It all started with a simple Google search for the words: "investment opportunity".
On an ordinary June afternoon in 2019, Carina Christine Breunig and her husband, Christoph, registered their details on an online investment platform called Globalix.
Within minutes, the phone rang. A man with a calm, confident voice answered the phone, introducing himself as Adrian Ross, their investment manager. Ross helped Mr. Breunig verify his account as a client, and he initially transferred 250 and 750 euros. Then, much more.
Over the following months, Adrian Ross urged him to make more deposits, telling him that only in this way would he be able to take better, more profitable trading positions. Christoph followed the progress of his investments from his computer, watching the charts climb, profits increase, and bonuses accumulate on the screen – during which time he transferred a total of 995,000 euros to the platform.
Although he was an experienced investor and business owner, Christoph did not know that what appeared before his eyes were not real contracts and that on the other end of the phone line, behind the pseudonym Adrian Ross, was a young Albanian, an operator in a call center in Tirana.
A year later, after a series of failed attempts to withdraw the funds, Christoph realized he had fallen victim to a fraudulent scheme and turned to the police.
The story of the Breuning couple from the Aschaffenburg area, a city about 40 kilometers east of Frankfurt on the northwestern edge of the German state of Bavaria, is not isolated. Cybercrime police authorities in Bavaria received a dozen similar reports between 2019 and 2021 from citizens defrauded by at least five online investment platforms.
Further investigations revealed that behind the platforms was a structured criminal group operating through several call centers in Israel, Serbia, and Albania – called “Blue Energy Call”.
While victims also ranged from Greece to the United Kingdom, in Germany alone this fraudulent scheme, based on reported cases, has caused millions of euros in financial damage to 105 individuals. However, German prosecutors believe that the number of cases unreported by victims is considerable and the value of the damage worldwide is much higher.
The Bavarian Central Office for the Prosecution of Cybercrimes has been monitoring this fraudulent industry and its development for several years, especially since 2019. The office's senior public prosecutor, Dr. Nino Goldbeck, told BIRN that despite some successes in investigations and operations over the past few years, the situation remains critical.
"Fraudulent online investment platforms continue to constitute a lucrative market, where not one or two, but several organized crime groups cause huge damage not only in Germany, but also in many other European countries," he said.
According to Goldbeck, it is difficult to calculate the exact amount of damage, but in Germany alone it amounts to hundreds of millions of euros each year.
"In Bavaria, losses exceed 100 million euros per year – and that's just from reported cases," he stressed in a written response.
Global threat
In an interconnected and digitalized world, fraud through investment schemes is one of the most widespread forms of financial crime.
According to Interpol, between 2022 and 2023, 85% of international arrest notices (red notices) were related to fraud cases, and in 2023 alone, the Corruption and Financial Crime Center supported more than 700 investigations into fraud cases worth $1.2 billion (€1 billion). One of the two main forms of fraud was through fake investments.
The perpetrators of these schemes use various tactics to manipulate victims – from promises of large profits to creating a sense of urgency to invest, and in some cases, they can take the form of 'Ponzi' or pyramid schemes.
They recruit their victims through advertisements on social networks, fraudulent websites and applications, as well as through telemarketing from call centers, where operators make unauthorized calls and exert psychological pressure or use manipulative social engineering techniques on victims to encourage them to invest in fraudulent financial schemes.
The widespread use of cryptocurrencies has also created new spaces for criminal groups involved in crime schemes financed through fraudulent investments.
According to prosecutor Nino Goldbeck, the most important step for fraudsters is to obtain contact details of people interested in investing in trading platforms, which are collected mainly through large advertising campaigns developed by specialized marketing companies on social networks.
"Companies place deceptive or manipulated ads on social networks like Facebook, on news sites or other platforms," he said.
Goldbeck pointed out that one of the most commonly used tactics is the use of ads that claim that the platforms have been recommended on popular television shows or by public figures.
Over the last five years, Tirana, with its polyglot and relatively young population, has become an important hub for call centers serving fraudulent schemes.
Although dozens of police operations have been undertaken to disrupt their activity, successful investigations can be counted on the fingers of one hand, and have been recorded mainly by the Special Structure Against Organized Crime and Corruption (SPAK), as part of joint investigative groups coordinated by Eurojust and Europol.
Modus operandi
Fraudulent schemes are often camouflaged as real businesses, while operators use language similar to investment advisors to manipulate their victims.
Located on the second and third floors of the Condor Center on Kavaja Street in Tirana, “Blue Energy Call” looked at first glance like any other telemarketing company, with long rows of desks where dozens of operators made calls in foreign languages to various clients outside Albania.
But according to German investigators from the Bamberg General Prosecutor's Office, behind the facade was a structured criminal group, which through 'cybertrading' platforms deceived ordinary people throughout Europe.
On March 16, 2022, around 50 Albanian police officers, 11 officers from the Bayreuth Criminal Investigation Department and the Upper Franconia Criminal Investigation Department in Germany, as well as a prosecutor from the Bavarian Central Office for Cybercrime, led by their Albanian colleagues from SPAK and coordinated by Eurojust, raided the company's offices in Tirana, as well as an IT company.
Investigators verified dozens of people and investigated their connections to the criminal organization. In many cases, the handcuffs creaked. Among the 15 arrested were two of the suspected main organizers of the scheme – Erion Kasmi and Xhulian Xhafa. According to prosecutors, Kasmi was the 'de facto' manager of the call center "Blue Energy Call" and the IT company 'Cleartech' shpk, while Xhafa was in charge of managing the computer network, for which he used the program Deepfreeze to delete evidence.
To preserve the digital evidence of the crime, eight specialists traveled from Bayreuth to Albania, specifically to take measures for scientific expertise. They used the advanced 'Paladin' laboratory and seized computers, servers and smartphones.
According to Fabian Zhillés, a cybercrime expert with the Global Initiative Against Transnational Organized Crime, this was one of the most critical moments of the investigation, as digital evidence can be deleted with a click.
“Storing digital data requires extraordinary speed and a high level of investigative secrecy, because it is very easy to damage,” Zhilla told BIRN.
“Blue Energy Call” used the Panda TS system, a software program produced by an Israeli company for Forex and CFD (contracts for financial derivatives) brokers. Panda TS is a ‘white-label’ trading platform that can be customized with different logos, colors and names, such as Globalix and Brokerz.
Asked by BIRN, Panda Trading Systems did not respond to an emailed request for comment.
In addition to the Globalix and Brokerz platforms, the company "Blue Energy Call" has also used other websites, which, according to Xhulian Xhafa, "were opened and closed for 6 months or a year maximum," after receiving negative reports on the internet and losing credibility.
According to him, the numbers of the defrauded European citizens were taken from the Panda CRM system, which was managed by Israeli citizens, who communicated mainly with Erion Kasmin. According to Xhafa, the system was set up by citizens from Israel and “banking data or other movements were managed by them.”
Victims were often manipulated into downloading the 'Anydesk' program, giving the scammers access to their computers.
Arben Gramo, an Albanian lawyer who represents some of the victims in the criminal case against Blue Energy Call, including the Breuning couple, told BIRN that the form of fraud used by Kasmi and his agents was sophisticated.
"This used to be done by phone calls – 'Hello, hello, I'm Leonardo DiCaprio,'" he said with a slight smile, referring to the popular film The Wolf of Wall Street, in which the Hollywood actor portrays Jordan Belfort, an American broker who manipulated ordinary citizens over the phone to convince them to buy worthless stocks.
According to Gramos, modern forms of fraud have evolved beyond the "oratory" of fraudulent brokers - a method that is now considered outdated, using sophisticated programs that create a false reality for the victim.
“This way is a little old-fashioned today and they don't trust it anymore,” he explained. “But when people see their name on the screen, put it in the computer and hear: 'look where you are here, look how the values move,' they start to trust it.”
"Here lies the deception," Gramo emphasized.
In March 2025, the Central Cybercrime Office in Bavaria also filed charges against a 42-year-old Israeli national, who is considered the mastermind of this scheme. The suspect, believed to have been one of the main managers of the criminal group, was arrested in Cyprus in July 2024 and later extradited to Germany. He has been charged with 6 counts of fraud as part of a criminal group.
In July 2024, the Special Court of First Instance Against Organized Crime and Corruption in Tirana sentenced Erion Kasmi to 11 years in prison and Xhulian Xhafa to 10 years, for computer fraud as part of a structured criminal group, while 11 other defendants were acquitted. The court also ordered the seizure of dozens of properties and bank accounts, but in April 2025, the Special Court of Appeal decided to return the case for a retrial to the first instance.
Human cost
Due to the nature of the crime of fraud, the global number of victims is difficult to estimate.
In the United Kingdom, for example, while a significant number report fraud to their bank, hoping to get their money back, only 5% report it to the police.
Simon Miller, executive director for Policy, Communications and Strategy at CIFAS, an organization that provides fraud prevention services in the United Kingdom, explained that reporting is not an easy step for people who have fallen victim to fraud.
“There’s a sense of shame that goes with being a victim of a fraud crime,” he said. “We talk about people who are victims and there’s always, I think, an implicit assumption that they’ve been greedy or stupid, which creates this sense of shame around reporting,” Miller explained.
According to him, in the UK alone there are 43 different police forces that have responsibility for dealing with fraud and people often don't know where to report it.
"The impact of fraud on individuals is significant, even when it comes to small schemes," he stressed, adding that in many cases victims lose not only their life savings, but also the trust in society.
"Statistics show a surprising number of people taking their own lives as a result of fraud," Miller added.
Nino Goldbeck, public prosecutor in Bavaria, confirmed that authorities in Germany have faced cases where victims of fraudulent schemes have sacrificed themselves, while many of them have ruined pension funds or taken out loans to make investments.
“It is very important to emphasize that the money invested and lost is not simply ‘gambling money’ for the victims,” he said. “Of course, there are also wealthy victims who manage to cope with the financial loss, but for the majority, it is life savings that have disappeared,” he added.
Miller emphasized that it should not be forgotten that often, the perpetrators of these schemes are also victims, as they are forced to commit fraud in conditions similar to slavery - especially in Southeast Asia and West Africa.
This is not the Albanian case, but that does not mean that young people in Albania involved in fraudulent schemes do not also suffer consequences.
"High salaries cause [young people] to be recruited initially without knowing the process well, and then, as if 'trapped', they are faced with two choices - leaving a good salary or continuing while turning a blind eye to what they are doing," said criminologist Fabian Zhilla.
"The biggest problem with this type of criminal activity is the criminalization of young people at a very early age," he added.
400 euros every minute
“Blue Energy Call” is just one of dozens of call centers cracked down on by Albanian police since 2021. Data collected from State Police reports list dozens of operations and arrests. However, data collected by BIRN through Freedom of Information requests shows that the cases sent for trial by the Prosecution were several times smaller in number.
Most of them belong to SPAK.
The Special Prosecution Office told BIRN that in 2024 there were 11 cases under investigation for fraud through call centers as part of structured criminal groups, and during the years 2021-2024 it had sent four criminal cases for trial.
One of the most high-profile cases investigated by SPAK is related to the so-called Milton Group – a criminal organization with activity in Albania, North Macedonia, Ukraine and Georgia.
According to data collected by a joint investigative group, composed of SPAK and the judicial authorities of Spain, Germany, Sweden, Finland, Latvia, Ukraine, Georgia and North Macedonia, coordinated by Eurojust, this criminal organization was responsible for dozens of fraudulent platforms, active over the past few years.
In a joint operation in September 2022 against Milton Group, coordinated simultaneously in 10 countries, SPAK arrested 4 people and conducted checks on 15 call centers.
According to Fabian Zhilla, the fact that these criminal groups operate from different jurisdictions makes investigative work difficult and complex.
“The server that holds the platform data could be in a jurisdiction where you have no cooperation at all,” he said. “It could be in a foreign language, where you have to prepare specific requests or form joint investigative teams,” he added, noting that “they could also be war zones or authoritarian countries.”
In Spain alone, this criminal organization is suspected of causing more than 50 million euros in financial damage to victims every three months, or 400 euros per minute. According to Spanish investigative authorities, the number of victims reaches 17 thousand, and from the beginning of the investigation in 2018 until the organization was cracked down on in 2022, it is estimated that it may have benefited from 2.4 billion euros.
The damage caused in Spain may be just the tip of a giant iceberg. According to data presented by Spanish authorities in a letter of request sent to Albania on this issue, the potential victims across Europe are estimated at 235 thousand, of which the largest number is suspected to be in Germany (82,533).
Of the 173 fraud reports investigated by prosecutors in Bavaria, the damage caused by 5 fraudulent platforms linked to this criminal group is estimated at 6.1 million euros. In addition to the Bavarian region where these victims are registered, many other public prosecutors in Germany also have complaints about others being harmed on these platforms, so the total damage is assumed to be much higher. According to German prosecutors, the damage is estimated at more than 100 million euros.
One of the key figures in this criminal group in Albania was Amant Josifi, a former advisor to the Ministry of Defense, who fled to Dubai.
Josifi controlled several call center companies in Albania, with 200-300 employees, which used social engineering methods to scam victims throughout Europe.
SPAK has seized around 2.2 million euros in the bank accounts of Josif and his relatives, while Spanish and Albanian authorities have issued arrest warrants.
Operation "Pandora"
When a woman tried to withdraw 100,000 euros in cash from a bank in the German city of Freiburg on December 19, 2023, the teller became suspicious and later realized that the customer had fallen victim to a “fake policeman scam.” He notified the real police, who stopped the victim from handing over the money to the fraudsters.
Instead of receiving the large sum of money, the criminals sent to collect the money in cash were arrested by Freiburg Police officers, while the phone numbers used to commit the fraud were put under wiretapping. During the investigation of this case, investigators quickly realized that the phone numbers used by the perpetrators could be linked to over 28,000 fraudulent calls within 48 hours.
As the investigation expanded, it was transferred to the Baden-Württemberg State Criminal Police Office, which was supported throughout the operation by the Federal Criminal Police Office. Initial findings showed that the perpetrators, located in different countries, were carrying out all forms of telephone fraud.
The scammers posed as close relatives, bank employees, customer service agents, or police officers. Using a variety of manipulation tactics, they shocked and deceived victims into taking their savings.
From false promises of lottery winnings, investment opportunities, debt settlement requests, prepaid card scams, to “buddy calls,” scammers relentlessly targeted their future victims.
The calls came from call centers in different countries. Debt collection scams were mainly carried out from Bosnia and Herzegovina, 'online banking' scams came from Kosovo. Investment scams mainly called from Albania, while perpetrators specializing in prepaid card fraud operated from offices in Lebanon.
To prevent scams through call centers, the Baden-Württemberg State Police opened its own call center with dozens of police officers, who listened to fraudulent calls and warned victims.
“The idea was to prevent all these crimes and at the same time conduct investigations against call centers,” said Oliver Hoffman, head of the Economic Crime and Corruption Department at the Baden-Württemberg police.
“We started with 30 officers preventing crimes and then we expanded the structure, a call center of our own, a counter-call center with police,” he added in an interview with BIRN.
This was the starting point of Operation Pandora, one of the largest crackdowns against cyber fraud schemes in Europe.
From December 2023 onwards, the call centre grew to 100 police officers, working in shifts and intercepting more than 1.3 million fraudulent calls. When officers realised someone might be falling for a scam, they would contact them to prevent the crime.
In total, the police call center intercepted around 7,500 calls that constituted a criminal offense during a 4-month period, preventing 80% of crimes worth an estimated 10 million euros.
According to Commissioner Hoffman, the value of this operation lies not only in preventing damage, but also in the information that was collected on the different fraud tactics, identifying eight different forms for which public awareness campaigns were prepared.
By the end of the investigation, authorities had identified over 700 people who had served as operators in the scams. Many of them lasted only a day, failing to convince victims, and were quickly replaced by others. Over time, each developed their own methodology for targeting people over the phone.
“It was like a treasure trove, because we've never had anything like this, thousands of phone calls, and we could figure out what their script was,” Hoffman said.
"It also means the moment when the tendency to hand over or send money appears, and it is at that very moment that we intervene, – not in the same conversation, but by calling the victim on a different number and informing them to stop, because it is a scam," he added.
Anatomy of deception
Before the Baden-Württemberg police could intervene and intercept fraudulent phone calls from call centers in Albania and other countries, investigators were first faced with the question of how they would carry out the operation.
Once the strategy was defined, they spent weeks analyzing the technical infrastructure to understand how calls were transferred over the internet, server connections, and the entire support network.
"To put such a scheme into operation, you need a trading platform, a call center, and then managers - people who recruit staff, sign contracts, and administer the entire process," Hoffman explained.
He added that during Operation Pandora, for the first time investigators had a full picture of these fraudulent schemes, revealing that the percentage of successful calls was very low.
“It takes about 200 calls to have one successful call, one case where they manage to scam someone,” he said. “So the success rate is about 0.5 percent,” Hoffman added.
Hoffman explained that setting up a fraud scheme doesn't necessarily require a large investment or sophisticated knowledge. "Basically, you just need to understand how the system works and have lists of 'clients,'" he said. The rest, such as technical infrastructure and software, can be purchased at low cost, while basic equipment and an internet contract are enough to get started.
He stressed that the investigations conducted as part of the operation gave authorities a clear picture that shows that these networks know no borders. In the past, call centers operated with dozens or hundreds of people in a single room; today, the schemes operate from apartments with 3 to 5 people in front of a computer.
“At the top of this enterprise are usually those who provide the platforms and software, while on the side they have their own money laundering networks,” Hoffman said. “This [structure] follows the 'crime as a service' model,” he added.
In the case of Operation Pandora, these services were provided by a 50-year-old Greek woman living in Hagen, who was arrested in February 2025, and is considered the leader of the network in Germany.
The defendant is accused of having entered into contracts with German telephone providers, providing sufficient telephone capacity for the commission of fraudulent acts, as well as for opening accounts for the transfer of illegally obtained income.
She is suspected of having set up fictitious companies with the help of "front" persons, signed telephone contracts in the name of these companies, paid overdue bills, and filed complaints in the event of service interruptions.
Using this infrastructure, telephone scammers have made a large number of fraudulent calls to Germany, Austria, Switzerland and other EU countries.
The Baden-Württemberg State Crime Office estimates that damage of around 1.35 million euros was caused through the infrastructure created by the arrested suspect alone.
According to investigators, the woman acted almost anonymously. She had been extremely careful, and it took an in-depth investigation that lasted almost a year to identify her as the main person responsible for organizing the entire scheme.
“She didn’t work anywhere else,” Hoffman said. “She was living on welfare in Germany, receiving about 500 euros a month from the state – from us, actually, and she devoted her time to this activity.”
Asked if this was a perfect cover for the scheme's organizer, the German policeman responded with irony.
“To some extent, yes, but it didn’t work out for him,” he said. “Now it’s up to the court.”/BIRN/
