March 7, 2025

Greetings From Amsterdam, 

In this edition of OCCRP Weekly, we’re introducing Scam Empire, a collaboration with over 30 media partners that unveils the inner workings of two scam centers where agents convince “clients” to pay into fake investment schemes — and never give the money back. 

Based on an unprecedented leak of 1.9 terabytes of internal files obtained by Swedish Television (SVT), the project exposes two sophisticated operations — one in Israel and Europe and the other in Georgia — that have convinced at least 32,000 people globally to make “investments” totalling some $275 million since early 2021. 

The leak includes reams of internal documents, records of money flows, screen recordings of the scammers’ computers, and even 1 million audio recordings of phone calls, allowing us to listen in as scammers gained their victims’ trust before destroying their lives. We also researched court cases, spoke with victims who lost their life savings, traced vast flows of funds, and even identified scammers who bragged they would never be caught. 

These two malicious operations are part of a thriving online scam industry enabled by a suite of service providers, including online marketers, voice-over-IP services, and payment providers.  This digital infrastructure allows them to target victims in far-away countries — and often elude the efforts of law enforcement. 

“This problem is not impossible to solve. We all just need to care enough to do something about it,” the anonymous source who leaked the records wrote in a statement. 

Today, we’re taking a look at how journalists made sense of the massive trove of leaked data and other records they collected over the course of six months — plus the psychological toll these schemes take on their targets. 

We’ll start by zeroing in on Georgia.

OCCRP’s regional editor for Georgia and Azerbaijan, Kelly Bloss, led a team of six reporters from three Georgian member newsrooms — Governance Monitoring Center, Studio Monitori, and iFact — to tackle the investigation into the Georgian call center. This involved reading through or listening to countless invoices, documents, emails, and Telegram conversations; some 20,000 screen recordings; and over 20,000 hours of audio calls. 

“You feel like you are inside the call center,” said Bloss. “You’re seeing how they are talking to each other, how they are talking with the victims, and how they are emailing, how they are forging documents. You can see in real-time how they are creating a fake passport for another colleague. So it’s actually a really crazy leak.”

The Georgian operation employed multilingual agents who took on aliases and altered their backstories to suit their audience. They worked brazenly. In calls with victims, they would often be doting and personable, sharing intimate — and fictitious — details from their so-called personal lives. But in messages between colleagues, they were disdainful and disparaging, calling victims “stupid” or “bitch.”

The agents were careful to hide their identities, using bland pseudonyms. They all had fake backstories and even fake passports they sent to clients, with AI-generated images used for the photos.

In one recorded call, a Canadian factory worker named Marcel comes to realize he is being swindled and threatens to call the police. His financial adviser, “Mary Roberts,” begins to laugh: 

“You are so stupid,” she taunts him in heavily accented English. “Even if you call the police of Canada, police of Quebec, police of Alberta, police of Calgary, police of  Ontario, or the police of the entire world, you will never find my real passport. You’re fucking dumb.” 

The team of Georgian reporters were determined to prove her wrong — and they did. 

They broke up the work systematically, said Bloss. One person was assigned to finding as much information as possible about the company behind the call center; another pored over invoices; others followed the work of specific scammers, reading through their Telegram conversations, making sense of how they managed their targets, and attempting to piece together their real identities. Collectively, the team built a timeline of the center’s operations and a series of investigative memos on their findings.

There were a few stand-out documents within the leak that helped reporters tie everything together:

• Invoices for rental payments helped the team determine where the scam center was located: in the heart of Tbilisi, Georgia’s capital. (But they still had no record of the company operating the center, Bloss said. The companies renting the offices turned out to be owned by impoverished proxies from the breakaway region of Abkhazia, including an internally displaced person who lived at a resettlement center )

• An organizational chart contained the real names of some call center employees — although it didn’t link them to their aliases. 

• A letter of recommendation lauded one employee’s work ethic, using his real name, the dates he had been employed and — crucially — the name of the company he worked for: A.K. Group. 

That same employee was listed in the organizational sheet, making A.K. Group the possible name of the company behind the call center, Bloss said. Searching online, she found little trace of it. But, there were a series of photo booth pictures from a 2023 New Year’s Eve party, with people posing in shirts that said “A.K.” across the chest. 

To confirm this was the company they were looking for, the Georgia team sought out A.K. Group’s commercial registry documents, which include owners’ passport photos. The picture of the owner matched a woman seen partying in the New Year’s photos — and one of the staffers on the organizational sheet shared her name.

Next, reporters searched the other names from the staff chart on social media and cross referenced the images with the photobooth pictures and Telegram chat details. Some employees had let clues about their identities slip in workplace conversations: They celebrated birthdays, talked about vacation plans, and even used real nicknames instead of aliases — all details that helped reporters match their identities with the information they found online. 

For instance, a receipt for a pair of Adidas saved to the desktop of one scammer allowed reporters to check his name, along with hints about his birthdate from colleague chats, against the country’s voter registry. 

Many of the Georgian agents were in their 20s and 30s, and appeared to be leading lives of luxury, replete with extravagant vacations, Rolex watches, and 6,000-euro Cartier bracelets. 

“It was extensive OSINT work,” Bloss said, referring to investigative techniques that rely on open source material. This independent research was crucial for verifying and expanding on the leaked records, she said. “Reporters had to vet everything they saw in the leak.”

As the team in Georgia was tracking down scammers’ identities, other reporters used the leak to identify their victims. 

They spoke with over 200 victims globally who had lost a total of $18 million. 

Reporters connected with victims face to face, by phone, and over email. Some of the people they spoke with had lost small sums of money. Others said they would never recover financially from their run-ins with the scammers. 

Few had told friends, loved ones or police what had happened to them, thinking it wouldn’t make a difference, said OCCRP Investigative Editor Lawrence Marzouk. Many people also felt deep shame at having fallen for a scam. Some victims said our reporters were the first people they ever talked to about the experience. 

Some victims found these conversations cathartic, hoping their stories would help others avoid investment scams and put the spotlight on the perpetrators. 

“Others thought we were the scammers — convinced that it was just another round of people pretending to be someone that they weren’t, and trying to extract more money from them,” said Marzouk.

Reporters approached victims delicately, providing evidence that they were journalists, giving them space to decide whether to participate in the project, and offering anonymity when desired, said Marzouk. 

They would also explain that they were speaking with hundreds of victims “from all walks of life, and that these guys [scammers] are skilled at what they do and therefore… they [the victims] should not feel stigmatized,” he said. 

For Marzouk and his colleagues, speaking with so many victims was moving, and underscored the importance of the Scam Empire project to the public. Some interviewees described being unable to eat or sleep after realizing they had been scammed, falling into depression, and, in some cases, wanting to kill themselves. 

“Obviously money is important, and a lot of people have lost a lot of money and have lost life savings and they’ve had to take out loans or they’ve nearly become homeless and these terrible things,” said Marzouk. “But I think what struck me most is how often people find it very difficult to trust again and have deep psychological damage.”

P.S. Thanks for reading OCCRP Weekly. Feel free to reply to this email with feedback, thoughts, or questions.