Every Tuesday, a man using the alias “Ben” logged into encrypted Telegram chat groups to coordinate payments. His job was simple: ensure marketers received their money for delivering contact details of unsuspecting individuals. But these weren’t ordinary sales leads—they were targets for ruthless investment fraud operations.
A massive leak of internal records, totaling 1.9 terabytes, has exposed how two sprawling call-center networks—one based in Georgia and another with offices across Israel, Bulgaria, Ukraine, Spain, and Cyprus—relied on third-party marketing firms to keep their scams running. The documents, obtained by Swedish Television and shared with dozens of media outlets, reveal a well-oiled machine where marketers earned lucrative commissions for each victim they delivered.
Payouts varied by geography, with victims from wealthier nations commanding higher prices. A single lead who eventually deposited money could fetch between $200 and $2,350. In just the first seven months of 2024, marketers working with the Israeli-European operation received at least $7.3 million. The previous year, they earned over $10.3 million during the same period.
The marketers used deceptive tactics: fake news articles featuring unauthorized celebrity endorsements, phony investment platforms promising extraordinary returns, and ads placed on mainstream websites and social media. When victims signed up, their personal details were instantly forwarded to the scam call centers. More than 300 marketer names appear in the records, though many operated under multiple brand names or coded aliases.
Victims suffered devastating losses. An architect from Seville lost 400,000 euros within months after clicking an ad that falsely featured a popular Spanish TV personality. A retired Finnish scientist saw his life savings vanish, plunging him into depression. A Spanish doctor lost one million euros. In total, journalists confirmed losses exceeding $21 million from 166 victims who acknowledged being scammed.
Internal records show that the scam operations maintained sophisticated back-office teams. “Ben,” for instance, earned nearly 85,000 euros in bonuses alone over 12 months, calculated based on how many of his marketers’ leads actually deposited money. His supervisor, using the alias James Collins, is believed to be Ronen Kapeika, a former affiliate manager based in Israel.
Some marketing firms appeared to ignore obvious red flags. One company, Sierra Media, operated brands that promoted “Quantum AI” trading platforms even after regulators in multiple countries issued warnings. Another firm, Oray Ads, charged the scam operation over $105,000 for Facebook advertising budgets. Oray Ads also allegedly stole a woman’s photo and identity for its website, listing her as marketing director without her knowledge.
Social media platforms have faced criticism for allowing such ads to proliferate. Meta, parent company of Facebook and Instagram, stated it prohibits ads promoting scams and works to remove malicious content. However, victims repeatedly reported encountering scam ads on these platforms. A Swedish journalist lost everything after clicking a Facebook ad featuring a well-known television presenter’s image without authorization.
The marketing firms appear to flaunt their success at industry conferences. Over a third of sponsors for the 2023 Affiliate World Asia conference appeared in the scam operation’s internal records. One marketer, MGA Team, sponsored exclusive events in Bangkok and Dubai, including a party branded “Sin City” featuring dancers and revelry, even as the victims whose details they sold were being harassed by scammers.
Senior prosecutor Nino Goldbeck of Bavaria noted that these criminal networks depend entirely on a constant supply of fresh leads. “The entire online marketing machinery that works in completely reputable areas is also of great importance in this illegal area,” he said.
Many victims reported their cases to police, but investigations often stalled due to the cross-border nature of the crimes. The source who leaked the data stated they were motivated by the apparent impunity of the scammers, noting that “fraudsters can operate almost openly, without anyone stopping them.”