
An unprecedented leak exposes the inner workings of a global investment-scam industry, where ruthless call center agents make millions while destroying lives around the world.
When Annika Gustafson and Anthony Adams first started chatting over the phone, they hit it off immediately. He told her to call him “Tony.” To him, she was always “dear.” He shared his dream of seeing the Northern Lights before he died, and promised to visit her in Sweden one day.
Annika, a retired journalist in her late 60s living in the country’s north, had been feeling anxious about money. She needed expensive dental work and didn’t have the cash to cover it. When she responded to a Facebook ad touting a new investment scheme in October 2023, Anthony got in touch.
He told her he was a senior financial adviser based in the U.K. who loved working with “beginner” investors. He said that, backed by an expert team, he could help Annika make money investing in stocks and cryptocurrency. Annika quickly came to trust him.
But within five months she had lost all her savings, been plunged into debt, and was considering suicide.
Annika Gustafson.
“Anthony Adams” wasn’t an urbane British investment adviser at all. He was a professional scammer based out of a call center in Tbilisi, the capital of Georgia.
Scammers like “Anthony” have been operating with relative impunity for years, emboldened by the ease of setting up call centers in the internet age and the fact that law enforcement agencies struggle to follow complex scams across borders. Estimates of their prevalence vary widely, but experts agree that hundreds of billions of dollars are lost annually to online scams like the one Annika fell prey to.
“The laptop, so to speak, is now the sharpest sword in the arsenal of criminal groups,” said Jürgen Stock, the former secretary general of Interpol.
But now, a team of journalists has obtained an inside view of how these scams operate, thanks to an unprecedented leak from two groups of call centers.
The massive archive contains internal documentation, records of money flows, screen recordings of the scammers’ computers, and even over 20,000 hours of audio-recorded phone calls, allowing reporters to listen in as scammers gained their victims’ trust before destroying their lives.
The leaked files analyzed by OCCRP and partners came from two separate scam operations, one based in the country of Georgia, and another with offices in Israel and multiple European countries. Though reporters found no evidence that these operations are controlled by the same group, they operate in very similar ways — and at a massive scale.
According to financial records maintained by managers of the Georgian operation, it received $35.3 million from more than 6,179 “clients” between May 2022 and February 2025.
The Israeli/European operation recorded much bigger numbers: It received $240 million from would-be investors between January 2021 and December 2024, according to internal transaction sheets. The money came from over 26,000 people in 33 countries, with most clients living in Canada, Spain, Australia, the U.K., and South Africa.
But reporters didn’t just get a glimpse of the scammers’ finances — they entered their world. They were able to watch as scammers chatted with each other on Telegram and Skype, swapping jokes and cheering each other on with animated GIFs when they convinced an unwitting victim to send more money. Internal chats also show scammers gloating over clients’ distress once they realize they’ve been scammed, at which point victims are often passed on to other agents who impersonate law enforcement and tax authorities and trick them into paying even more, supposedly to release their lost funds.
Fake passports used by scammers at the call centers.
The leaked files also reveal that these merciless scams are enabled by an entire ecosystem of service providers that make it possible to set up — and scale up — these operations.
Some of these providers are legitimate businesses that scammers can easily exploit, like online “neobanks” and voice-over-IP services. Others appear to largely cater to scammers, like a firm we uncovered that helps people avoid banking compliance efforts by making fake invoices and providing scammers with details of ready-to-go shell companies and bank accounts. A thriving online marketing sector helps ensnare victims with fake ads, collects their contact details, and sells them to scammers.
“These call centers are extremely professionally structured and organized and are managed accordingly,” said Nino Goldbeck, a senior public prosecutor in the German state of Bavaria who specializes in cybercrime.
“Well equipped, good IT, good equipment…We’ve often been really amazed at how well they work, how well everything is monitored and recorded. In our opinion, the accounting in such companies is sometimes almost better than in many completely legal companies.”
The industry also thrives because of its ability to elude law enforcement by crossing borders — scammers can open companies in minutes, move money through a web of international transactions, and target victims in far-away countries.
For crime groups looking to turn a profit, operating a call center can be more lucrative than trafficking drugs, since the margins are higher and the risks of being caught much lower, according to an investigator from Spain’s Mossos d’Esquadra, the Catalonian police, who specializes in investment fraud networks.
“The profits they make without risking anything are enormous,” said the investigator, who was not authorized to speak on the record about his work.
On the other side of the phone line are people who are pushed to the brink of financial — and often psychological — ruin.
Reporters reached 182 people targeted by the Georgian and Israeli/European call centers, using information within the leak to find them. More than 90 percent of them, or 166 people, said they had been scammed. Their total confirmed losses exceeded $21 million, and 85 of them told journalists that they had gone to the police.
Though many of these victims lost relatively small sums, some were cheated out of life-altering amounts of money. One of them was Annika, who is living on a pension and says she will never financially recover from her run-in with Anthony.
“I was devastated, absolutely devastated,” she told OCCRP. “I felt so stupid, betrayed and ashamed. … I didn’t tell anybody for a long time.
“I didn’t want to live any more.”
Gaining Victims’ Trust —Then Destroying Their Lives
Like dozens of other victims we spoke to, Annika got reeled into the scammers’ universe through an advertisement she saw while browsing Facebook. Formatted like a news story, it claimed that a famous Swedish television host had found a way to “earn money while she sleeps.”
“At first I thought, ‘This is a hoax,’” she told SVT in an interview. “But then I saw that it was some serious journalist at Aftonbladet who had checked this out … and I thought yes, why not?” After all, Annika was desperate to fix her teeth, and she didn’t know where else she would get the money. She entered her contact information into the page.
It was a fateful decision. Annika was now a “client” of “Golden Currencies,” a completely fake investment platform.
Although Golden Currencies had a logo, a website, and a motto (“Get more for less”), reporters were unable to identify an actual company behind the branding. (British regulators issued a warning in November calling it a “clone” firm set up to spoof a licensed company.)
Instead, a marketing company was behind the Facebook advertisement. When she filled out the contact form, Annika became a “lead” that the marketing firm could sell to a scam call center.
The Scam Empire data reveals that this is a typical tactic: Hundreds of marketing firms feed the names of people like Annika to scam centers, who then call them directly to pitch their products. In exchange, the marketers get a payment for every “lead” who can be converted into a “client.” The going rate for a Swedish victim was around $1,350, the second-highest rate in the world, according to spreadsheets of marketing payments found in the leak.
There is no evidence these firms were aware they were servicing scammers, but there were several red flags about the operations, including the fact that the financial platforms being advertised were in many cases unlicensed, and some had been flagged by regulators around the world. The promoted ads often used fake celebrity endorsements and fake news sites — as in Annika’s case — and the compensation per lead was also extremely high for the industry.
Annika’s name ended up with the Georgian scam operation, run by a company called A.K. Group. With three offices in Tbilisi, the country’s capital, it was staffed by young, multilingual Georgians who had received intensive training in how to pretend to be “financial advisers” who could help their clients get rich quickly.
Diamond Jewelry, Lavish Holidays, Range Rovers, and Porsches
Along with the other agents, Anthony likely worked in A.K. Group’s largest office on Kavtaradze Street, a leafy thoroughfare that runs through a Soviet-built residential neighborhood in the west of Tbilisi.
One of the call centers identified by the journalists is located on Kavtaradze Street in Tbilisi, the capital of Georgia.
Internal documents and communications reveal an office life that, in many respects, wouldn’t look out of place at a normal company. The call center staff clocked in and out of work, enjoyed office parties, underwent performance reviews, and exchanged memes and GIFs of Hollywood celebrities in office chat groups.
But there are also clues that something darker was happening. Employees used code names in their chats and even in official internal spreadsheets. Their office has no signage and was rented on A.K. Group’s behalf by a company owned by a proxy — an internally-displaced person from the breakaway region of Abkhazia.
And when the employees received bonuses, their rewards were linked to the amount of money they had extracted from their “clients.” An internal spreadsheet shows that high-performing staffers made over $20,000 some months in a country where the average monthly income hovers around $750.
These earnings afford them a high-flying and sometimes decadent lifestyle, replete with diamond jewelry, lavish holidays, ostentatious weddings, Range Rovers and Porsches.
Highlights from the Instagram account of a scammer at A.K. Group, Veriko Charchian, who showed off pricey purchases and international holidays on social media.
Earning all that money required an organized workflow. Like many sales operations, the Georgian scam organization was divided into “conversion” and “retention” teams.
The “conversion” team was filled with fresh recruits. After receiving batches of leads from an affiliate marketer, their job was to call them one by one, gauge their interest and level of expertise, and quickly pass them on to a more experienced agent if they proved willing to make a small initial investment.
They were instructed to present this as an opportunity. “[Sell] the senior, presenting them as a figure of authority,’” reads an instructional manual found in the leak.
Scamming 101
It was actually a deeper trap. The most skilled salespeople sit on the “retention” team, where their job is to extract as much money as possible from their clients.
Divided up into different language “desks,” the call center agents use fake names that match the country they are tasked with calling — in the Georgian call center, agents calling Spain had names like “Esteban Fernandez,” while the Russian desk was led by “Kseniya Koen” and the English desk employed “Mary Roberts.”
Along with the pseudonyms, they gave themselves impressive titles — usually “financial advisers” — as well as detailed back stories and fake identity documents they could send to clients who doubted their legitimacy. Some of the female agents sent male clients photographs of a beautiful green-eyed woman, claiming to be her. (The images were actually taken from the social media account of a Ukrainian woman.)
Scammers Flatter Their Victims — But Trash Them in Private
After submitting her information, Annika first received a quick phone call from a man who spoke poor English — internal records show that he was a conversion agent using the alias “Lucas Hoffman.” He convinced her to make a small initial payment of around $250 to join Golden Currencies and promised to connect her with a colleague in London for further guidance.
“It didn’t take many minutes and this one called,” she recalled. “Anthony Adams.”
Recordings of Anthony’s calls with Annika show that he had a smooth, polished pitch and a deft handle on his backstory as “senior financial adviser,” although his English was accented to the point where she asked him if he was really from the U.K. (Anthony’s ready answer? He was born in Toulouse.)
In reality, the man behind the pseudonym writes and speaks in fluent Georgian with his colleagues, the leaked files show. On his desktop, reporters found a copy of a British passport that was clearly doctored, using an AI-generated image available online.
On that first call with Annika, Anthony asked her what she would do with the investment windfall she was sure to receive — a tactic scammers learn in training. “I love when my clients are motivated,” he said, suggesting she might want to buy a new car or take a holiday.
Annika replied that after fixing her teeth, she dreamed of giving her profits to the homeless. Anthony complimented her effusively, calling her a lovely woman. He also had good news for her: She had already made a “profit” of $19.
But the scammer’s sweet side frequently dropped away in internal chats with colleagues, and even in some conversations with clients when they did not cooperate. In one case, he prank-called a man who had caught on to the scam, claiming to be a delivery man bringing a sex toy to his wife.
“Family full of dickheads,” Anthony wrote in a note on his internal customer relationship management software, which the scammers used to track approaches to potential victims.
On another occasion, he left a string of expletive-ridden comments in the software to denigrate a target: “She is a fuckin bitch // said that doesn’t want calls every month // thinks that I’m gonna trade for her like a slave // said that has investment plan for whole year and isn’t willing to invest more // … hope all her properties will fuckin burn down // dumb bitch.”
Gaining Access to Victims’ Computers
During the months Annika was in touch with Anthony, she was in poor health and he pestered her with incessant contact, sometimes ringing several times a day. Recordings of the dozens of calls he made to her create the impression of a woman bowled over by his confidence and persistence.
Early in their relationship, Annika allowed Anthony to walk her through the process of downloading a remote-access software program called AnyDesk.
Although AnyDesk has many legitimate uses, call center scammers frequently use it to gain access to vast amounts of personal information from their victims’ computers.
In thousands of screen recordings of scammers’ computers reviewed by OCCRP, it was very common to see AnyDesk open on one side of the screen so that scammers could keep an eye on their victims.
Reporters even saw scammers chatting with their victims while watching through AnyDesk as they typed their responses, creating a haunting mirror image.
A typical view of a scammer’s desktop. On the left side, the scammer looks up a client’s entry in her customer relationship management system. In the middle is a VoIP app she uses to make calls. On the right, she is watching through AnyDesk as her "client" chats with her.
AnyDesk told OCCRP that it was “tirelessly working to prevent” the use of its software by scammers and worked closely with law enforcement to fight against scam call centers. “We even have a warning in place for first-time connections from suspicious accounts where the end user has to type, ‘I read this,’ said a spokesman, Matthew Caldwell. “Unfortunately, a large portion of these attacks involve social engineering where a victim is coached around these automated countermeasures we put in place.”
After Annika installed AnyDesk, Anthony began to guide her even more closely, explaining in minute detail where she should click in the Golden Currency-branded trading platform to secure her profits.
“I want you to move [the] mouse to the right side,” he said in one phone call. “Okay, to the bottom right now. Go below. Down. Go down. Stop, no, not so much.”
Eventually, he directed her to click on a red “close” button: “You see $30? That’s our profit for today. … Congratulations. So, we have closed the positions and we have made this profit.
After these initial “gains,” it was time for the real “investing” to begin. In mid-January 2023, Anthony called with news of a fantastic VIP deal: He had inside information on the electric vehicle company Tesla, and if Annika sent him just $2,500, he could help her make a “risk free” investment in the firm.
“Oof,” she said when she heard the amount, which was far more than the $650 she had at her disposal. But he promised she would recoup her investment, and more, after just three days. She agreed to send the money. (Internal logs from the call center confirm that she made this payment.)
"letter of guarantee" sent by Anthony Adams to a British client of the fake investment platform Golden Currencies shows the same type of reassurances he made to Annika: that her investment was "risk free" and her money would only have to be held for a short period of time.
Three days later, Anthony called with great news.
“Let’s check our platform,” he told her, watching through AnyDesk as she moved to the Golden Currencies website. “All right, here we are,” he announced. “You see on the bottom there? $6,288. So we made an amazing profit. We made approximately $2,700 on a Tesla deal. So that was something amazing.”
A screenshot of an agent’s computer from inside the A.K. Group call center shows what a client might have seen while "trading" on the Golden Currencies investment platform. At left is the agent’s desktop; at right is the client’s. The agent is watching through AnyDesk.
In fact, none of Annika’s money had been invested in Tesla at all. (Even if it had been, she couldn’t have doubled her money on Tesla stock, since the company’s share price was falling in January 2024.)
Things moved faster after that. Immediately after her successful Tesla deal, Anthony proposed another one — a much larger investment in Bitcoin.
Annika had nowhere near enough cash to afford what he proposed, so Anthony suggested she take out a loan. Call logs show how he logged into her bank’s website and filled out a loan application on her behalf. When that didn’t work out, he helped her apply for several other loans, before a Swedish provider finally agreed to lend her the equivalent of around 9,000 euros.
Then it was time to send him the money.
Neobanks, Cryptocurrencies, and Shell Companies
Annika can’t recall precisely how she made her payments to Anthony, but internal records from inside the call center show they arrived through cryptocurrency exchanges.
This was typical of the cases examined by reporters in both call center operations. Victims would be instructed to convert funds to crypto and send it to wallets, or to set up accounts with online-only “neobanks” or online payment service providers to speed up their transactions.
From there, the money would be whisked away through a series of shell companies registered in different jurisdictions, often set up and owned by proxies to disguise their ownership. OCCRP found victims’ money moving through companies owned on paper by a fashion model and a perfume vendor, among others. Some victims were even used as “mules,” unwittingly sending money to other victims who scammers were trying to reel in with small payouts.
In order to send her second, larger payment to him for the so-called Bitcoin investment, Anthony walked Annika through the steps of opening an account at Wise, a major “neobank.” But her attempted transfer was blocked.
(In response to a request for comment, Wise said its verification processes, transaction monitoring, and account deactivations “help us prevent, detect and stop potential instances of financial crime and abuse of our services.”)
Scammers and NeoBanks
In the cases examined by reporters, scammers often told their victims to open accounts at neobanks like Revolut or electronic money services providers like Wise that are not as stringently regulated as commercial banks.
Read more similar news:
Comments:
comments powered by Disqus























