Don't miss interesting news
In the call centers of the investment “Scam Empire” everything resembled a legitimate international company. Only instead of clients, there were victims, and instead of results, there was a squeezed LTV of tens of thousands of dollars.
In Tbilisi, the A.K. Group call center occupied three floors, and Sapphire Network had seven offices around the world: from Ramat Gan to Sofia, Limassol, Varna, and Kyiv. In total, there are about 500 employees.
The process was divided into two main parts. The first one was performed by salespeople – young guys and girls who worked according to scripts. Their task was to persuade a person to make the first deposit of €250. In the GetLinked CRM system, this event was marked as a FTD – first transaction. For this, the salesperson immediately received a $250 bonus, and the affiliate who brought the lead received three times as much.
After that, the victim was “handed over” to the so-called retention team. These were experienced managers with psychological training. They spent weeks calling, pressuring, and persuading until they “squeezed” an average LTV of $14,000 out of the client. The agents’ monitors displayed a fake “investor’s account” – but in fact, it was just a regular slider that the backend team manually customized to keep the profit graphs growing.
The entire funnel was launched before the first call. More than 20 large affiliate networks generated a stream of leads through Facebook and Google ads.
Creatives mimicked CNN or Forbes news with photos of Elon Musk, Richard Branson, or Bill Gates. Under each “brand” were shadow companies registered in Singapore or Hong Kong. The discussion of attracting new leads took place not only in online chats but also at Big Bash yacht parties in Dubai or Bangkok. There, affiliates were asked to “give a ride to some more European grandmothers”.
According to the leak, in 2024 alone, Sapphire paid affiliates more than $11 million. The call center’s marketing department manually verified conversions by confirming payments through GetLinked on a daily basis.
Voice traffic was routed through Squaretalk (Israel) and CommPeak (Asia). These providers allowed changing the phone number as if the call was coming from the victim’s bank. The service cost $10-15 thousand per month. The bills were paid through the British company Intek Systems or the South African company Vector Financial Services.
GetLinked, a CRM system, was written by Perspecta LTD in Bulgaria. The API of this CRM was connected directly to affiliate dashboards, and all information was transferred to the internal “brand-desk” system. The operator of Jane Finance (real name: Vita Bernotaite) manually approved large deposits by pressing “Approved 10k” and sent USDT to affiliates’ addresses. At Sapphire, marketing expenses marked as “services” were routed through trafficon.io or allstar-media.uk domains and stored in the “Black hat” folder.
The call center worked in four shifts, covering different time zones. The converter had to make at least 180 calls per day and bring in 4 deposits. There were honor boards on the walls. The one who “led” the most received an iPhone 15 Pro, and for $500,000 of net profit, three days at Atlantis The Palm.
Those who did not meet the standard received a fine of “0 salary” for a week. The rating system was color-coded: green – easy to manage, yellow – requires a “risk manager,” red – postponed to a later callback.
In Slack, agents greeted each other with the “Sucker caught” meme and competed in the speed of squeezing out the second €5,000 deposit. When a client demanded a refund, they sent a PDF with a “tax audit” or “SEC fee”. If someone mentioned the police, a “lawyer” appeared, scaring them with a court in Malta and asking for another €1,500 to handle the case.
Payment infrastructure is another key element of the scheme.
AK Group ran money through hundreds of accounts in the Baltics, Poland, and Germany. Sapphire used companies in Spain, North Macedonia, and the UAE.
Each transfer was disguised as “IT consulting” or “software”. Part of the amount was transferred into crypto via Binance, mixed and withdrawn to the wallets of the nominee directors. From there, it was used to pay for the office, salaries, and the same parties. In Tbilisi, according to the leaked documents, the payroll was $176,000 per month. A separate line item was payments such as “CEO Rolex” – $7,800, or “Squaretalk coverage” – $12,360.
The emails include Balenciaga, Dom Pérignon, and a Lamborghini for a weekend in Dubai. One of the managers posted all these “treasures” on Telegram, along with tickets to Affiliate World in Barcelona, where they were supposed to discuss the new black-hat offer Quantum AI Invest.
On March 5, the world media simultaneously published the Scam Empire investigation. Panic broke out in Telegram chats: “clear the pages”, “switch to the backup Slack”, “do not accept newcomers”. Several key brands were removed from the rotation, and the office in Sofia was closed. In Tbilisi, journalists were simply not allowed to enter the building.
But already on March 25, Qurium analysts recorded 184 outgoing calls via Squaretalk – this time to Canada, Australia, and the UK. It looks like the ship has been repaired and launched again.
The only thing that really hit the system was the threat of infrastructure loss. Squaretalk, afraid of publicity, promised to block accounts without registration documents. This created serious problems for scammers.
For the legal arbitration market, this case is a textbook. It clearly shows how affiliate networks, VoIP services, and CRM software, which on paper only “provide services,” become drivers of fraud if they do not check to whom they sell these services.
At Junior’s Arbitrage, we have already shown how the bundle was formed and how they received $1000+ per FTD. At Middle’s, they explained in detail how GEO traffic worked: Canada paid more due to high credit limits. On Senior’s, there is already a series about how Google Ads was driven. And C-lvl is preparing an article about the creation of a crypto arbitrage company.
Scam Empire is still alive, changing domains and signs. But the main thing has already happened – the world has seen affiliates turn into scammers in suits. And when you see the inside of CRM, VoIP, scripts, and the payout structure, it is easier to understand how it works. And more importantly, it is easier to decide what to do with traffic: make money quickly or build a system for a long time.
Sources: