In February 2019, the European authorities executed a multi-jurisdictional enforcement action against the cybercrime organisation around the Israeli Gal Barak, his E&G Bulgaria and his German partner Uwe Lenhoff. The two have operated various broker scams such as Option888, TradoVest, OptionStarsGlobal or XTraderFX, CryptoPoint and SafeMarkets. Moreover, they jointly operated the techno-organizational infrastructure behind those scam schemes and shared important resources such as call centres and payment service providers. In this report we want to take a closer look at the SafeMarkets Scam in a follow-the-money approach using the data and information available to FinTelegram. SafeMarkets was closed after the access of the police authorities and is the subject of official investigations.
The Israeli Shame
With the introduction of the binary options about 8 years ago, a real broker scam industry has been established in Israel. Tel Aviv developed into the Silicon Valley of cybercrime. Simona Weinglass of the Times of Israel uncovered this fraud industry in detail in her internationally recognized series of articles on the Wolves of Tel Aviv in 2016. With her articles, Simona has created a global public awareness of the gigantic Israeli fraud industry. The FBI estimated the annual loss for retail investors with this fraud industry to be around $10 billion. Ultimately, Simona’s work led to a ban on binary options in Israel at the end of 2017.
Basically, this scam industry with hundreds of startups and thousands of employees has fired the so-called Israeli Startup Miracle. In fact, this celebrated miracle was financed with money stolen from retail investors around the world. A pity for Israel.
Israeli entrepreneurs have abused the most modern technologies to acquire client-victims on the Internet and steal their money and data. The whole world fell victim to the Israeli perpetrators. The financial instrument of binary options was the cover to the first industrial scam industry in the history of the Internet.
The Elements of a Broker Scam
Domain and Trading Style
The individual scams are handled via registered domains and websites. SafeMarkets was listed under the domain www.safemarkets.com. The UK Financial Conduct Authority (FCA) and other financial market regulators refer to each scam domain as a “trading style”. In general, the trading styles are frequently changed by the scammers and have rarely lasted longer than 18-24 months. Many customer complaints and the warnings of the financial market supervisory authorities have brought about a rapid end. The scammers know this and usually operate several trading styles and have a time line.
The operating entities
Two companies are usually set up to operate a scam (trading style). One of them is regularly offshore to blur the tracks and avoid tax payments. The other company is usually located in the region in which client-victims are addressed, for example in the EU.
In SafeMarkets Scam, these were Rockarage Ltd, registered in the Marshall Islands, and Optiumcommerce OÜ, registered in Estonia. Like the trading styles, the operative companies of a scam also change frequently. These are anyway only empty shells which are led by so-called nominee directors or “monkeys.”
Those companies are needed to open bank accounts and register as so-called merchants with payment services providers. These two SafeMarkets companies were controlled by Gal Barak and his partner Marina Andreeva. Just like the offshore companies where the stolen customer money finally ends up.
Call Center (Boiler Room)
The boiler rooms with their agents are the real heart of every scam. Trading styles come and go but boiler rooms are here to stay. They employ agents who care either on the new acquisition of client-victims (Conversion) or on the keeping of the client-victims and, more important, their money (Retention). The client-victims are covered by dedicated agents who are psychologically well trained. These agents work with scientifically worked out scripts with the goal of getting the maximum money and data from client-victims. Many client-victims report that the agents actually became friends or trusted people. They told them everything about their family and friends, about their problems and wishes. Armed with this information, client-victims are delivered helplessly to the agents.
Through false promises, allegedly insured trade,s
At SafeMarkets the Israeli Chen Ganon was responsible for the boiler room activities. The scheme was operated by ARC Solutions DOO in Sarajevo. The ARC Solution DOO belongs to the network of E&G Bulgaria of Gal Barak and Marina Andreeva. Chen Ganon has earned good money and high commissions as a scheme manager for SafeMarkets. In good months like August 2018, Chen received more than € 35,000. Chen is a young man who is not yet 30 years old and already earned a small fortune. His job was to steal as much money as possible from the client-victims with his agents. He made that successful.
Chen Ganon admitted this in talks with FinTelegram, noting that SafeMarkets was only a “small fish” compared to other schemes in the Barak scam ocean such as XTraderFX or OptionStars or OptionStarsGlobal. He would also have noticed that his boss Gal Barak together with Marina Andreeva was running a vast cybercrime network and that his own activities were also illegal. That’s why he said he left SafeMarkets with a lot of money in the summer of 2018.
Payment Services Provider
In addition to the boiler rooms, the payment services providers are a core element of the scams. Without them, the scammers can’t steal the customers’ money. The scammers work with different channels:
- Bank accounts of the operating companies (entities);
- Bank accounts of other companies that accept bank wires from client-victims as illegally operating payment service providers and pass them on to the operating companies of the scams after deduction of high commissions;
- Regulated payment service providers and credit card companies such as Payvision, NetPayInt, or Wirecard;
- Unregulated payment service providers such as Binex Group, Payobin or PraxisPay working with various regulated payment service providers
In the case of SafeMarkets, the main payment services provider was the regulated Payvision where the scam operating entity Rockarage Ltd was registered as a merchant. In some months, such as December 2018, Payvision transferred over one million euros to the bank account of Rockarage Ltd at the Bulgarian Investbank.
Payvision has a special position with regard to the scams from E&G Bulgaria and Gal Barak. In 2017 alone, Payvision transferred more than 11 million euros to the accounts of New Markt SA, which operated the Scams OptionStars and OptionStarsGlobal at the time. Marina Andreeva was also the person authori
Besides Payvision, the Binex Group, led by Russian Vladislav Smirnov and his frontman Leonid Olshevsky (Ukraine), was the most important payment transaction partner. The Binex Group, in turn, has worked with the UK licensed financial services provider
In the end, SafeMarkets received bank wires from its client-victims via the bank account of its Estonian operating entity Optiumcommerce OÜ held with the Bulgarian Postbank. In August 2018 alone, Optiumcommerce OÜ received almost one million euros by bank transfer from its client-victims.
No Segregated Accounts – the money is gone for good
Licensed and serious brokers must keep their customers’ money on separate (segregated) accounts and may only dispose of it on the instructions of their customers. The money may not be used to finance the company or for any other purpose. The brokers are merely trustees for these client funds. In this respect, customer funds deposited via the various channels should be available in the bank accounts at any given time.
As a matter of fact, however, the deposited client-victims money is immediately transferred to various other companies. We have analysed the bank statements and documents and can confirm that the money was not held in segregated accounts. This pays for the boiler rooms, the marketing companies that have acquired the client-victims and other services providers. The remaining money is then forwarded to the offshore companies of the scam operators and thus into their privacy. Untaxed, of course.
At no time is the money deposited by the client-victims actually available for trading. There is no trading. On a case-by-case basis, payments are made to customers to reassure them of their seriosity. These withdrawals are funded by freshly deposited monies from other client-victims.
Offshore and to Israel
In the case of SafeMarkets, the funds were transferred to Online Prospect Limited registered in Hong Kong after payment of the service providers. This company is controlled by the Israeli Simon Tetroashvili (LinkedIn profile) who forwards the funds from Online Prospect Limited to the Israeli DYISY Group Ltd. This is also controlled by Tetroashvili. According to FinTelegram’s information, in 2017 and 2018, approximately $12 million of E&G Bulgaria‘s scams were transferred to Online Prospect Limited and transferred to Israel. These payments are invoiced as marketing services and should, therefore, be taxed accordingly in Israel by the DYISIG Group and Tetroashvili.
In the case of the SafeMarket Scam, in 2018 Rockarage Ltd also transferred hundreds of thousands of euros to the Cyprus-registered Tiberg Limited for alleged marketing services. Also from SafeMarkets sister scam, XTraderFX, Tiberg Limited has received more than one million Euros in 2018. An amazing fact considering the fact that Tiberg Limited was founded in November 2017 and the website was launched in April 2018 (see OpenCorporates).
