How a Ukraine-based boiler room allegedly scams victims worldwide out of millions

Things were looking up for Yamelin Montero, a 34-year-old single mother in the Dominican Republic. Her small investment in digital currency through a company called CryptoMB was soaring — or so she thought.

Montero made three separate small investments of less than $500 via a credit card, and her computer screen now flashes an account balance significantly greater — more than $2,000 ⁠— an amount she clings to with misplaced hope. For six months she has been unable to recoup her “winnings.”

“These entities have screwed me easily out of $2,000,” she said in a phone interview from Santo Domingo, the capital.

CryptoMB is part of an aggressive marketing pitch and alleged global fraud scheme run through a Ukrainian telemarketing center named Milton Group. It offers investment in so-called cryptocurrencies, commodity trading and foreign currency markets. Invest $1,000 and you’ll walk away with $10,000. That’s what investors such as Montero were led to believe. She was on a list of more than 1,000 purported victims shared by a company insider.

In fact, a former insider turned whistle-blower told journalists and authorities that the company is operating a scam, that the purported investments are nonexistent and that the operation’s profits are staggering.

The plight of the Dominican woman and others who say they are victims offers a cautionary tale in the digital era. While regulators in developed nations like the United States keep a watchful eye, the Internet has been weaponized, and curbing bad actors is akin to a game of Whac-A-Mole. A simple marketing pitch that arrives by email or over social media can originate with a clutch of sophisticated, hard-closing salesmen working out of a boiler room in faraway Ukraine or some other place halfway across the planet.

The operators can tailor their pitch by language, country and even tap the fame of unsuspecting celebrities. Some self-described victims of Milton-related investments told the Guardian newspaper they answered ads that featured celebrity chef Gordon Ramsay and actor Hugh Jackman. After Montero took the bait, she got email scam offers of large sums of money from people claiming to be U.S. Treasury Secretary Steven Mnuchin, Attorney General William Barr and FBI chief Christopher Wray.

The group is involved in activities closely watched by U.S. regulatory authorities, such as trading digital currencies, betting on movement of foreign exchange rates and binary options, a form of wagering on where a stock price will close.

For months, a company insider has worked as a whistle-blower, sneaking out documents and videos to share with the Swedish daily Dagens Nyheter. Together they show the scope, systems and scale of the alleged fraud, which last year allegedly netted more than $70 million, in part by having clients download software to computers and phones, providing access to their sensitive banking information.

Employees, numbering more than 300, are kept in check through intimidation, constant surveillance and threats, according to the whistle-blower. The Swedish newspaper shared the information with a global consortium of news outlets in 21 countries, including McClatchy and the Miami Herald.

After verifying and further investigating the information, reporting partners are jointly publishing the stories under the title “Fraud Factory.”

In February, the whistle-blower shared the information with Swedish law enforcement.

“We have initiated a preliminary investigation,” said Patrick Lillqvist, head of the fraud department of Stockholm police, when contacted by McClatchy’s reporting partners in Sweden. Arne Fors, the Swedish public prosecutor in charge of the investigation, confirmed that other countries have been notified about the information provided by the whistle-blower.

“It is not correct,” said Jacob Keselman, Milton’s CEO, when confronted by McClatchy’s Europe-based reporting partners about the alleged fleecing of clients.

“A lot of clients lose money because they don’t understand how it’s working. But when clients lose money, why [do] we need to send back money?”

Deception apparently extends to the organization’s public-facing websites. McClatchy found that the photos of the strikingly attractive staff on the website of Cryptobase, one of the other brands Milton was offering investments in, are fake.

That photo of “Karina Krylova,” the supposed head financial analyst, is actually a cropped image of a woman clipped from an ad for National Woman Road Warrior Day 2017. CEO “Sergio Ferrer Martinez”? His photo is actually an image from the sales page of a formal wear website.

One self-described victim in El Salvador forwarded a photo of the salesperson she said was talking with her via WhatsApp, describing him as young and handsome. It was the same tuxedo model. He identified himself as “Ferrer.”

When investors, many aged or of humble means, try to withdraw their profits, CryptoMB breaks off contact, said several victims interviewed for this story. Montero said that once she paid money through affiliates of CryptoMB, she immediately got offers of help to get U.S. residency. She said she sent more money, well beyond the $550 reflected in documents she shared with reporters, to an outfit called The Immigration Enterprise. It has a toll-free number and advertises a New York address. A reporter left messages over multiple days, but nobody returned calls.

“They sell the American dream,” she said, sharing information in hopes of alerting other would-be victims.

Montero provided evidence of how she believes she was tricked, in the form of more than two dozen screenshots. These included messages from a man known only as Ronald, who told her he worked for the U.S. Postal Service and needed $255 sent by Western Union in order “to commence with the delivery of your ATM Master card to you.” That card, she was told, was loaded with money she was “inheriting.”

The phone number from the WhatsApp message to Montero traced to the Texas town Georgetown, near the capital city of Austin. When called by a reporter, a Google Voice message followed and asked the caller to leave a message. In an instant, a caller with a number from the Dallas-Fort Worth area called back and listened before hanging up. Then the person texted to declare it was a wrong number and that he would not agree to talk.

Minutes later a woman with a number from Marion, Illinois, called and said she had just received a call and demanded to know who’d called before angrily hanging up. It was unclear if they were connected to any scam or had numbers that had been cloned. Neither caller identified themselves.

McClatchy, the Miami Herald and their reporting partners identified at least 180 people from across the Americas as well as Australia and Europe who claimed that they were scammed by Milton Group and its affiliates.

Maria Carmen Lopez, a 29-year-old woman in El Salvador, is among those who paid a seemingly small amount, but for a poor person in a developing nation it was a huge sum. She estimates that she spent about $350 on CryptoMB in three separate payments of $100, $150 and $100 — significant investments for someone living in a country where even high-skilled workers earn only $500 to $700 monthly.

When her own bank card company rejected payment to a foreign account, she was instructed by a woman named Alexa to send money to a Western Union account in Mexico City that she was told would be relayed to Spain. She doesn’t know who ended up with the money.

“It has been bad for me,” she said of the investment that provided her no certificate or proof of ownership other than a website user ID and password that shows her a growing account balance that she’s powerless to cash out.

She started with CryptoMB in November 2017. Like Montero from the Dominican Republic, she was given access to a website and her own password, the same as Montero’s, the numbers 123456. Records she shared show she had about $1,300 in her account but was also offered a can’t-miss scheme where she could make another $5,000.

“I told the woman I wanted to take some of it out, and she said yes. And then she disappeared,” said Lopez, now resigned to her investment being lost.

“Here [in El Salvador] the possibilities aren’t great, and I was unemployed in 2017, and things were tough, so I thought I’d invest and let’s just see what happens,” she explained. “The reality is I lost.”

Those sending money by Western Union or credit card must check a box for CryptoMB that they are not U.S. citizens, documents shared with McClatchy and the Miami Herald show.

The whistle-blower described in detail how teams of language-specific sales staff work the phones. The top sellers are assigned to retention teams. Managers warned Milton’s staff not to contact any Americans because they feared that U.S. law enforcement and regulatory bodies would clamp down on their operation, said the whistle-blower, who demanded anonymity for reasons of safety.

Both the U.S. Securities and Exchange Commission and the Federal Trade Commission have been closely watching the nascent digital currency market with an eye toward protecting U.S. consumers.

“If you are trying to explain how the investment works and you can’t explain it to somebody else, I wouldn’t invest in that,” said Christopher Leach, an attorney at the U.S. Federal Trade Commission, which in 2018 banned a similar alleged digital currency marketing scam.

Leach’s advice for consumers: Before investing, do research and check for reviews or complaints posted online, carefully scrutinize unfamiliar products and beware of sellers emphasizing urgency and a quick decision.

For a few dollars more

Milton Group is located in a prestigious, upscale commercial building, the Mandarin Plaza, on Baseina Street in the heart of Kyiv, Ukraine. According to the whistle-blower, Milton also has offices in the former Soviet republic of Georgia and in Albania.

The group gets contact details of potential victims, the whistle-blower said, from fake lotteries or fake money transfers, the black market where information on people is on sale, fake ads on social media sites, or fake games where people are induced to register their names, email IDs and phone numbers.

He said employees on Milton’s “sales” desk then contact these individuals by phone, messaging apps or through social media and offer them fake banking or investment services like CryptoMB, Cryptobase, VetoroBanc and Royal Bank for a minimum of 50 Euros ⁠— around $55.

“Every morning the order was, ‘Get all [the] money you can get from the client. Doesn’t matter which way,’ ” said the whistle-blower.

Managers advise the staffers under them to “keep talking, talking, never stop and never let the people start thinking.”

The whistle-blower explained to reporters that once a “client” is reeled in, Milton staffers produce a detailed profile of them, including information on their profession, age, family, and even dreams and aspirations. These profiles are then transferred over to Milton’s “retention desk,” whose staff are encouraged to squeeze victims down to their last penny.

“The company and what they do ⁠— everything is fake,” said the whistle-blower. “There is no money. Only fake money and fake profits.”

“They push the clients to put more money in … to sell cars, some assets, sometimes people even sell apartments [to] invest in the company.”

According to the whistle-blower, Milton squeezed a Russian woman in 2019 until she lost all of her savings. She was nine months pregnant at the time.

Milton also provides victims with access to an online web application that shows the status of their “investment” ⁠— except Milton staffers can manipulate the displayed data, the whistle-blower said.

Jose Orlando Monegro, who owns a furniture factory and store in La Vega in the Dominican Republic, invested about $1,200 and insists it is worth more than $2,000 ⁠— if he could just get it out.

“According to the web page, I am earning money, but I can’t take anything out. … It’s something I can see, but I can’t take it out,” he said, confirming he has tried to withdraw those phantom earnings with no luck.

Like Monegro, most victims generally discover they were duped when they try to cash out on their investments and are told that they need to invest some more before they can get their money back.

Jonadad Segura, another person on the victims list and an employee at a private university in the Dominican Republic, saw a Facebook ad that appeared to show he could make big winnings fast in digital currencies. He invested $1,000 with the pitch that he’d earn $10,000. When he asked to get it out, he was told he had to pay an apostille ⁠— a 10 percent fee ⁠— which he paid.

“Even then, they said it should be in your account, but it never came to my [bank] account,” he said.

When he followed up, he was told he had to again pay the apostille since the payment did not register before.

Facebook did not respond to multiple requests for comment from McClatchy about fraudulent ads.

Victims are caught in an endless cycle of spending more in the hope of getting returns. For many, those few hundreds of dollars might comprise all of their savings.

“They [the victims] lose their dreams. They lose their lives. They are trying to earn money to maybe help their children, or help themselves. … It was a very painful experience,” said the whistle-blower, recalling his time at Milton.

The sales proceeds from Milton’s office in Kyiv alone approached $71 million in 2019, with most of the money coming from the retention desk, the whistle-blower said.

Wolves of Baseina Street

According to the whistle-blower, staffers on the retention desk frequently joke about their victims and after closing deals refer to them as “their victories.”

In January, Milton held an extravagant New Year’s party attended by its owners and staff. The theme was “The Great Gatsby,” which itself memorialized opulent parties in the 1920s. There were around 700 guests, the whistle-blower said. Valued managers received prizes of money, cars and apartments.

Milton’s CEO, Jacob Keselman, calls himself “The Wolf” ⁠— purportedly after Martin Scorsese’s film “The Wolf of Wall Street” ⁠— on his Instagram profile and has a penchant for luxury cars and foreign holidays.

In a phone interview with McClatchy’s Europe-based reporting partners, Keselman first confirmed that Milton offers investments in CryptoMB, Cryptobase and VetoroBanc, but later said that Milton provides only IT support for these companies.

A secret recording made by the whistle-blower at Milton’s New Year’s party and shared with reporters has a speaker who calls himself “CEO” of Milton refer to a “David” as the “father” of Milton’s operation. The whistle-blower identified the speaker as Keselman.

From photos of attendees at the party, reporting partners were able to identify a David Todua, a 38-year-old Georgian-born Israeli, who also posted a photo of himself with other attendees at the party on his Instagram account. In it, he poses with other attendees in front of a backdrop with the words “Happy New Year! Milton Group.”

The whistle-blower said he has seen Todua in Milton’s Ukraine offices at least six times, including once in November 2019, when he congratulated the staffers for bringing in more than $1 million in investments in October alone for VetoroBanc, one of the brands sold by Milton. That company on its website describes itself as providing global payments processing for foreign currency trading.

Screenshots of the application used by Milton staffers show the movement of cash for VetoroBanc is facilitated by a Cypriot-based firm, Naspay, owned by a “David Todva” since August 2018. In Hebrew, “u” and “v” are sometimes interchangeable.

Naspay is only the software that facilitates the transfer of money and “does not see the nature of the transaction in question and has no ability to control the purpose of the transaction or the brands involved,” Todua said when contacted by McClatchy’s reporting partners.

“If there is any risk or illegal activity involved, it is solely [the] financial institution (or payment institution’s) decision to accept and transmit the payment or to refuse it,” he said.

“I am neither a secret owner nor the founder of Milton Group,” said Todua when contacted by the Organized Crime and Corruption Reporting Project (OCCRP), one of the lead reporting organizations for the Fraud Factory project. “I do not hold any formal or informal position in the mentioned company.

“Moreover, Naspay has not had and currently does not have any legal relationship and/or contractual relationship with Milton Group.”

Todua said that he was invited to Milton’s New Year’s party by Keselman, who has been informally introducing him to “various merchants that needed the gateway software services” of Naspay.

Keselman, however, denied Milton had the party. He also denied knowing Todua.

“I don’t know who is this,” he said repeatedly when pressed. “The owner of Milton is [a] Ukrainian guy.”

Keselman said he is the director of Milton Group and not “owner or CEO.” However, a photo on his Instagram account shows a business card identifying him as CEO.

McClatchy’s Europe-based reporting partners found that on paper, the telemarketing center is owned by a Georgian named Dadivadze Irakli. They were unable to track down any information about him.

Todua said he bought Naspay from a company in the British Virgin Islands represented by a politically connected Georgian named Rati Tchelidze (sometimes spelled Chelidze), who describes himself as a “legal advisor” on his LinkedIn profile.

Documents from the Panamanian law firm Mossack Fonseca, which were leaked to journalists working with the International Consortium of Investigative Journalists in the 2016 Panama Papers, show Tchelidze having powers of attorney and incorporating several offshore firms for David Kezerashvili. He is a former Georgian defense minister who is also listed as co-owner in a construction firm owned by Todua.

Kezerashvili was detained in France in 2013, pending a hearing on extradition to Georgia on corruption charges, but the French court refused to extradite him.

When contacted by McClatchy and its reporting partners, Kezerashvili acknowledged being Todua’s business partner but denied knowing anything about Milton.

“I know nothing of the Milton Group: I had not heard of the company before receipt of your questions,” he said.

McClatchy and its reporting partners did not find any direct link between Milton Group and Kezerashvili.

Big brother is watching you

Milton’s day-to-day functions take place in an atmosphere of surveillance, fear and intimidation, the whistle-blower said.

There were two managers who were fired for asking too many questions. They were then taken to the Russian-aligned part of eastern Ukraine, said the whistle-blower, and since then they have not been seen. In another incident, said the whistle-blower, two managers who had stolen money from the retention desk were put up against a wall in what they thought would be their execution. Instead bullets were fired around their heads to scare them.

All employees also have to leave their phones and sign in before entering. They must sign out when leaving the building. When employees report on their colleagues, they receive money as a reward.

“Everyone is afraid. They’re hiding,” said the whistle-blower. “They understand that it’s a crime, what they do.”

If fear marks the operation, false optimism guides would-be investors.

What apparently allows the enterprise to keep going is the unflagging optimism of mostly poor investors who are hoping to escape their situation with instant riches.

Jose Monegro, the Dominican furniture store owner, is confused but shrugs off his loss as growing pains. He is frustrated but thinks he will be made whole. Despite evidence to the contrary, he speaks about his investment as if it is just temporarily quarantined.

“I was going to virtual meetings … and it looked like things are going well,” he said. “The system is in transition; they say it will be recovering but now it’s been three months. There are people who have been able to get out with their money.”

McClatchy found no one who actually got back their money.

Many have lost hope.

Montero, the single mother, hoped to emigrate to the United States and had been trying to make easy money toward that end. But now she does not know what she can do to recover her lost money.

“They never call,” she said with a heavy sigh. “I don’t even know where to complain.”

This story was reported in collaboration with the Swedish daily, Dagens Nyheter and the investigative nonprofit Organized Crime and Corruption Reporting Project (OCCRP).

This story was originally published March 3, 2020 at 9:00 AM with the headline "How a Ukraine-based boiler room allegedly scams victims worldwide out of millions."