Marcel Deschamps was on the edge of despair.
The factory foreman from Alexandria, Ont., a small community between Ottawa and Montreal, had lost his savings in a crypto investment scam. He had reported it to the Ontario Provincial Police, but investigators hit a wall.
Beset by suicidal thoughts, Deschamps clung to the hope that someone could help him recover his funds.
Then, in February 2024, someone presenting themselves as a cryptocurrency expert named Mary Roberts reached Deschamps by phone, told him she had found the scammers who took his $200,000 and assured him she could get it back.
She told Deschamps he was on a watchlist because he’d given money to fraudsters and would need to transfer $3,500 into a crypto wallet to prove he was a legitimate investor. She promised “it’s 110 per cent that I’m going to find that money and I’m going to send it to you.”
In reality, “Mary Roberts” was yet another scammer, and had pirated the identity of a real financial adviser.
In fact, as an investigation by Radio-Canada’s investigative show Enquête and partner media outlets found, she’s part of a fraud empire that has left millions of victims, in Canada and elsewhere, on the brink of financial ruin.
The scammers typically ply their schemes from abroad with impunity, as domestic police investigators struggle even to identify them, let alone bring them to justice.
But thanks to a massive leak of records — which reveals in an unprecedented way the internal workings of the scammers — Radio-Canada and a global team of journalists have been able to track them down.
$275 million stolen
Last year, journalists at Swedish public broadcaster SVT got a big scoop, when a confidential source leaked them nearly two terabytes of internal records from two phone-scam call centres. One of the call centres is in Tbilisi, the capital of Georgia, and the other is spread across Israel, Spain, Cyprus, Ukraine and Bulgaria.
SVT shared the files with the Organized Crime and Corruption Reporting Project, a global network of investigative journalists, as well as Radio-Canada and more than 30 other media outlets.
The leaked documents show that the two scam networks have defrauded at least 32,000 victims out of more than $275 million US, with the thieves operating like any well-oiled big business: human resources departments, IT support teams and bespoke customer-relationship management software for tracking victims.
Among the leaked files are audio recordings of more than one million calls to victims and nearly 20,000 video captures of the scammers’ computer screens — recordings that were made so the scam networks could keep an eye on their employees and sharpen their skills at ensnaring their marks.
The confidential source who leaked the files said they did it because these kinds of crimes are almost never solved, due to the logistical and jurisdictional hurdles of cross-border investigations.
“Without real international change, this will never go away,” they said.
Phony news article
Deschamps, 59, was initially baited by what he thought looked like a genuine news article posted on Facebook, where Canadian celebrity investor Kevin O’Leary was singing the praises of something called Quantum AI.
The report presented Quantum AI as an investment system purportedly financed by Tesla CEO Elon Musk where a modest $250 US put into cryptocurrency could grow to many times that, using artificial intelligence.
But it was totally fake.
Similar fake news articles copy the look of websites such as CBC News or CTV News and feature photos of personalities like Prime Minister Justin Trudeau or actress Sandra Oh.
Teams of advertisers, separate from the scammers in Europe and Asia, come up with the fake articles and buy ad space for them on Facebook, Instagram and X. Then, when people click on the posts and provide their names and phone numbers, the advertisers forward the contact info to the call-centre scammers for a fee — up to $1,350 US in the case of Canadian victims who make the initial $250 US cryptocurrency “investment.”
According to documents in the leak, one of the fraud call centres pays hundreds of thousands of dollars a year to the fake-article creators, who in turn pay Facebook and other social media platforms to carry their posts.
“Facebook and any other companies who are publicizing those fake ads or letting them use their media, they are really responsible for letting it happen, too,” Deschamps said.
Facebook’s parent company, Meta, has a policy that prohibits ads that “promote products, services, schemes or offers that use identified deceptive or misleading practices, including scams to take money from people or access personal information.” But the fake articles are still being published.
Meta has announced it is testing facial-recognition technology in a bid to crack down on fraudulent ads that exploit the images of celebrities.
Scammers pose as CRA agents
People who click on the Facebook ads and submit their phone number typically get a call within minutes.
A scammer on the other end sets up the victim with an account on what appears to be an investment software platform, but it’s actually controlled by the fraudsters, who manipulate it to create the illusion of big profits in crypto, stock trading and currency exchange — enticing victims to invest more.
When someone goes to cash out, problems begin.
“When you try to do a withdrawal, it’s always impossible to do, because there’s always charges. More charges and more charges,” Deschamps said. “You never get it back.”
Victims are told there are technical difficulties and they need to make another interim payment to unblock their money.
Then, a second group of fraudsters working for the same scam call centre calls victims, posing as employees of the Canada Revenue Agency, the Financial Consumer Agency of Canada or other organizations, saying they can help recover the victim’s stolen funds.
In Deschamps’s case, when he clicked on the fake Facebook article and sent his info to the scammers, they enticed him to make crypto investments, but also realized he had previously been the victim of a crypto fraud, and promised that their AI system could help them locate and retrieve his missing funds.
Canadians a top target
Canadians are a favoured target, the leaked records reveal.
Canada was the No. 2 country most often called by the Georgian scam organization (after Great Britain), accounting for nearly one in five calls.
For the other scam network, based in Israel and Europe, Canada ranked first, with more than 8,000 victims, far ahead of Spain, Australia or Britain.
Many Canadians have self-managed retirement savings such as RRSPs or TFSAs, making them an attractive target for fraudsters, according to Benoît Dupont, a criminologist and Canada research chair in cybersecurity at the University of Montreal.
He said criminals also don’t have much to fear from Canadian law enforcement.
“The authorities here don’t give the impression they’re doing much,” Dupont said.
Radio-Canada identified more than 30 of the hundreds of Canadians targeted by the Georgian scammers and analyzed more than 1,600 calls — that’s 400-plus hours of audio — between victims and swindlers.
Marcel Deschamps’s calls with “Mary Roberts” were among them.
In the calls, she presents herself as an expert in crypto investments who’s registered with regulatory authorities. An actual financial adviser named Mary Ann Roberts is indeed registered with the Financial Industry Regulatory Authority, the U.S. organization that oversees stockbrokers and brokerages.
The fake Mary Roberts tells Deschamps she’s based in London, which squares with the country code that appeared on his caller ID. In order to reassure him, she sends him photos purportedly of her passport, some of her work colleagues and of herself relaxed and smiling.
“She had a sweet voice. And she was trying to be very friendly,” Deschamps recalled. “I trusted her. She sounded very convincing.”
After each call, the scammers would write up detailed notes in their victim database.
“Mary” wrote this on Deschamps’s file, sharing it with the other employees at the call centre: “He started to love me / had a two hour conversation / cb [call back] on Monday 11 our time / asked for 10K CAD.”
‘I can scam whoever I want’
Deschamps eventually realized he had once again been conned, and confronted his scammer in an icy phone exchange where she dropped her ruse.
Marcel Deschamps of Alexandria, Ont., victim of an international call-centre fraud, confronts one of the scammers who swindled him.
“I can scam whoever I want and it’s not your [expletive] business! Your life is ruined,” she tells him.
When Deschamps tells her he’ll go to the police, she erupts in laughter.
“You’re so stupid. Even if you are going to call the police of Canada, police of Quebec, police of Alberta, police of Calgary, police of Ontario and the police of the entire world, you will never find my real passport. You’re [expletive] dumb!”
The photo of a passport she had sent to Deschamps was faked; it used an Instagram pic of someone else for the headshot and was concocted by an online service that costs $8.99 US.
But “Mary” didn’t count on the investigative ingenuity of some Georgian-based journalists.
Master scammer
The Georgian-based fraud ring revealed in the leaked records is run by an organization called the A.K. Group. At least 85 people work out of its offices in downtown Tbilisi.
According to the leaked documents, the fraud network’s best scam artists can pull in $20,000 US a month. Top performers get prizes like iPhones and even the occasional BMW; Mary Roberts is one of their best.
The organization’s rules strictly forbid employees from mentioning their real names to colleagues or victims. But in internal company chats found amid the leaked files, employees sometimes get careless and leave clues — which permitted a group of Georgian journalists to identify several of the scammers, including Mary Roberts.
Her real name is Mariam Charchian. Her Facebook account shows she comes from modest roots, but her life suddenly saw a big change for the better two years ago, with trips to Paris, Dubai and Milan and visits to high-end boutiques. Her Instagram account has a photo of a diamond-studded Cartier bracelet, accompanied by the comment, “Dream shopping done.”
While Mary Roberts taunted Deschamps that “you will never find my real passport,” there was actually a photo of it on Charchian’s Facebook account.
Shown the social media posts and the evidence of Mary Roberts’s true identity, Deschamps said it’s “really, really maddening” to see her living a life of luxury with his money and that of other victims.
Scammer group goes dark
After learning all this, Deschamps recently called Mariam Charchian on her personal cellphone, with Radio-Canada’s cameras rolling.
“Hey Mariam, how are you doing? It’s Marcel… You told me I could never find you.”
He asked her if she’s told her family what she does for a living.
“Marcel? No, I don’t remember you,” Charchian replied.
“Are you Mariam Charchian or are you Mary Roberts?” Deschamps asked.
Charchian hung up. Deschamps let out a little squeal of joy — he had taken some revenge.
“It’s it’s fun to be on the other side table for once…. What she did to me, I know she’s doing it to everybody else in the world,” he said. “Hopefully, it’s going to stop soon.”
Neither Charchian nor any of her co-workers or bosses replied to questions from the OCCRP and its partner media outlets.
On Tuesday, Charchian shut down her Facebook account, as did a number of her colleagues.
The A.K. Group’s offices in Tbilisi, Georgia, were dark when journalists visited earlier this week. No one appeared to be there anymore.
Georgian state prosecutors told the OCCRP they were looking into the A.K. Group after receiving inquiries from journalists.
“In case of detection of any criminal activity, it will respond in accordance with Georgian legislation,” the office said in a brief statement.
