X.com Facebook E-Mail X.com Facebook E-Mail Messenger WhatsApp It all begins with a seemingly harmless ad on Facebook. "Free stock tips via WhatsApp,” reads Mia Hofer on her smartphone. Above it is the logo of a popular German neobroker called Trade Republic. The ad appeals to her. Hofer had already been thinking about learning more about investing. She clicks on the ad and ends up in a WhatsApp group. The article you are reading originally appeared in German in issue 50/2025 (December 5th, 2025) of DER SPIEGEL. Mia Hofer – not her real name – is 42 and works as a retail sales clerk near Wiesbaden. She prefers to remain anonymous to protect her privacy. One Friday in mid-March, a woman named Laura contacts her on WhatsApp. She introduces herself as the assistant to a renowned hedge fund manager, "Professor” Monroe Trout. She and the professor, Laura says, work for the U.S. financial institution Stifel. Hofer googles the names: Everything seems legitimate. The professor really exists, and Stifel has an office in Frankfurt am Main, the German financial capital not far from Wiesbaden. She decides to pursue the contact and waits for more messages from Laura, the friendly assistant – and for the professor’s stock tips. Victim Mia Hofer Foto: Felix Schmitt / DER SPIEGEL Before long, a friendly rapport begins to develop. "Good morning,” writes Laura. "I really need a coffee, or my eyes are going to fall closed again.” The two women talk about Hofer’s daily life, her worries – and her wish to build a nest egg. "When we make the dream come true, cocktails are on me,” Hofer types. Laura replies: "Then I’ll go ahead and start picking out cocktail glasses and paper umbrellas.” Then, the first investment tips begin arriving. Hofer downloads an app called STLSTE to her phone, as recommended by Laura, and then she begins investing – a few thousand euros at first, then more. On her screen, her supposed profits skyrocket. It’s only when Hofer tries to withdraw those dreamlike gains, and Laura suddenly demands another payment, that she realizes something is wrong. Hofer, as it turned out, had fallen for a financial scam. In reality, Stifel runs no WhatsApp group for private clients, and the investor Monroe Trout has nothing to do with the fraud. Indeed, at no point did Hofer actually trade any stocks. All she did was wire money to the scammers. Around €20,000. She is just one of several tens of thousands of people who fall victim each year to a global, multibillion-dollar scam industry. In 2024 alone, online scammers stole more than $1 trillion worldwide, according to calculations by the nongovernmental organization Global Anti-Scam Alliance, based in The Hague. DER SPIEGEL followed the trail of the stolen money, reviewed chat logs and scrutinized suspicious trading platforms and bank transactions. The reporting team uncovered a sprawling network – and a scam operation in Myanmar, where armies of fraudsters sit in large, open-plan offices with smartphones and computers. Their mission: to contact internet users around the world and extract as much money as possible. What has received little attention until now: Many of those working inside these scam centers do so under coercion. Many of the perpetrators are also victims. As DER SPIEGEL has learned, German law enforcement believes that organized crime groups from China are often behind these scam factories. To keep their business running, such groups even resort to human trafficking. According to United Nations estimates, criminal networks have trafficked hundreds of thousands of people to Southeast Asia to work in these illegal complexes. One of those forced into crime is Phelipe de Moura Ferreira. He spent three months working in a blue office building on a river marking the border with Thailand. Through WhatsApp, Ferreira chatted in English with people across the world. Using translation software and ChatGPT, his office was able to target victims in France, Ukraine, Germany and elsewhere. He cheated his marks out of large sums of money – against his will. Ferreira was being held captive. The 27-year-old is from São Paulo, Brazil. In November 2024, as he recounted to DER SPIEGEL, he received a job offer via the chat app Telegram – a call center position in Thailand. It offered flexible hours, $2,000 per month, plus an airline ticket. For someone like him who came from a poor background, it sounded tempting. Phelipe de Moura Ferreira was forced into scamming after responding to an ad for a call center position in Thailand. Foto: Victor Moriyama / DER SPIEGEL "Myanmar is my hell." Phelipe de Moura Ferreira But when Ferreira landed in Bangkok, an armed driver was waiting for him, he recalls. The driver did not take him to the promised company site nearby but instead drove him across the border into neighboring Myanmar, a country shattered by civil war. There, in a walled compound south of the town of Myawaddy, Ferreira’s passport and cell phone were taken away, he says. He then lived like a prisoner. "There were eight people sleeping in my room,” he recounts. "It was very dirty and the building was cold and it had many guards." He was told to carry out scams for the "bosses,” as Ferreira calls them. The facility, he says, was divided into large office spaces, each focusing on a different type of financial fraud. In Ferreira’s department, which he estimates consisted of several hundred people, the focus was on so-called "love scams.” They would build up hopes of romantic relationships, only to later coax large sums of money from victims. The office next door specialized in crypto trading. Those who refused to work or failed to produce results were punished, Ferreira says. With electric shocks, with whippings. When one captive tried to contact his family online, he was caught, Ferreira recounts: "They locked him in a black room for several days and beat him every day." It is not possible to independently verify his detailed accounts. A photo of a scam center being shown on a smartphone. Foto: Lauren Decicca / The New York Times / Redux / laif Despite the intimidation, Ferreira took the risk of contacting his father through Facebook. "I wrote that I needed help. That I wasn’t in Thailand but in Myanmar. That we were punished everyday and it's not legal work." Ferreira’s father contacted Brazilian police, who put him in touch with The Exodus Road, an international non-governmental organization that combats human trafficking. "We provided all available information about them" to local authorities "so they could take the necessary steps" to facilitate a rescue, says Cintia Meirelles de Azevedo, the organization’s country director for Brazil. She says that negotiations then took place with the operators of the scam factory, who are thought to be linked to the Chinese mafia. De Azevedo confirms that Ferreira was held captive in the complex and forced to carry out scams. She and her organization made it possible for DER SPIEGEL to establish contact with him. Ultimately, more than 300 captives from the scam factory were freed, including Ferreira. Today he is back in São Paulo, living with his parents and two siblings. "Myanmar is my hell,” he says. People rescued from scam centers in Myanmar arriving at the Thailand border. Foto: Somrerk Kosolwitthayanant / EPA Scam factory "KK Park" in Myanmar. Foto: Lillian Suwanrumpha / AFP Whether the authorities have actually dismantled the criminal network Ferreira was forced to work for remains uncertain. When one factory closes down, another may emerge elsewhere. Scammers are also hard to stop because tech companies continue to provide them with a digital infrastructure. The bait offered by scammers frequently appears on platforms such as Facebook or Instagram. Fraudulent ads on the social media networks owned by Meta have "increased significantly” since early 2025, Trade Republic told DER SPIEGEL. The financial services provider says it reports between 10,000 and 20,000 fraudulent ads per month to Meta, which it holds partly responsible. Meta left DER SPIEGEL’s questions unanswered. A spokesperson merely emphasized that the company removes all fraudulent ads with the help of "advanced technology and trained review teams” as soon as they are detected. Meta apparently profits from the fraudulent advertising. According to an analysis of internal documents conducted by the news agency Reuters, such revenues amounted to $16 billion last year. Enjoying our international coverage? In "SPIEGEL – The German View" on Substack, we offer even more in depth, independent and deeply reported insights into how Germany sees the U.S., global crises, and the future of democracy. And if you subscribe on Substack, you get early access! Get it delivered straight to your inbox or follow us on Substack. And it’s not just Facebook that has been flooded with such scam ads. Fraudulent promotional content even shows up on serious news sites. DER SPIEGEL has also been affected. The core of the fraud, however, lies in fake trading platforms, complete with websites and apps that are designed so professionally that not everyone can recognize them for what they are. No real stock trading takes place on these sites. Account balances and purported earnings are simply typed in by the scammers. Authorities say they are currently registering a veritable flood of fake platforms online. Germany’s Federal Financial Supervisory Authority (BaFin) specifically monitors such fraudulent sites and issues warnings about "unauthorized business activities.” DER SPIEGEL took a closer look at the warnings issued by BaFin in recent years: In all of 2024, the agency identified around 760 suspicious sites, but by the end of November 2025, the total for the year had already exceeded 2,400, more than three times as many. Some of the agency’s warning lists contain hundreds of links to near-identical websites running the same scam schemes. Senior prosecutor Mirko Heim of the Cybercrime Center in Baden-Württemberg says thousands of such sites now go live each year, causing billions in damages in Germany alone. The use of artificial intelligence allows scammers to generate new fraudulent platforms "as if on an assembly line,” BaFin said in response to a query from DER SPIEGEL. With minimal effort, scammers can reach ever more potential victims, in addition to tying up investigators’ limited resources. Does the financial watchdog have a realistic chance to stop them? At the very least, BaFin can make it harder for scammers to spread their content. It can order German providers to shut down fraudulent websites, for example. The authority is also empowered to freeze accounts and block funds held in domestic banks. Criminal prosecution, though, remains the judiciary’s domain, and BaFin cooperates closely with prosecutors. In October, for instance, the financial regulator, together with the Cybercrime Center and the State Criminal Police Office in Baden-Württemberg, shut down 1,400 fraudulent trading websites. Things grow more complicated, however, when the fraud is carried out not via browser-based websites but through apps that customers can install from official marketplaces such as Apple’s App Store or Google Play. The trick works as follows: Scammers take over apps already listed in Google Play that originally offered completely different content. For the scam app STLSTE, DER SPIEGEL identified two app versions that had previously been listed as music apps. Evidence suggests that fraudsters were able to buy such app shells before then changing their logos, names and content. To understand how scam apps can end up in these supposedly secure stores, DER SPIEGEL followed the digital footprints of the STLSTE scheme. The result was a complex network of at least 26 fraudulent trading platforms and apps. Some showed links suggesting they used developer tools and cloud storage providers from China. Authorities face significant hurdles in fighting such networks. It often takes weeks for fraudulent apps to disappear from Google’s Play Store following a BaFin warning, and even then, the deletions may be incomplete. Google did not immediately remove all of the STLSTE network’s apps. Several remained available for download despite clear indicators such as identical developer names or email addresses. In a written statement, Google said that it "consistently takes action against applications that violate our policies.” The company said it blocked the publication of 2.36 million apps in 2024 alone for policy violations and suspended more than 158,000 accounts belonging to malicious developers. Beginning in 2026, all Android apps will have to be registered by verified developers. It is an ongoing race between law enforcement agencies with limited resources and well-organized scammers constantly inventing new methods. The key question, though, is: Where does the stolen money end up? Mia Hofer, the victim from near Wiesbaden, has created a WhatsApp group allowing several dozen victims to share experiences. A few months ago, she reached out to DER SPIEGEL to tell her story. Hofer says that the total loss among members of her chat group amounts to several million euros. The investment group Mia Hofer took part in on WhatsApp. Foto: Felix Schmitt / DER SPIEGEL It is unclear whether the scammers in her case came from one of the notorious factories in Southeast Asia. As is so often the case, investigators have so far been unable to identify any suspects. Still, the case is not hopeless. The scammers left clues behind. Hofer’s money did not vanish into some anonymous crypto wallet but went to a bank account, complete with an IBAN number and a name. DER SPIEGEL has obtained the transfer receipts of multiple victims. Many of the payments were addressed to Easy Payment & Finance, a financial institution in Madrid that offers so-called white-label banking services for corporate clients, essentially providing them with its banking infrastructure. Victims were deceived into believing that, by registering on the app, they were opening a trading account at that bank. The scammers advertised Easy Payment & Finance as their partner. The institution did not respond to DER SPIEGEL’s questions before publication. "Little genuine interest in preventing money laundering and fraud." Trade Republic über Easy Payment & Finance The mystery remains, though: How could funds wired to accounts at a European financial institution simply disappear? Why didn’t victims’ domestic banks raise alarms when tens of thousands of euros were repeatedly transferred to Madrid? One of those banks was Trade Republic, the very institution whose logo the scammers had stolen for their fake ads. The neobroker told DER SPIEGEL that before any potentially risky transfers, multi-level warning messages appear in its app: "impossible to overlook.” If a customer insists on proceeding anyway, the bank is legally required to carry out the payment. Trade Republic says it discovered a "suspicious pattern” in transfers to Easy Payment & Finance during the second quarter of 2025. In discussions with the Madrid-based institution, it quickly gained the impression "that Easy Payment & Finance had little genuine interest in preventing money laundering and fraud.” As a result, Trade Republic says it blocked all outgoing transfers to Easy Payment & Finance and notified German and Spanish regulators. So far, the broker reports, authorities have so far taken no clearly discernible follow-up actions. Spain’s central bank said in a statement that Easy Payment & Finance is "duly authorized and registered in Spain," but declined to comment on individual cases. The money trail fades into a tangle of financial intermediaries, virtual accounts and overlapping jurisdictions. For the victims, there are few answers. And no justice. Mia Hofer has filed a complaint with her local police department, contacted Spain’s banking regulator and even reached out to Interpol. But her money remains missing. Along with Laura, the friendly assistant.
WorldWorld
Finance Fraud by App: Online Scammers Fueled by Forced Labor in Myanmar
Loading article...
AI Index
Neutral / Balanced
Facts presented without strong bias.
