven “brands” launched since 2023, including at least three since November and one as recently as January this year.

These make up the bulk of the “regulated” branch of Scam Empire – platforms operated by real companies sporting real financial service provider (FSP) licenses – which sets them slightly apart from the rest of the network.

The vast majority of trading platforms under the Scam Empire umbrella are unregulated and often have no actual legal entity underpinning them.

Despite their ‘legal’ status, these local companies are doing massive real damage to the lives of thousands of would-be ’traders’.

Like their counterparts in other parts of the world, investors are drawn in by a toxic mix of misleading or outright fake advertising that lures them in a web of harassment and manipulation by call centre agents. 

In almost every case they end up losing all their money.

In Part One of this exposé we showed how this part of the scam operates and the scale of the losses suffered by its victims in a scheme whose tentacles reach practically every corner of the globe.

Our investigation is based on a monumental leak of data originally provided to Sveriges Television, the Swedish national broadcaster, to which amaBhungane has gained access as part of a global consortium of media organisations coordinated by the OCCRP.

The leak also contains masses of information on the creation of the online trading “brands”, the companies underpinning them as well as the people pulling the levers in the background.

Scam Empire’s first noticeable presence in South Africa, in around 2022, was an unregulated platform named InvestEFT, which has since disappeared without a trace after collecting several million from the public.

Things have shifted since then in South Africa, with a growing number of local platforms using FSP licenses issued by the Financial Sector Conduct Authority (FSCA).

Within the Scam Empire network these are referred to as the “regulated” brands.

Why some have gone the ‘legal’ route is not clear, but as we will show, the South African division appears to have played a disproportionate role in the overall syndicate, seemingly becoming a nexus for money flows of nominally unrelated operations around the world and possibly exploiting the cover provided by their veneer of respectability.

A first attempt at running a licensed trading “brand” in South Africa seems to have been a short-lived brand named SkyMT.

After that came the infinitely more successful Finbok, Finxocap and VP Trade all of which used the same FSP license.

Then, in November last year, two new brands named Tredomatix and FXSI were launched using a single license. Finally, in January this year, another named TradeFT emerged using yet another new license.

We pointed out in our previous instalment that three of these platforms supposedly belong to an unemployed Bulgarian man named Boris Kodzhov, while another one belongs to Romanian model Diana Gugles – both are either victims of identity theft or willing “sellers” of their identities.

The identities of the other platforms’ owners remain a mystery.

It is clear from the leak that this “regulated” division of Scam Empire relies on a small, consistent management team and a handful of professional service providers to tackle the unique problems of getting and sustaining licenses.

What also emerges is that the centrally managed Scam Empire system has crossed paths with other similar operations in South Africa, leading to some cooperation and later to bitter conflict.

Why bother?

Before we explore the colourful characters involved it is worth asking: why get a license at all?

In the course of our investigation two compelling answers have suggested themselves.

One is the veneer of legitimacy a FSP license provides.

A victim we spoke to who had lost something in the region of R1-million to the platform Finbok recalled that he had phoned the FSCA to check whether the platform was “legitimate”.

If he had not been told that their FSP license was in order he would likely not have invested.

An internal Scam Empire document for call centre agents suggested that agents use the platform’s exposure to regulatory sanction to reassure the potential “traders”.

There is, however, another important reason that is core to the functioning of the platforms – the constant hunt for new payment service providers (PSPs) to channel funds from depositors to the platforms.

As we will see, the need to accept high volumes of payments in various currencies makes getting diverse PSPs onboard a big part of the game.

Being ‘licensed’ makes it far more likely that even relatively scrupulous formal PSPs will accept your business. At least until accusations of fraud start rolling in, as they frequently have.

But all of that comes later, in Part Three of this exposé. For now, we turn to the evolution of Scam Empire in South Africa.

Taking off: SkyMT

Getting a new FSP license is not entirely painless, but there is another route – buy an existing one.

And what could be better than one that is going cheap because it has been rendered technically useless to those who own it?

In June 2022 the FSCA announced that it was investigating an FSP named Lehumo Securities following complaints from the public.

Lehumo was ordered to cease taking deposits, rendering its license inoperative but still technically ‘valid’. This valid FSP license is all anyone would see if they went as far as looking up the company on the FSCA website.

Within a year this beached FSP would be transformed into SkyMT, seemingly the first “regulated” operation set up by Scam Empire to specifically target South African investors.

It’s a convoluted story but foreshadows much of what the network has gotten up to since.

When the FSCA pounced in 2022 Lehumo was owned by South African Martin Maudi Lentsoane.

In early 2023 Lentsoane was approached to sell his company and its (still valid) FSP license. He then got a part-time job acting as the company’s “key individual” – the person meant to take responsibility for an FSP’s conduct.

The buyer and Lentsoane’s supposed new boss? Bulgarian Boris Kodzhov.

This is the Kodzhov who, as we revealed in Part One, is a former cleaner in the Bulgarian capital Sofia who lives off a government grant.

Lentsoane said that in hindsight it should have been a red flag that Kodzhov “bought” Lehumo despite its lame duck license.

He told us: “I explained the situation with the FSCA and disclosed the fact that the entity will not be able to operate until it is cleared of the ongoing investigation and the buyer was seemingly not concerned and they were willing to wait for the process to conclude.”

Another red flag: despite the mysterious Kodzhov making this seemingly quixotic investment, Lentsoane says he never once met him, not even on the video calls through which the deal was negotiated.

The mysterious Kodzhov did, however, have solid legal representation – an impressive-looking Israeli law firm named Porat Group.

According to Lentsoane, the video meetings were attended by the firm’s head of financial regulation David Woliner and senior associate Or Reizis.

The transaction moved ahead rapidly and a sales agreement was signed in February 2023, after which the company was renamed SkyMT.

In the agreement an “intermediary” named Clearsky Solutions, based in Hong Kong, was introduced. Clearsky would take a cut from the sale price.

Clearsky seems to be a related corporate services company for Porat Group, seemingly making Porat a one-stop-shop for a deal like the one between Lentsoane and (ostensibly) Kodzhov – a deal which appears to have involved installing a fake owner who would appoint a key individual who in turn (as we will see) had no idea what was going on.

In fact, amaBhungane is aware of at least one other case outside the ambit of Scam Empire where Porat allegedly organised the buyout of a FSP that had been immobilised by the FSCA, again on behalf of a mystery buyer.

This law firm will feature again in this story. In response to questions, Porat told us that it “does not provide ‘proxies to obscure real owners and/or managers’ or similar services, in any manner whatsoever”.

“However, we can confirm that Porat Group’s sole activity is providing legal advisory and legal documents drafting services”. Read their full response here.

Middlemen

Lentsoane claims that the deal to sell Lehumo/SkyMT was brought to his door by Myles Ndlovu, a man years earlier also implicated in an unrelated alleged pyramid scheme named Profit Trading.

Also involved was Simiso Ndlovu, apparently a family member.

It is unclear how Ndlovu came to be involved. Neither Myles nor Simiso Ndlovu responded to our questions, but it appears they stayed in the picture at SkyMT after it was bought from Lentsoane.

In May 2023 Kodzhov ostensibly signed a “shareholder proxy agreement” that effectively ceded control of SkyMT (formerly Lehumo) to Simiso – at least on paper.

This is the month the SkyMT trading platform went live, although Lentsoane told us he knew nothing about it.

However, the leak contains invoices and a spreadsheet showing monthly expenses tabulating his fees.

SkyMT raked in around R30-million from South African “traders” and refunded R3,6-million before it was discontinued. The level of refunds may seem high compared to the average of 3% Scam Empire platforms allow traders to recoup internationally, but the number is misleading. 

Over 60% of the SkyMT refunds consisted of a single payment to a big investor who raised hell with a fraud complaint which, according to a leaked internal “monitoring” report, needed to be resolved with “extreme” urgency.

The ultimate demise of SkyMT at the end of 2023 had a proximate cause we will only deal with properly in Part Three, when we explore the shady financial machinations of the online trading business.

Suffice it to say that fraud allegations were making it hard to sustain a system for bringing in new money.

There were also larger forces at play.

Among the voluminous files in the Scam Empire leak, SkyMT takes its place alongside dozens of other centrally managed platforms, as is attested to by countless records of its transactions, chatroom discussions of its affairs and contracts signed by its “owner” and his apparent proxy Ndlovu.

But who really ran SkyMT during its roughly seven months of operations?

One clue lies in letters drafted on behalf of SkyMT dealing with complaints from traders and more specifically their author: a legal trouble-shooter calling himself “Paul van Rensburg”.

As we will see, “van Rensburg”, despite his South African name, is one part of a shadowy back office known as “Cyprus HQ” that took the lead in much of what follows and links back to the Israeli network that appears to call the shots.

Another clue is mystery investor Boris Kodzhov, who would soon reappear to provide a link between SkyMT and the next iteration of Scam Empire’s regulated division.

For that iteration we must visit Cape Town and introduce a key South African player.

Who serves who?

At the heart of the South African operation lies Astrix Data – a licensed FSP that spawned two so-called juristic representatives named Vector Financial Services and Libra Wealth – – “juristics” for short.

These juristics are companies that piggyback on another entity’s FSP license.

This is perfectly legal, but the actual owner of the license is meant to do a thorough due diligence before appointing a juristic, creating an element of outsourced regulatory oversight.

In this case all three entities are linked by a common director, Capetonian ex-banker Dustan Cornelissen, though as we’ll see, he claims he is just a service provider.

Vector and Libra were set up to use Astrix’s license to operate online trading platforms: Finbok and Finxocap in the case of Vector and VP Trade in the case of Libra.

The documents in the leak show that Vector in particular was to become a major presence in Scam Empire, leaving an outsized footprint of deals, payments and unanswered questions.

First off, the direct damage done.

Vector’s flagship platform Finbok launched in late 2023, some months after SkyMT.

By the end of 2024 this platform had collected deposits of over R210-million and returned about R20-million. As with SkyMT this number is misleading – roughly half of these returns went to only two people. One of these still lost most of their investment while pretty much everyone else also, at best, received only part of their investments back– often after vociferous threats and complaints.

Finxocap has been a more modest operation. Since February last year it has raked in deposits of R26-million and paid back around R1,6-million.

Over at Libra, its brand VP Trade, which largely targets South Americans, collected around R63-million and allowed withdrawals of R1-million.

As we pointed out in Part One and will show again below, claims that all these people are simply losing when they gamble on the markets falter in the face of signs that trades are manipulated, if not fictitious.

That aside, the leak’s voluminous documentation on Vector brings into the picture the public – and hidden – roleplayers who pull the levers.

Importantly, the two camps – those visible on the paperwork and those leaving no trace – have seemingly had a massive falling-out, leading to contradictory versions of who did what.

Let’s start with the man who set up Astrix, Vector and Libra – the ex-banker Cornelissen – and a colleague of his in Cyprus named Keith Ioakim.

The “compliance man”

Cornelissen, a former FNB staffer, has provided confusing and seemingly contradictory versions of his exact role at Astrix, Vector and Libra.

He created all three and has remained the director of the companies.

Throughout the leak it is his signature on every contract or agreement involving Vector or Libra and their trading platforms.

As readers may recall, however, Vector is supposedly owned by the unemployed Bulgarian Boris Kodzhov (who we saw above buying out SkyMT) while Libra is supposedly owned by Romanian model Diana Gugles. At least on paper.

Cornelissen only admits to ownership of Astrix, which he says was a mere service provider to Vector and Libra providing “compliance services to…keep them licensed and compliant”.

These services, however, extended to receiving deposits from “traders” before crediting them to trading accounts and paying out the meagre refunds and withdrawals that did occur.

In an initial response to questions, Cornelissen called Vector and Libra “my companies” and described Kodzhov and Gugles as “representatives appointed to manage the platforms ”. He simultaneously described it as a “co-operative structure” where Vector and Libra were “co-ops”.

Subsequently, however, in relation to the requirement that he perform a due diligence when appointing a juristic representative (specifically Vector) using Astrix’s FSP license, he replied that “I can’t exactly to a do a due diligence on myself”.

This particular claim becomes important a bit later on.

In response to follow-up questions Cornelissen seemed to change his tune.

Now Kodzhov and Gugles were unambiguously the ultimate beneficial owners (UBO) of Vector and Libra respectively and “were in administrative and financial control of and responsible for their respective platforms when the brands were launched,” whereas Cornelissen had initially told us that “only I have access to Libra’s bank account”.

Whatever the exact nature of Cornelissen’s role, it seems clear that he worked with a South African based in Cyprus named Keith Ioakim.

The Expat

Ioakim is an old hand in the online trading business and has been associated with several entities that have been mired in scandal and sanctioned in several countries.  He told us that he himself had never been investigated or found guilty of anything. We have no evidence to the contrary.

Ioakim currently runs what seems to be a specialised company in Cyprus named Prorole Enterprises which, according to him, has as its niche “assisting firms to obtain South African FSCA licences”.

His two major South African clients have been Vector Financial Services and Libra Wealth.

In the leak there are several invoices from Prorole wherein Ioakim charges for “Provision of SA Directors and Key Individual, compliance, office rental space and PI [personal indemnity] cover as in accordance with the Consultancy Agreement”.

In response to questions both Ioakim and Cornelissen echoed each other, saying that the arrangement was that Prorole had the contract to provide all these services to Vector and Libra but outsourced it to Cornelissen’s Astrix. These companies would then pay Prorole which would pay Astrix.

The masses of invoices Ioakim sent Vector and Libra have a problem, however – one that leads us into the larger global Scam Empire.

While all the invoices are for services to the two South African companies, they are actually addressed to a bizarre array of other companies around the world.

These other companies are in fact conduits for money flowing from Scam Empire operations in other countries.

For instance, one of the companies paying Prorole was Greencode Connection in the UK. Bank statements in the leak show Greencode receiving constant inflows from another UK company named Purplesun which in turn received inflows from “traders” in Poland.

Another company invoiced by Prorole was Cyrestis, which was likewise fed by Purplesun.

This is another demonstration of the interrelationship of Scam Empire entities around the world, but the question arises: what was Prorole doing invoicing these companies?

According to Ioakim, he was simply told to address his Vector and Libra invoices to these entities because his clients were “part of a larger group of companies”.

Another noteworthy feature of these invoices is that they are all addressed to processing@backofficeteam.io.

This email address leads us back to the Israeli nexus: it belongs to Israeli Eduard Brovshtein – a man who in internal communications is known as “CFO”.

Ioakim told us that his contacts at the larger organisation were three characters who are all over the Scam Empire leak: Brovshtein, the mysterious “Paul van Rensburg” and an accountant named Hamza Javaid.

According to Ioakim, he was first introduced to the group by the aforementioned Israeli law firm Porat Group.

As we will see, these men have no kind words for Ioakim, which means he might conceivably be choosing to highlight them as scapegoats. All indications are, however, that they were central to at least the regulated division of Scam Empire.

Headquarters

Among Scam Empire’s meticulous records are expense reports for something called “CY HQ”.

These detail the staff complement and salaries of what looks like a small management team largely concerned with the regulated part of Scam Empire. We have thus far focused on South Africa, but the division has a growing presence in the Seychelles and the Comoros that we’ll get to soon.

In the documents, the aforementioned Hamza Javaid is (confusingly) also identified as “CFO” while “legal” falls under the purview of “Paul van Rensburg”. Javaid’s designation as “CFO” seemingly only relates to this smaller CY HQ, not the larger part of the scheme where Brovshtein is referred to as “CFO”.

Everyone in this HQ seems to have email address with the domain “nexushq.co” in addition to a plethora of other addresses linked to the platforms. While this implies a common employer there is an unaccountable unwillingness by all involved to say exactly who this may be.

Emails, screenshots of chatgroups and voluminous documentation, however, show that this “HQ”, alongside Brovshtein, ran the minutiae of the “regulated” platforms in South Africa and elsewhere.

One glaring red flag when it comes to HQ is that “Paul van Rensburg” does not exist.

Presented with evidence that his name is a pseudonym, “Paul” admitted that this is merely a “stage name” under which he does business.

This includes the fake name being listed as the contact person with authorities when complaints against the platforms arise, as well as when negotiating settlements with irate “traders” who allege foul play.

“Van Rensburg” is in reality an ex-South African named Gershon Bresler.

As we showed in Part One, the use of so-called stage names is commonplace in Scam Empire’s call centres – a practice that at least makes sense for a profession that often involves harassing and misleading people over the phone.

We asked Bresler why he used one, to which he replied that “the mere use of a “stage name” may serve various legitimate purposes and does not constitute an offense under the laws of any country”.

The fake name could however land him is serious trouble. Not only did he use it when talking down complainants and authorities – it also appears on the FAIS disclosure of Finbok, a mandatory declaration of a financial service provider’s key responsible individuals.

Victims of Finbok we spoke to recall being contacted by “Paul” when they threatened to take action against the platform. He would often offer them non-withdrawable “bonuses” to placate them and keep them on the platform.

In the chatgroups captured in the leak it can be seen how Bresler formulated documentation such as the legal fine print on the websites of the various platforms and organised the passports and other documents to appoint, among others, the “owners” of Vector and Libra.

Alongside Brovshtein and Javaid, Bresler helped set up platforms, as well as the all-important payment systems.

In the chatgroups Bresler had the username “PvanR” and display name “Poul”.

Javaid had the username “Max90289” and display name “Max56”.

Brovshtein was known as both “CFO” and “Michael_F”.

Some of these chats are illuminating.

For instance, they show how Brovshtein was not only processing@backofficeteam.io,  receiving Vector and Libra invoices, but also finance@vfs-sa.com, a Vector email address.

He can also be seen directing staff dealing with not only the South African platforms but also two others we will touch on shortly.

Elsewhere Bresler is seen arranging for Cornelissen to sign some documents, only for Javaid to complain that “his highness works half day only”.

In a discussion about deploying a new payment service, Brovshtein tells a colleague to focus on Latin America and South Africa “as they have now traffic there”.

One exchange that seems to demonstrate that Libra’s putative owner Diana Gugles has little if any involvement in the company is when incorporation documents are ordered signed by someone else in her name, with the instruction to “sign on each document + add below the signature by hand ‘one hundred shares’”.

This instruction is carried out, as can be seen from the document itself, which is in the leak.

Throughout the leak there are documents authored by Javaid and Brovshtein dealing with the platform’s financial affairs and in particular the ever-present challenge of acquiring and maintaining payment systems to collect deposits.

Fire, brimstone and bad blood

We approached everyone mentioned above for comment.  Both Brovshtein and Javaid essentially disregarded nearly all questions and instead railed against Keith Ioakim and Dustan Cornelissen.

Brovshtein threatened to sue journalists, saying “I vehemently deny your baseless allegations. I look forward to the moment they are published so that I can legally pursue each and every one of you personally. There is no country where you will be able to hide from my future lawsuits.”

More substantively, however, he claimed that the platforms were all under the control of Cornelissen and Ioakim but that Ioakim had in fact defrauded the company of $750 000 using fake paperwork.

Brovshtein also mistakenly assumed that Ioakim was our source and said that “without even realizing it, you are acting on behalf of Keith, who is doing everything he can to divert attention from the fact that he was caught stealing a massive sum from the company. He is trying to shift the “fire” away from himself.”

“Consider this a warning.”

Javaid repeated the claim that Ioakim wholly controlled Vector and Libra and that he had defrauded the companies.

In his defence, Ioakim told us “I want to make it clear that I did not steal any funds from Vector, Libra, or any other individual or organisation. This is a serious accusation, deeply offensive, and defamatory. I was never in control of any bank accounts for Libra, Vector, or Astrix. The only person with access to the SA bank accounts was Astrix Data, who acted solely on the instructions of representatives from Libra and Vector.”

“I have not received payments, neither personally nor corporately, other than those pertaining to the provision of my services.”

Javaid also shed partial light on what he claims is his true relationship with the platforms.

According to Javaid he is employed by a company that merely provided services to online trading platforms, including “developing financial strategies in alignment with the FinTech industry practice and requirements, providing regulatory compliance consulting, overseeing payment processing initiatives”.

While this does roughly correspond to what he can be seen doing in the leak, he did not address the fact that the regulated platforms he did work for are integrated with a vast international network of schemes that show all the hallmarks of being scams.

Javaid told us he had escalated Ioakim’s alleged misdeeds to the companies’ owners but would not confirm to us whether these owners are in fact Boris Kodzhov and Diana Gugles.

The biggest red flag,however, is that even when pointedly asked he refused to say who his employer or indeed the people who contracted them are. He did however admit that the “nexushq.co” email address he shares with Bresler was assigned by this mystery employer.

Bresler, apart from admitting that “Paul van Rensburg” is a fake name, likewise said he is a mere consultant, largely concerned with resolving client issues like complaints.

As supposed proof of his and Finbok’s legitimacy he provided a list of five refunds that had been given to traders. While he anonymised this list and provided only their numerical account numbers, the leak allows us to see the true state of affairs behind these refunds.

It was an ironic and ill-advised selection of examples.

Bresler for instance held up “trader 39740” – a man who lost the better part of a million rand and who told us unequivocally that he believes Finbok is a scam.

“Trader 61409”, the leaks show, had threatened to drag Finbok to the authorities and only then got a small refund that offset their losses, which ultimately came to R600 000.

Worst of all is trader 40354, who laid a lengthy complaint with the FAIS Ombud and lost both her pension and her daughter’s university fund.

All these examples involved clients who fought tooth and nail for their “refunds”.

We pointed this out to Bresler who responded that the latter client who took Finbok to the FAIS Ombud did ultimately get her refund. He also said that all of them knew what they were getting into.

“Individual confirmed they had read and fully understood the terms and recognized the inherent risks associated with trading in Contracts for Difference (CFDs), as documented by their subsequent signatures. Ultimately, they accepted negotiated resolutions to their complaints.”

He also suggested that clients are asserting that they have been defrauded only because third parties (like journalists) are contacting them and suggesting this was what happened.

“Given the inherent risks involved in trading CFDs, it is important to address cases in which external parties contact clients alleging fraudulent activity. Such communications may inadvertently cause clients to believe falsely that they have fallen victim to fraud.”

Complaints

The leak has revealed that the FSCA has been aware of complaints against Finbok in particular since at least late 2023, when it sent Astrix Data a letter demanding information on Vector and the trading platform.

In the leak there is both a draft and a final version of the response that was sent to the regulator.

One question was particularly telling and the answer may expose Cornelissen to serious legal risk.

The FSCA wanted to know what kind of due diligence had been done on Vector before it became a juristic representative using Astrix’s FSP license.

In the draft of the response, which clearly went through numerous hands,  the initial plan was to say that a rigorous due diligence had in fact been carried out.

This was scrapped and in the final version Astrix instead said that no diligence was required because Astrix and Vector have the same owner.

Recall how Cornelissen also told us that he owned Vector but then turned around and instead said that the Bulgarian Kodzhov owned it. If the latter is true, then Cornelissen seemingly intentionally misled the regulator.

In June last year the FSCA issued a public statement that it was investigating Finbok, Vector and Astrix – an investigation it told us is ongoing.

New horizons

The pressure on Astrix, Vector, Libra and the associated brands Finbok, Finxocap and VP Trade (perhaps combined with the schism with Cornelissen) appears to have resulted in these platforms making a getaway.

In November last year all three were seemingly transplanted from their South African FSP license and reborn as products of a company in the Comoros named Nova Capital.

One Finbok user sent us a message they received at the time.

This has not affected the platform’s place in the Scam Empire administrative system – possibly a demonstration that Cornelissen and Ioakim are not in fact the controlling minds their former colleagues make them out to be.

These platforms, while still targeting South Africans, are now effectively out of authorities’ reach.

But Scam Empire has also seemingly been quick to replace its local footprint.

In November last year a new licensed FSP named Zivalea launched two platforms – Tredomatix and FXSI. Tellingly, the leak reveals that Tredomatix has the same exact staff complement as VP Trade.

The Tredomatix website was, however, recently taken down, which the company’s lawyers attribute to it having been too similar to other trading websites.

In January another new FSP named The Grand Trading launched TradeFT.

Again, there is no involvement from Cornelissen or Ioakim but the “nexushq” team is very much involved.

Bresler confirmed that he does work for TradeFT.

Up until now we have been mostly concerned with the core South African platforms within Scam Empire.

The Nexushq team has, however, been driving the establishment of platforms based in the Seychelles using a company named FXW Global.

One of these,SIFX, started up in November judging by records in the leak.

It has recently been placing seemingly AI-generated ads online.

Another platform is Nuvega, again based in the Seychelles. Apart from Javaid, Bresler and Brovshtein, the common thread seems to be Porat Group, which we will encounter again in our next instalment.

We will show that while setting up companies and fancy websites is all well and good, what really matters is the money and the people who move it.

Correction: 27 March 2025

A previous version of this story erroneously claimed that bank statements in the leak showed Prorole receiving constant inflows from another UK company named Purplesun. The story has been updated to note that it was Greencode, not Prorole, receiving said inflows.

The post Scam Empire part 2: behind the veil appeared first on AmaBhungane Centre for Investigative Journalism.

Kodzhov seemingly launched not one but three multi-million-rand online trading platforms for complicated financial products called ‘contracts for difference’ (CFD). Their defining characteristic is that you can very rapidly lose all your money, but the potential rewards, marketers will tell you, are boundless.

One of these platforms, SkyMT, briefly shot the lights out before going out of business early last year after roping in estimated deposits of R30-million.

The other two platforms, however, Finbok and Finxo Capital, have gone from strength to strength, collecting deposits of over R240-million from aspirant traders since September 2023.

The problem is, the ‘fintech mogul’ Kodzhov was until recently actually a cleaner working in Bulgaria’s capital Sofia for a modest salary of around R6 800. He has since retired to care for his sick mother and now lives off a government grant. Kodzhov doesn’t speak English and says he has never heard of either his South African companies or those he supposedly owns in other countries.

Another arrival in the local online trading scene is one Diana Gugles, who, as purported owner, sits behind the company Libra Wealth and its trading platform VP Trade.

The platform has roped in at least 2 000 traders, who have between them deposited R64-million – and that’s just since April last year.

Gugles, a professional model, also struggled to recall her fintech start-up which, while based in South Africa, targets investors in South America.

By all appearances, Kodzhov and Gugles have either been the victims of identity theft or have allowed their identities to be used for setting up companies halfway across the world.

Either way, by using the sleek platforms presented by Kodzhov’s and Gugles‘s alleged companies aspirant traders could deal in crypto currencies, foreign exchange, commodities and other things besides, all aided by friendly finance whizzes over the phone.

Or so they thought. They, in this case being several thousand South African “traders” who would in almost all cases never see their money again.

These South African victims have fallen under the sway of the rapidly expanding local leg of a staggering international enterprise simultaneously managing over 70 online trading platforms across the world from a mysterious “back office” spread between Cyprus and Israel.

This nameless multinational syndicate has a staff complement of nearly 500 people targeting aspirant investors everywhere from Australia and Canada to Poland and Japan. If this were not enough, it appears that the organisation has branched out into an online “trading academy” as well as online gambling.

Victims have included South Africans from all walks of life, from pensioners who pinned their hopes on R3 500 investments to business owners who signed over millions.

And on the rare occasion someone got “profit” out, the evidence suggests that this was just bait to keep them putting in more.

Investments from South Africa and elsewhere mostly disappeared into a network of apparent fraud and subterfuge involving shell companies, offshore bank accounts and crypto currency exchanges.

Companies ostensibly run by the unemployed cleaner and model we mentioned at the outset are only the tip of the iceberg.

Beneath the surface lies a spectacular labyrinth of deceit.

This and other minutiae of this clandestine network’s operations have been laid bare in a monumental leak of data originally provided to Sveriges Television, the Swedish national broadcaster, to which amaBhungane has gained access as part of a global consortium of media organisations coordinated by the OCCRP.

The leak contains thousands of recordings from call-centres, screenshots from the computers of individuals managing the scheme as well as many thousands of documents and detailed spreadsheets tabulating everything from the global income of the various “teams” through to the office party expenses of call centre employees.

What emerges is a dark and cynical business, hidden behind the fig-leaf of cutting-edge fintech, churning out what the conspirators call trading “brands” – each with a dedicated website and staff.

The brands supposedly belonging to Kodzhov and Gugles sit among dozens the managers of the scheme can monitor at the same time using a back-end dashboard.

Based on our calculations from data in the leak, these centrally controlled “brands” appear to have collected deposits from tens of thousands of individuals across the world since the scheme’s relatively modest beginnings in 2021.

Records show that by the end of last year the total had swollen to at least $247-million – well over R4,4-billion.

Crucially, throughout the voluminous recordings, spreadsheets and other documents in the leak there is very little proof that any of this money was actually used to trade anything.

Where trading seemingly did occur, the leak suggests that it was manipulated and under the control of a “dealing desk”. In a document describing “roles within the company” the powers of this desk are said to include the ability “to make changes in ongoing trades, open/close, adjustment of pricing and even deleted ones when needed”.

Another major clue that these “investments” are very likely bogus is the negligible level of withdrawals or cash-outs that are reflected. Our interactions with victims suggest these are hard-won and sometimes only follow complaints of fraud.

While effortless withdrawals are always part of the pitch for new recruits, the reality is that there are a host of ways to block these, often by claiming that victims have an “open position” on the market and have to wait a few days. After this wait they are either told that the “market went against them” or get cajoled into a new investment.

Our data shows that the system’s overall deposits of $247-million were followed by withdrawals of only $7-million globally over 70-odd platforms. That’s 3%.

South Africa has been a prominent target, but the available evidence shows that it has also played an outsized role in the larger international scheme’s tangled financial arrangements. Managers of the network also include a number of South African expats now based in Cyprus and Israel.

AmaBhungane will lift the veil on the wizards in the backroom and the complex fronts they have constructed in Part Two of this exposé.

For now, we will explore what for lack of a formal name we will call Scam Empire.

Step one: bait and switch

Clickbait ads are so ubiquitous that many of us simply accept them as an online nuisance, but the leak shows how shockingly effective this kind of online bait can be and how organised and cynical this opaque world is.

This completely unregulated business involves companies based far and wide.

Records in the leaks show that the companies that captured the most South Africans are based in Bulgaria, Israel, Singapore and the Czech Republic, among other places. More on them below.

For many victims of Scam Empire their ordeal started with an online ad featuring fake celebrity endorsements.

One South African who lost over R300 000 told us his involvement began with a fake video of Elon Musk on YouTube. Musk is in fact a ubiquitous fake feature, sometimes presented as punting the notorious and entirely fictitious “Quantum AI” trading robot.

Another victim who lost R400 000 says she was caught by, ironically, a Facebook ad featuring prominent local consumer rights journalist Devi Govender.

According to the victim, “Devi” was punting effortless risk-free income “from the comfort of your bed”.

Govender told us she has come across numerous scams using her name, so many in fact that she had to give up trying to stem the tide: “Don’t fall for it,” she warned.

These ads are the handiwork of so-called “affiliate marketers” who, in the parlance of the business, “sell traffic” to the online trading platform sites.

Since the marketers are independent of the client and unregulated, they can essentially make any ludicrous claim they want, without consequences.

It’s a big business, replete with international expos and networking events.

While there are legitimate reasons to fish for eyeballs online, the over 160 marketers feeding victims to Scam Empire are being handsomely rewarded for this complicity and often resort to naked lies.

Records in the leak show that when a new trading client makes a “first time deposit” the affiliate marketer pockets at least $750. Tellingly, a South African “scalp” is generally worth $800, while a Canadian earns you closer to $1 100.

This is expressly set out in one marketing agreement in the leak where South Africa is relegated to “Tier 2” – one step above “Latam” (Latin America).

This seems to suggest that the majority of small one-time investors, the people putting in less than this fee, are actually loss-making for the trading platform scammers.

The whole model relies on repeat investors, often “whales” who put in ruinous amounts. The records show that there are, however, plenty of these. While half the deposits in 2024 were “first time”, follow-up investments make up 97% of the value.

It’s all about getting people hooked.

For the affiliates, these per capita payments rapidly add up as thousands of people sign on.

By January 2024 Scam Empire had likely spent between $36-million and $50-million (which is to say nearly R1-billion) “buying traffic”, a rough estimate arrived at by multiplying the number of victims by the lower and higher ends of the prices that generally apply.

Since then, it has spent another $11-million according to amaBhungane’s partners in the OCCRP consortium who calculated this figure by analysing the cryptocurrency wallets almost universally used for payments.

Enter Vector

Recall the trading platforms ostensibly controlled by the unemployed Bulgarian Boris Kodzhov:  Finbok and Finxocap.

These two platforms are operated by “his” South African company Vector Financial Services, much like the Romanian model Gugles’s Libra Wealth operates VP Trade.

Before this, Kodzhov also seemingly owned the ill-fated SkyMT.

The real hands controlling these operations are the subject of Part Two, but for now the basics are important.

Vector and Libra are what are known as juristic representatives. They piggyback on the financial services provider (FSP) license of another company – in this case Astrix Data. This is legal.

As an aside, this structure was apparently very recently abandoned, but we will get to that in Part Two.

Finbok and Finxocap are big players and have seemingly left destruction in their wake.

They have taken in deposits of at least $13.4-million while allowing withdrawals of $1.3-million. Half of these withdrawals belonged to just two extremely large depositors, both of whom have proven hard to get hold of. Most victims are in South Africa, although the records show Finbok more recently branching out overseas.

By and large, everyone loses their money.

While the FSCA said last year that it was investigating complaints from investors struggling to withdraw their “investments” from Finbok, it appears that the regulator is not aware that it is scratching the surface of a colossal international enterprise.

The investigation, we are told, is ongoing.

When it comes to Scam Empire, however, these South African companies are exceptional in a number of ways.

For one thing, they are actual companies with actual licenses. Much of the larger scam consists of phantom platforms with no underlying legal entity, platforms that operate without licenses or platforms that have licenses in relatively lax island jurisdictions.

The South African ones in fact fall under a special “division” of the organisation named “ZA_Regulated”.

Dustan Cornelissen, the local director of Vector Financial Services, Libra Wealth and Astrix Data (he was not involved in SkyMT) told us everything was above board.

He states that he provides regulatory compliance but does not control the companies or the platforms which, he insists, are just portals the traders use to access markets.

On his version they knowingly expose themselves to high-risk trading and sometimes lose: “Losses are an unfortunate reality in any speculative financial activity, whether it be trading, online casinos, or sports betting. The individuals in question were traders, not ‘would-be investors’. Their decision to engage in trading was voluntary and based on their own risk assessment.”

Cornelissen told our partners at OCCRP, “I have personally resolved every complaint lodged in South Africa by presenting a portfolio of evidence to the relevant authorities, including banks, the FSCA, and the Ombudsman. To date, we have not lost a single case.”

We will consider Cornelissen’s role in more detail in Part Two. His assertions will need to be tested against evidence revealed in the leak concerning the wider network, evidence that indicates the use of front companies, suspicious financial arrangements, fake documents and fraud claims.

The leak also shows call centre “account managers” pushing clients into investments they barely understand, as well as the ubiquitous use of misleading advertising to lure in new “traders”.

Step two: into the rabbit hole

The fake ads lead investors to the engine room – call centres.

First, they will land on the site of the trading platform “brand”. In the case of South Africans this would be Finbok and Finxocap (after the short-lived SkyMT bit the dust).

As a potential investor, you will be asked to fill in your details and before long someone will call.

And call and call and call.

Everyone we and our partners spoke to cited the pushiness and incessant harassment they suffered or continue to suffer. Internal guidelines direct agents to call each assigned client three times per shift.

The sources of the calls are disguised, and you would most likely see a South African number on your phone.

The leak, however, has made it possibly to track down the real physical locations from where agents call the various countries targeted by Scam Empire.

If you have ever received a call from Finbok it probably came from a Bulgarian office that is, confusingly, codenamed ‘Serbia’.

In ‘Serbia’ there are subdivisions. Finbok is only one of the operations housed there, in an office our OCCRP partners recently visited only to be told it was hastily evacuated in December.

Inside this ‘Serbia’ office, the South African operation (Finbok) had two further codenames – ‘Bentley’ and ‘D&J’.

And then there is Finxocap.

If you received a call from them before October last year it most likely came from a Cyprus office codenamed ‘Tesla’.

This then moved to the ‘Serbia’ office and was renamed ‘Rolls Royce’.

The South Africa-based VP Trade platform – which targeted South Americans – was also in ‘Serbia’, but for at least a small period shifted to Barcelona, presumably because of a need for native Spanish-speaking agents.

The boiler room

Extensive records for the call centres reveal a shocking hothouse of bullying and deceit.

The leak contains thousands of hours of recorded calls and evaluations of individual calls where “agent risk” and “client risk” (for instance a client who might lay complaints or sue) had been identified.

Perhaps most telling are actual manuals and presentations on how to deal with hesitant “traders”.

The mostly East European agents have seemingly been carefully coached to push inexperienced clients towards often ruinous ‘investments’, but first they must test the waters and secure the first deposit.

In chatgroups the prospective investors’ profiles are posted as they come in, including telegrammatic notes on whether they had any experience with financial products and whether they had income or savings or, for instance, assets they could conceivably borrow against.

These are in many ways the most pointed demonstration of the cynicism roiling in the back room, especially since selling complex financial products to people with zero experience and little money is extremely unethical even before fraud enters the picture.

Some egregious examples of how new investors were described stand out:

“Really bad experience…part timer at some low-life job,” reads one of these missives about a 62 year-old who did make an investment.

“Note: most of his family members have died and he’s doing this with high hopes to have a better legacy to leave his children”.

“Has a house”.

Another note, dealing with a 45-year-old “client” who made a deposit with Finbok, reads:

“No Exp”.

“Unemployed, sells food for a living”.

“Note: wants to build a house”.

The supposed finance whizzes on the phone who were making these notes did also, however, make efforts to befriend victims.

And there is a playbook for that.

The scammer’s manual

Contained in the leak are a variety of training materials, including a “bible of rebuttals” that gives country-specific advice on talking past people who object on the phone.

The instructions are straightforward and include, for instance: “We will ignore what the client says and keep talking fluently without stopping – here we must talk about profits and try to create a ‘hook’ for the client to ‘bite’ and then he will move on and forget the rebuttal”.

According to the “bible” South Africans often lie that they don’t have their bank card on them. As a response, the manual suggests using “ammunition” such as “you want money for your new baby on the way”. Another option is to “stress him out” by claiming there are limited licenses for the trading software left, or that some major event is imminent that could create profits.

If someone says they are afraid of being scammed, the agent should try “empathy” by saying “I was also scammed once long ago”.

If someone has previously lost money in a scheme: “Really (be a bit surprised) I’m so sorry to hear that!”.

The agents working for the regulated South African companies are trained to avoid certain legally dangerous formulations. Specifically, they can never outright promise profits but rather say something like “the majority of traders made around 30-40% returns last month.”

Even though fake celebrity endorsements are used via the affiliate marketers the agents themselves are supposed to avoid doing the same: “The agents must avoid direct affiliation with famous names or companies the customers see on the ads.”

This rule is broken often in practice.

Possibly the most damning evidence of how agents are taught to lie or withhold information comes from an “office rules and guidelines” document dealing specifically with VP Trade, the platform of South Africa-based Libra Wealth.

A draft is in the leak showing how a manager added comments for changes.

One of the rules is that “office location cannot be shared,” to which the manager added a comment: “Remove – you don’t want this document to land in the hands of a third party – this must be conveyed orally .”

In a section titled “benefits of the regulation” agents are told they can inform clients that they can complain to the regulator. However, according to the manager they should guide the complainants to the FAIS ombud and not to the FSCA, which could suspend licenses while conducting investigations.

“You don’t want clients to approach the FSCA – this way we got more control over the complaints and there is less chance the complaint will effect the activities negatively”

In a note that seems to indicate that the trading platforms are simply fake and do not “facilitate” investments is a “frequently asked questions” entry titled “How are you making money?”.

The draft claimed that “VP Trade makes a small commission (≈ 0.5-2%) on every position you open on the market!”

The manager, however, ordered this to be scrapped and said that “instead of mentioning commission we should rather explain spread as how VP Trade makes money.”

In other words, the platform was choosing between two completely different options what to tell prospective investors – an indication that perhaps neither is true.

While agents are meant to build up a personal rapport, they also use fake “stage names” that are formally assigned. Tellingly, these often to replace agents’ clearly Eastern European names with more Western sounding ones.

Some agents have three different names they use on different clients.

According to the leak, there are close to 490 agents involved in the Scam Empire network. Those who manage to shake loose enough deposits are handsomely rewarded with bonuses and even gifts of expensive watches.

One particularly extreme case was an agent for one of the major unregulated platforms who seemingly received a Rolex, along with $130 000 in bonuses, after scamming Briton Stuart Daburn out of $5 million.

Tellingly, a record of office expenses contains the line item “Polygraph, fixed toilet, taxi for security,” as well as a number of party-related costs, including “deposit for midgets”.

Despite the careful coaching, agents often go off-script.

The leak contains masses of call reviews where agents’ problematic claims are highlighted.

By and large, these involve promising absurd profits or lying that Elon Musk is somehow involved and that there is some or other AI-powered trading robot doing all the work, which would be false even if there was real trading going on.

Step three: the money

Scam Empire’s financial arrangements are convoluted, opaque and heavily reliant on cryptocurrency. From the leaks, however, it is possible to paint a picture of how layers of fronts move money across the world.

As mentioned earlier, there is little sign that any money is actually invested in the things clients believe they are trading.

But before you get the money out you need to get the money in.

Setting up payment service providers for the various brands is a constant preoccupation and all the platforms in Scam Empire have numerous ones – the records reflect up to 300 different services being used to collect money from “traders”.

The South African platforms seemingly made use of a number of extremely suspicious payment service providers that appear to have been stopgaps after more established ones withdrew due to fraud complaints.

For instance, a formal provider named Swiffy provided payment services for the SkyMT and Finbok platforms from May until November 2023.

In response to questions, it told us that it had terminated its services to these platforms due to fraud concerns. A “monitoring” spreadsheet in the leak shows at least three serious fraud allegations involving payments through Swiffy.

Swiffy added that “at the time of KYC checks both merchants were licensed with the FSCA under the correct class of license according to their stated business activities”.

Worryingly, one payment service provider that took Swiffy’s place was in fact a scrap metal dealer – in Part Two, we will deal with this and other dodgy payment service providers used by SkyMT and Vector.

Another established payment provider said they had no problems with Finbok, one of the brands linked to Vector.

They told us, “We have no recorded instances of fraud linked to this merchant… We note that the Financial Sector Conduct Authority (FSCA) has stated in its latest communication that its investigation is ongoing and that no findings have been made against any of the involved parties.” 

The online “traders” also paid a total of R68-million straight into the accounts of Astrix Data – the FSP behind Vector.

Apart from the massive payments for online advertising, it is not easy to discern where the money goes.

The sole director of Astrix in South Africa is Cornelissen.

In his version of how the platforms’ financial arrangements worked, traders would deposit their investments with Astrix either directly or indirectly through payment services like those mentioned above.

Even though the money is in Astrix’s account, the company “never holds clients’ funds”.

“Practically how this happens is that clients deposit funds via EFT or payment gateways which eventually settle to the Finbok/ Finxocap accounts, these funds are then credited immediately to their trading profile by our liquidity providers. All funds deposited are reflected on their trading profile – clients have the ability to withdraw all their funds via card refund or EFT directly to their bank accounts or they have the ability to trade. As such, we never hold clients’ funds.”

We have partial records for the accounts held by Vector and Astrix Data (the FSP behind it).

Payments from investors can be seen streaming in constantly. The only significant “exit” point discernable is payments to a Cape Town crypto payment provider named Xago Technologies.

Investors’ funds are regularly sent to Xago from Astrix. Xago keeps accounts in the UK and Switzerland.

Xago did not answer detailed questions but told us: “We categorically deny being complicit in or enabling fraudulent or money laundering operations. We are fully cooperative and willing to engage with any investigations launched by regulators or authorities.”

This company has cropped up in several places in the Scam Empire leak, as well as elsewhere.

Like the payment service providers mentioned above, Xago also directly channelled investment payments from a handful of large depositors, including a number of South African investors, to the online trading platform companies.

Xago has also come up in a court case launched by one of the victims in the UK: the aforementioned Stuart Daburn, who has lost several million pounds.

According to the particulars of his claim, he was told put pay Bitcoin into his investment account using Xago. He then paid in GBP100 000 via this Cape Town company, with this becoming part of his loss.

This is a very partial window on the South African division of Scam Empire’s financial arrangements. As we will see in Part Two, however, it is indivisible from the larger global enterprise.

Get out

AmaBhungane and its OCCRP partners have contacted dozens of investors in Scam Empire platforms worldwide and they almost universally now claim it is a scam.

There are common experiences, including being frantically pushed to make new and different investments as soon as possible. When the investor signals that they want to take cash out of their trading account they suddenly unaccountably lose everything in a turn of supposed bad luck.

One victim who lost R1-million told us that after getting sucked into Finbok by a celebrity ad, his online ‘agent’, who went by the stage name ‘George Weber’, first pushed him into oil, then stocks, then foreign exchange, until he had essentially lost all his money.

The agent did remember to repeatedly quote the playbook mentioned above, advising the investor that “they make their profit on the spread”.

“It’s a total scam,” the “investor” told us.

His agent George seemingly often went off-script with investment advice and once told a client he doesn’t “give a rat’s ass” about his negative experiences in the past, according to reviews in the leak.

Another victim mentioned earlier who lost R300 000 was likewise talked into one investment after another – oil then cocoa then sugar. He says that he tried to withdraw R75 000, but 45 minutes later it had disappeared.

He insists that his trades were manipulated, saying that the prices he could see on the chart presented to him were not the ones reflected in his trades. According to him he suffered “deliberate sabotage” and was told it would take three days to get his money out. He suffered his “losses” during this period.

The calls between him and an agent were reviewed and at one point the agent tried to push his wife to get a home improvement loan to invest with.

The “trader” laid a complaint and before long received a call from a man who will feature extensively in Part Two – the seeming legal head of Scam Empire’s South African division who calls himself ‘Paul van Rensburg’.

‘Van Rensburg’ made the hapless investor an offer: R100 000 credit, non-withdrawable, so he can keep going. Essentially a loan.

This seems like something ‘Van Rensburg’ does according to documents in the leak where other traders are made similar offers, which are called “bonuses”.

In one case where an investor complained he was offered either a R100 000 bonus or R40 000 cash to walk away.

But these “traders” have something in common with a few hundred others who were allowed to withdraw at least some of their funds from Finbok: for some reason the company seemingly tried to disguise the fact that it had happened.

Fake trail?

In the leak there are hundreds of clearly fake invoices. They each have a Vector Financial Services letterhead but all the letterheads are wrong and have wildly different designs.

The invoices are all addressed to investors who had gotten withdrawals and match the amounts and dates of those withdrawals.

But for some reason, all these invoices claim to be bills for “online marketing services”.

Even more confusingly, they state that the investor is to pay Vector but give the investor’s bank details for payment.

We spoke to some of the people these invoices are addressed to and they express complete ignorance. They had neither seen the documents nor ever provided “online marketing services”.

It is hard to know what to make of these invoices, which effectively create accounting cover for payouts to “investors” by describing them as business expenses.

This is, however, speculation, because with Scam Empire nothing is ever really straightforward.

Cornelissen told our partners at OCCRP that “the claim that invoices for marketing services matched withdrawals from Finbok is incorrect. If there was a template error in any invoice, it was an administrative oversight, not an attempt to misrepresent transactions.”

Stay tuned for Part Two of Scam Empire, where we will pierce the veil of fancy websites and call centre soothsayers to find the hidden hands behind the system.

The question is: who are these people?

The post Scam Empire Part One: Inside the dark heart of a multinational investment scam appeared first on AmaBhungane Centre for Investigative Journalism.