Eurasia Press & News
“Tell them you’re only offering educational materials,” one said into the camera. “Nothing more.”
The raid was one of 22 carried out the same day in Serbia, Bulgaria and Cyprus, coordinated by Europol and involving considerable manpower and intelligence from Germany. Four call centres were hit, all of them in Belgrade.
Investigators found that employees were assigned to specific language teams tailored to target specific countries, given fake names, fake identities and scripts in order to pose as brokers, gain the trust of their targets and fleece them out of considerable sums of money, sometimes their entire life savings.
The network is believed to have targeted over 70,000 people worldwide, pulling in an estimated 250 million euros by duping people into fake Forex and cryptocurrency investment trading, police in the southwest German state of Baden-Württemberg said by email.
In Serbia, 21 people have been charged with fraud totalling an estimated 3.4 million euros in damages. The indictment is yet to be confirmed by the court. The suspected masterminds, however, remain out of reach of authorities.
This investigation, by Investigate Europe and the Balkan Investigative Reporting Network, BIRN, has traced the operation in Serbia back to an Israeli couple from Tel Aviv – convicted money launderer Eliran Oved and his wife, Liat Kourtz Oved, both 42 years old – through a series of shell companies, frontmen and connected firms, including a former sponsor of English Premier League football club Leeds United.
Prosecutors in Serbia say that at the Olympus Prime call centre itself, Israelis were ultimately in charge, with day-to-day operations in the hands of Serbian staff members.
The call centre agents were ruthless: according to internal chats, shown to BIRN and IE by a source close to the investigation, they referred to their victims as “idiots”. In one exchange, after an agent stated that a target had 40,000 euros to invest, a colleague replied: “Great, grab it!”
Asked to confirm the connection between the scam and the Oved couple, Majlat said he was unable to comment on an ongoing investigation.
The Oveds and their associates identified in this story have not been charged with any crime in connection with the Belgrade call centre scheme. None of them responded to detailed requests for comment.
Victims around the world
The Oveds do not hide their wealth on social media. There are snaps from exotic family holidays and fancy dress parties, and in September last year Eliran Oved received an award from Israeli President Isaac Herzog for the community work done by the second tier football club he owns, Bnei Yehuda Tel Aviv.
Behind the public persona, however, Eliran has had trouble with the law before: he was sentenced in 2012 to a year in prison when Israel’s Supreme Court upheld a conviction for operating an illegal online gambling business and money laundering.
Now, an investigation by IE and BIRN, involving analysis of dozens of documents from corporate trade registers, has exposed multiple business links between the Oveds and the multimillion-euro boiler room fraud operated out of Belgrade.
The couple had help via a number of key associates: Cypriot former footballer Nikos Andreou, Bulgarian lawyer Vera Nachkova Andonova, and Milos Radivojevic, a Serb with Bulgarian citizenship and who is believed to be Andonova’s husband. The trio served as directors at five Oved companies and held shares in 14 firms linked to the fraud network.
Of the three, only Radivojevic is currently under investigation in Serbia for suspected money laundering in connection with the Belgrade call centres, according to details of the case shared with IE and BIRN.
Radivojevic and Andonova did not respond to requests for comment. Andreou could not be reached at the only email address found for him online.
In total, the four call centres in Belgrade targeted individuals in Germany, Britain, Ireland, Switzerland, Austria, Australia and Canada; documents seized at Olympus Prime and seen by IE and BIRN show that some lost a few hundred euros, others over a million.
In 2018, a 64-year-old Scottish builder who agreed to be identified only by his first name, John, clicked on an ad on Google for FX Trade Market, which claimed to be endorsed by Dragon’s Den, a popular British TV show in which entrepreneurs pitch ideas to wealthy investors.
He got a call the next day.
“He was quite amicable and really charming,” John said. “I told him I’d love to buy a house in Spain and he told me: ‘I’ll get you three houses in Spain.’”
Over the next year or so, John invested £25,000 [28,650 euros] and even persuaded his daughter to invest. Online, his portfolio appeared to have grown to £130,000 [149,000 euros].
“My wife didn’t know very much about it, and I was hoping to surprise her with a big chunk of money,” he said. Then one day, the money vanished; so did John’s broker.
The moment, he said, “must have taken years off my life”.
FX Trade Market was operated by the Estonian firm Ingoten OU, which worked with one of the Belgrade call centres, called Parogan. Parogan was owned by Andreou and Andonova and is also under investigation by Serbian authorities in a separate case.
‘Everyday he called me’
According to the indictment against the 21 individuals in Serbia, seen by BIRN and IE, prosecutors have identified Israeli citizen Shai Dorani as the most senior manager at Olympus Prime.
Dorani fled the country and Serbian authorities froze roughly a million euros-worth of real estate assets he owned in Belgrade, including an apartment in the luxury Belgrade Waterfront district on the right bank of the Sava. Contacted via Instagram, he did not respond to a request for comment.
On paper, Olympus Prime is owned by Andreou.
An Olympus Prime document, seen by BIRN, lists a host of associated investment brands that prosecutors say were fronts used to lure in victims.
They include FXVC, a former sponsor of Leeds United, as well as PrimeOT, Greenfields Capital, Wingroup and others, all of them offering online trading services in crypto, foreign currencies and other products.
A Belgian former bank IT manager, who asked to remain anonymous, told BIRN and IE that he deposited 250 euros with Wingroup in 2020 after seeing an ad on Facebook.
Someone claiming to be a financial broker called him shortly after and offered help with the “short selling” of stocks, a form of trading the IT manager was familiar with.
“Everyday he called me, and every time he asked to invest more,” the Belgian said.
Online, his account balance rose to 3,000 euros, when suddenly he was locked out.
An invoice that he shared with IE and BIRN shows that his original deposit was handled by Coinshype, a cryptocurrency exchange. According to business registry documents in Australia, Coinshype is a registered brand of Mormarkets Pty Ltd, an Australian entity. Andreou is named as ‘shareholder’, taking over in 2020 from Cypriot-registered Tyriona Limited, which, according to Cypriot corporate documents, is owned by Kourtz Oved.
According to the invoice, Coinshype is operated in Europe by a company called Polotis, registered in Estonia but dissolved in 2022. Its last shareholder was Andreou, again having taken over from Kourtz Oved’s Tyriona Limited, according to corporate documents in Estonia. Radivojevic was previously a shareholder and also a director.
In financial reports submitted in 2022 by Cypriot-registered Lytria Holdings Limited, which was owned first by Koutz Oved and now by Eliran Oved, Polotis is mentioned as an “entity under common control” even though at that point its registered owner in Estonia was Andreou, suggesting again that Andreou was merely a frontman for the Oveds.
In March, Brendan Gunn, a director of Mormarkets Pty Ltd, was arrested on suspicion of handling the proceeds of crime in excess of 100,000 Australian dollars [56,000 euros], collected from three victim investors who deposited funds for conversion into cryptocurrency, the Australian Securities and Investments Commission said.
Red flags
Some of the brands were flagged as suspicious well before the January 2023 raids.
In 2020, 38 plaintiffs from around the world sued the Oveds in Israel, alleging that companies controlled by the couple were promoting financial scams such as Greenfields Capital and PlusOption.
IE and BIRN found that the UK and Vanuatu entities behind Greenfields Capital listed Andonova as shareholder. Andonova has served as director of four companies ultimately owned by the Oveds.
Defence documents in the Israeli lawsuit confirmed that the Oveds’ Israeli firm had provided call centre services to Tradeplus Solution, the offshore company behind PlusOption, and BIRN and IE understand the case was settled out of court. Since then, newly uncovered corporate records reveal that Tradeplus Solutions was owned by Andonova. Eliran Oved appears to have registered a website domain on behalf of the company.
Investment fraud identified as key threat
Europol, the EU’s police agency, identified investment fraud as a key threat in its latest report on organised crime, with its scale and scope increasing at an alarming pace. Globally, the financial scam industry siphoned off over a trillion euros in 2023, with only four per cent of victims recovering their losses, according to estimates from the Global Anti-Scam Alliance. Artificial Intelligence has become a potent tool for deceiving more people with realistic [often cloned] websites, scripts and videos, with social media becoming a common vector to ensnare consumers.
Meanwhile, FXVC had a sponsorship deal with Leeds United, which in 2020 won promotion back to the top flight of English football for the first time in 16 years. With its branding displayed across the Elland Road stadium, FXVC was suddenly reaching millions of viewers every week until the UK Financial Conduct Authority, FCA, revoked its licence in April 2021, accusing it of “misleading financial promotions”.
Responding to a Freedom of Information request, the FCA said FXVC was not fined, nor was it required to compensate any victims of the ‘misleading’ promotions. A BBC investigation in 2023 cited Leeds United as saying it had severed all ties with FXVC after the FCA ruling. The club did not respond to requests for comment for this story.
On paper, FXVC was owned by a Cypriot holding fronted by nominees. But a closer look at the fine print on the company’s accounts disclosed Kourtz Oved, Eliran’s wife, as the ultimate beneficiary.
PrimeOT also came in for scrutiny from the UK Financial Ombudsman, which in 2022 issued a decision ordering Nationwide Building Society to reimburse a customer more than £100,000 [117,300 euros] that she had lost to a cold-caller from PrimeOT. The customer had been instructed to send her money to Coinshype.
Panzers, Vikings and Spartans
Malcolm Edwards, a 67-year-old semi-retired oil industry manager from the northeast of England, began by investing £500 [573 euros] with Greenfields Capital after seeing an ad on Google. A ‘broker’ called the next day, urging him to put in more.
“He persuaded me to invest £34,000 [38,970 euros],” said Edwards. “He told me he’d double it within a week and pay the gains straight into my bank. Needless to say, the week came and went, and no gains were received. All the investments he set up were at zero.”
Malcolm took a closer look at Greenfields Capital and found that the London address listed on its website was fake.
Meanwhile, some of the fake brokers in Belgrade were raking in massive monthly bonuses far higher than most Serbians can expect to earn in a year. According to details of the indictment seen by IE and BIRN, in November 2022 one agent pocketed an extra commission-based bonus of 63,000 euros, while another took home 84,000 euros.
At Olympus Prime, five teams worked around the clock, divided by language and region. A German-speaking team nicknamed ‘Panzer’ preyed on German victims, team “Viking“ focused on Scandinavians, and three more teams – ‘Spartans’, ‘Miners’ and ‘Atlas’ – were tasked with targeting English-speakers.
Employees at the call centres used language-specific code names such as ‘Jack Weiss’ or ‘James Eastwood’.
After clients made small initial investments via cloned websites, simulated ‘profits’ and encouragement from their ‘broker’ spurred them to invest more.
Majlat, the Serbian prosecutor, said the Serbian judiciary is ill-equipped to deal with such operations.
“We are not dealing with amateurs,” he said Majlat. “This is organised crime, and unless we respond accordingly, they will simply move elsewhere and start again.”
“We’re facing organised, transnational, crypto-based fraud, yet the court treats it like a basic scam,” he said. “These are not cases for ordinary prosecutors. We need specialised units. Without them, we cannot win.”
His frustrations were shared by German prosecutor Nino Goldbeck, who since 2019 has headed a special task force out of Bamberg, northern Bavaria, dedicated to tackling online investment fraud.
“If, for example, we search a call centre with 200 employees, only a small fraction will end up in the dock at the end of the day,” Goldbeck said. “This is due to resource constraints, prioritisation, and jurisdiction issues.”
In Germany, the Public Prosecutor General’s Office in the southwestern city of Karlsruhe is working alongside Serbian law enforcement to investigate the Belgrade call centre network but declined to comment for this story.
In 2020, Australia’s financial regulator fined a firm called Ozifin Pty Ltd 20 million Australian dollars [11.2 million euros] for “unconscionable conduct” after investors in online trading lost over 11 million Australian dollars [6.2 million euros] in the space of a year.
While the ruling did not name the Oveds, according to the Australian business register, Ozifin Tech Pty is owned by Hong Kong-based Corfenix Limited, which, in turn, according to the business registry in Hong Kong, is owned by Kourtz Oved.
Despite the growing scrutiny of their operations, the Oveds continued to expand.
An offshore company owned by the Oveds and associated with the former Leeds sponsor FXVC launched two new trading brands: Klips.com and 50K.trade.
The Klips trademark was registered in 2022 by one of the couple’s Israeli firms, while the 50K.trade app was released in March last year.
People who lost money to the Belgrade call centre scam, meanwhile, are still coming to terms with what happened to them.
Some of those approached for this investigation refused to speak, afraid they might be targeted again.
For others, the memories were simply too painful to revisit.
“It is the worst thing to talk about,” said one woman, who lost 54,000 euros to Greenfields Capital. “As a victim, you are trying to forget it.”
PrimeOT and the personal touch
In August 2020, Anna Leitner [not her real name], a 64-year-old secretary at a university in southern Austria, stumbled across an online advertisement that promised to reveal the investment secret of Austrian billionaire and Red Bull founder Dietrich Mateschitz.
Leitner clicked on the link and registered with PrimeOT.
Shortly after Leitner entered her details, she received a call from a man who identified himself as “Gabriel” and said he was her “personal account manager”.
Gabriel set about gaining Leitner’s trust, sharing supposed personal information about himself and his family, talking to her about his career, and sending her photos, all well-known social engineering tactics designed to exploit human emotions to create a bond.
Before long, Leitner and Gabriel were speaking three to four times a week, usually for more than half an hour at a time.
“Gabriel often told me about how he had spent his weekends with his wife and children,” Leitner recalled. “Once he told me he had bought his wife a gift with a bonus payment.”
“He probably thought I was a money maker.”
When Gabriel asked her to download Anydesk, a legal software programme that allows remote access from other computers, Leitner did not hesitate. This allowed him access to her personal banking information to make trades, and she could see Gabriel investing more money on her behalf. Leitner said she watched in real-time as the cryptocurrency prices rose, blissfully unaware that the data on her screen was fake.
When Leitner hesitated over whether to make her first large deposit, Gabriel sent her a photo of himself. It showed a handsome man in a white shirt smiling and looking at his smartphone. Leitner replied with a screenshot of a transfer receipt. A few weeks later, in an email in mid-October, he wrote: “I always carry you in my heart.”
Sometimes, the tone changed.
“I have called you four times but you are not answering,” Gabriel wrote in another email seen by IE and BIRN. “I wonder what has happened. I am worried.’
Leitner said the pressure grew. “It quickly became about how I could invest in this or that, and whether I could scrape together more money,” she said.
Gabriel initially asked Leitner for 5,000 euros, then after a few weeks he sent a payment request for 10,000 euros. By the end of 2020, she had transferred money six times, in multiple digits, to a Maltese bank account.
Leitner soon started losing large sums, and became suspicious.
“I wanted to withdraw my money,” she said. In January 2021, Leitner sent an email: “Dear Gabriel, please, I URGENTLY need you to call.”
Finally, by email, she received instructions on how to withdraw her funds with just a few clicks of her mouse. “But that [possibility] didn’t exist at all,” Leitner said. Shortly afterwards, her account was deleted. “I couldn’t log in anymore. They had kicked me out.”
The money was gone. “Then I realised I had screwed up,” Leitner said.
Altogether Leitner invested – and lost – 29,250 euros. In March 2021, she enlisted the help of a Berlin lawyer to recover her money. But all efforts came to nothing. Two and a half years later, in November 2023, Leitner received an email from her lawyer, informing her that “despite our efforts, including complaints and further investigative approaches”, the prosecutor had “closed the investigation against PrimeOT”.
