Behind the Scam: How Fraudsters Use Social Media, Software, and Shell Companies to Steal Millions

Investigation

Professional scammers call upon a global network of service providers to execute their work in a sophisticated, streamlined fashion. Here are some of their names.

Banner: James O'Brien / OCCRP

July 25, 2025

At the heart of many modern-day scams is the call center: sleek offices staffed by manipulative, multilingual agents who spend their days trying to convince victims from around the world to pour funds into fake investment opportunities.

These call centers, however, do not operate in a vacuum. They draw upon an entire ecosystem of service providers who help facilitate each step of the process — and get a cut of the profits.

Here, we present dozens of companies from around the world whose services were used by the two large-scale fraud operations exposed by Scam Empire, one based in Israel and Europe and the other in the country of Georgia. 

It was not always possible to determine the extent to which these companies were aware of the scams their services helped facilitate.

From external marketers who harvest victims’ data to money transfer services used to extract their cash, these players range from legitimate businesses exploited by the scammers to entities that appear purpose-built to help them carry out their nefarious work.

Below we have organized these providers by their role in the three major phases of a scam: catching victims, winning their trust, and taking the money.

1. Catching Victims

Affiliate marketing companies

To catch their victims, the call centers rely on external marketers who post online phishing ads. Promoting snazzy investment opportunities that promise big returns, the ads target specific audiences and often feature fabricated endorsements from local celebrities or media outlets. 

Rather than advertise a real product, the goal of the marketers is to collect data: Potential victims who click on their links are brought to landing pages where they are asked to enter their contact information. This data is then funneled to the call centers, who compensate the marketers for every individual who goes on to make a deposit. 

While the extent to which these marketers are aware of who they are servicing could not be confirmed, many go to great lengths to conceal the nature of their work by operating through anonymous shell companies, using aliases in encrypted chats, and receiving their payments in cryptocurrencies.

MGA Team
CRYP
Sierra Media
Oray Ads

Tech platforms and websites

Social media platforms and other websites are the public bulletin boards where scam ads are plastered across the internet. They also receive a cut of the profits, as marketers pay to place advertisements on their platforms.

While these tech companies tout policies barring such fraudulent content, their moderation efforts have failed to prevent billions of scam ads from proliferating across their platforms.

Meta
Google
Taboola

2. Managing a Scam

Software

After clicking on an online ad and entering their contact details, victims frequently hear from a call center agent within minutes. This is thanks to technology that directly integrates the personal data collected by affiliate marketers into databases of “leads” maintained by the call centers. 

From there, the call centers utilize a range of software to streamline their work, including “customer relationship management” software, or CRM, which is used by sales operations worldwide. This software provides a space for the scammers to store information about each “client,” such as notes on their background and investment experience, the content of their phone conversations, the amount the victims have deposited, and how much they believe they have “earned.” Screen recordings in the leak showed how agents were in some cases able to control the client-facing side of some of the software, where victims would view figures detailing the status of their fictitious investments. 

Getlinked.io
PumaTS
AnyDesk

Connectivity

The scammers’ work rests on their ability to make large volumes of calls on a daily basis. To do so, they pay for Voice-over-IP (VoIP) services that allow them to make international calls over the internet. In addition to saving costs, VoIP enables the scammers to choose the country codes of their phone numbers, bolstering the ruse that they are calling from prestigious financial centers like the U.K. or Switzerland. The VoIP firms also provide a steady flow of new phone numbers to call center agents whose numbers are frequently blacklisted as spam.

Coperato
Squaretalk

HR and administrative

The call centers require the same administrative upkeep as any normal company: Someone needs to pay for rent, internet, utilities, and parking spaces, plus handle HR tasks such as payroll. In many cases, these payments were made by external firms that helped shield the identity of the real companies and individuals behind the call centers.

Za Traiding Company
Saberoni LLC
Roserit
Amapola
Maximateam
Clear IT

3. Getting the Money

Banks and money transfer companies

Once a victim is ready to “invest,” the next challenge for scammers is to get ahold of their cash without alerting compliance officers at banks or leaving a paper trail that would allow authorities to track them down. In the cases reviewed by reporters, the scammers would often advise victims on how to answer questions from their banks as they sought to transfer funds out of their accounts. The scammers would also frequently push victims to open accounts at specific institutions.

Revolut
Chase UK
Wise
Wirex
Santander
BBVA

Payment service providers

The scammers don’t receive the funds directly from their clients — that would make it too easy for investigators to hunt them down. Instead, they were found to move the money through other bank accounts, often belonging to shell companies, to obscure the final destination.

The leaked files reveal how a sprawling ecosystem of unregulated service providers were called upon to facilitate this process. When the scammers requested help moving funds from a victim, these providers would match them to the most suitable company and produce phoney paperwork to help satisfy questions from banks. Internal documents show these providers charged fees of 10 to 17 percent, significantly more than a legitimate mainstream payment service.

Bankio / Anywires
Britain Local

Shell companies

To bring the money to its final destination, the scammers need a steady supply of shell companies to help obscure the ultimate recipients of the funds. The leak revealed the existence of dozens of such companies that were used to funnel victims’ money around the globe. Some of them also served as intermediary firms who paid the call centers bills for other services, such as software.  

Selterico SL
Greencode Connection Limited
Purplesun Limited
Intek Systems Limited
Fact-checking was provided by the OCCRP Fact-Checking Desk. Research and Data expertise was provided on this story by OCCRP’s Research and Data Team