Foreign exchange (Forex) and cryptocurrency trading platforms are increasingly popular among investors. While many of the sites where this trade happens are legitimate, fraudulent schemes abound, aiming to deceive and defraud. A four-month Piga Firimbi investigation into two WhatsApp groups and a now-defunct online platform revealed how these scams abound and adapt to lure new victims.
Two things happen when you hear of forex and cryptocurrency trading — you’re either asked to invest immediately or to avoid it completely. Over the past few years, foreign exchange trading, commonly referred to as forex, and cryptocurrency trading, also known as crypto, have become popular not only in Kenya but globally. The internet is awash with stories of people who reportedly earn a living from these platforms, and who use their flashy lifestyles to promise potential investors that they too can make substantial returns. For anyone looking to make quick money with minimal effort, the allure of this trade is hard to resist. Is it all that it’s hyped up to be? Piga Firimbi investigated the intricate maze of online trading, and we found a complex web of questionable actors, and their sometimes not-so-noble intentions.
Forex is a combination of ‘foreign’ and ‘exchange’, and according to Investopedia, it involves exchanging the currency of one country with that of another for profit or personal use. Forex trading primarily involves buying a given currency, say U.S. dollars (USD), at a given price and selling it at a profit when the price rises. The trading is done electronically on the foreign exchange market where major world currencies are traded. Cryptocurrency trading is very similar to forex trading, but deals in cryptocurrency (digital currency) rather than hard currency.
With the unemployment rate in Kenya rising from 5.3% in 2019 to 6.6% in 2021 and projected at 5.41% in 2023 up from 4.90% in the fourth quarter of 2022, it is not surprising that many Kenyans, particularly the youth, are opting for investment in cryptocurrency and foreign exchange trading. Google Trends show a steady rising graph for searches for “forex” over the last five years, with searches for “cryptocurrency” maintaining a steady pattern over the same period, indicating that the curiosity Kenyans have about forex continues to rise, and remains steady about cryptocurrency.
Google search trends for the words forex & cryptocurrency (Source: CfA/Flourish)
Setting The Bait
Due to the growing interest and relative newness of forex and crypto trading, scammers are banking on the increasing popularity of these investment opportunities to defraud unsuspecting victims, promising substantial returns only to flee with investors’ money instead.
For instance, one of the platforms identified is, or was, known as APOVEN and was fronted as a platform that offers cryptocurrency trading, Paid to Click (PTC) adverts, WhatsApp earnings, Instagram earnings, YouTube videos referral bonuses among others. Piga Firimbi has since established that Apoven changed its name at least once since it was registered in November 2021. By following comments on Twitter (now X) and drawing comparison with comments on Facebook, Piga Firimbi established that Apoven later changed its name to Earncity.
A tweet posted on April 24, 2022 suggests that Apoven had changed its name to Earncity. Another tweet on February 24, 2022 says that Apoven is a scam, warning users against joining the platform.
Apoven was heavily promoted on a public group on Facebook, with Joy Lee and Jona Victor as the administrators. A link embedded to one of the posts leads to a WhatsApp group with a Nigerian number (+234 903 *** ***5) as the group administrator.
On Facebook, a user by the name Lincoln Pedroh posted messages to the public group Apoven Company, promoting the platform. This same user also posted promotional messages for Earncity, Apoven’s new iteration, amid replies accusing the platform of scamming people. Similarly, Lincoln Pedroh was a new identity, with the account name having changed from Dedan Pedroh de Braza.
Take note of the name Dedan Pedroh de Braza, we will come to it later.
“He Sent Me A Link And Asked Me To Register…”
“We first met [the scammer] on Facebook when I was seeking advice on how to sell bitcoins I had,” says Debrah Akinyi, who lost 4,800 Kenyan shillings ($34) to the Earncity scheme. “He sent me a link and asked me to register.” She was later asked to post ads on her WhatsApp status in order to earn at a rate of Ksh 100 ($0.71) per view on the product.
“I used to post an array of items from vehicles to beauty products … I would see the money increase on my registered account but I could not withdraw it.”
According to Debrah, the scammer eventually became aggressive, even abusive, and then blocked her.
“After posting for two days, I could not withdraw but when I asked he started … abusing me,” Debrah says. “I called him asking him to refund my money but he refused.”
Once victims of these platforms are lured by promises of earning from posting adverts, they are then asked to pay registration fees or “buy a package” from between Ksh. 1,000 to 3,000 ($7-$22), which varies with the platform. The victims are then asked to post ads on their WhatsApp status or refer others to earn money. The platforms then change their name while the perpetrators cut off contact with the swindled victims.
A WhoIs domain search of Apoven.net shows that there were seven changes to the domain on seven unique IP addresses over two years, and seven changes on seven unique name servers over the same period. This review also says it was a referral site. Curiously, Earncity.net was created in February 2022, around the time suspicions of scamming by Apoven emerged. Both domains are now listed for sale.
Luring in the victims
Many of the fraudulent cryptocurrency and forex trading platforms use social media to scour for victims. They post enticing posters and messages of how one can make money online on their platforms. However, they often re-direct interested users to messaging apps such as Telegram and WhatsApp where individuals are then asked to submit details for payment of registration fees. The initial web pages are then wound up or changed after some time, and eventually, they stop responding to messages entirely.
Over the last one year, I joined three WhatsApp groups to learn from within the nuances of the scams, the tricks they use, and methods they use to lure victims. All the groups investigated are fronted as cryptocurrency or forex trading platforms, and have between 60 and 200 members. What is immediately suspicious about these groups is that only administrators are allowed to post and comment. Also peculiar is that the group administrators of all the three WhatsApp groups are based in Nigeria, given the country codes attached to their phone numbers (+234). However, membership of all the groups cuts across at least 22 countries, with most members coming from India, followed by South Africa and Nigeria.
The administrators in all these groups constantly post a barrage of messages, all structured in the same way and with particular keywords such as “invest”, “profits”, and “making trading easy”, a tactic most likely intended to pique curiosity and entice users..
Note the use of similar language.
The tone of the messages posted on the groups is urgent, and within hours of joining these groups, the administrators of each reached out to me via direct messaging putting pressure on me to invest, following up with incessant calls and messages. The WhatsApp groups investigated also provided personal phone numbers, all Kenyan, where they asked that money be deposited through mobile money transfer.
Moreover, the group administrators also use names that appear to be generic for their WhatsApp profiles such as Mr. Benjamin, Mr. Thomas, Mrs. Sarah, Mrs. Judith etc. This cuts across all the groups we investigated, and in all cases the names attached to these numbers on True Caller were not the same as the names used on WhatsApp. In some instances, the admins kept changing the names.
For instance, at the time of publication, one of the groups – Bitcoin Cryptocurrency – had changed its name at least eight times over a period of under four months.
The Players And The Connections
So, who are the actors behind these groups? How are they connected? What is their play?
Investigations by CfA and Africa Uncensored established that Apoven and Earncity share the same IP address, indicating that the same website could have been only changing names and brand but maintaining its purpose to swindle.
Two Facebook groups, Apoven Ventures and Apoven Company, have a select group of users promoting Apoven and its activities. While the website is now defunct, the groups remain fairly active, with members promoting other money-making platforms such as Flashycoin. However, we could not establish any correlation between Apoven and Flashycoin.
Moreover, a Facebook user by the name Pedroh Malcolm, who has since deleted his profile on Facebook, promoted both platforms on the Apoven Facebook page within months of each post. His post promoting Earncity came three months after the post promoting Apoven, probably after Apoven had rebranded to Earncity. The number shared on the posts is enrolled as “Dedan Rey ” on Truecaller but registered to a Peter Barasa. In replies to one of his posts on the Apoven page, the post tags Dedan Pedroh de Braza, which is the same profile as Lincoln Pedroh. This implies he changed his profile name to obscure his identity further. On Truecaller, his identity is given as Dedan Rey, and his registered name on his number is Peter Barasa, where Braza can be construed as a variation of Barasa.
Another accomplice in promoting Apoven and Earncity is Joy Lee, whose identity Piga Firimbi established as Joyce Omari, based on her registered number. She uses the image of Ugandan Socialite Khally Bae on her Facebook profile, and posts promotional messages for Flashycoin, another forex trading platform.
A phone number registered to Joyce Omari also shows up alongside promotions on the second Facebook group, Apoven Ventures. The page administrator, Damaris Korir, uses a profile image that appears in a variety of places online as seen on these archived Google Image Search results dating as far back as 2016.
Piga Firimbi was unable to verify the identity of the female in the image. The image itself appears to be a hallmark of fake accounts and scams as suggested by this post on X. It also appears to have been used in other countries as well.
Just like Joy Lee, Damaris Korir is a fake Facebook profile.
Red Flags
According to Tom Okore, a management consultant and forex trading enthusiast with 7 years’ experience in forex trading and training, one of the greatest red flags in identifying a scam is the promise of hefty returns. The groups we investigated on WhatsApp all promote huge “returns on investments” up to 100% and in some instances promising 10 times your investment capital.
“Chances are if they are telling you that you’ll make a lot of money, trust that it is a scam,” Okore says, “most legitimate trading companies will have full disclosure — they will tell you that forex trading is risky, you can lose a lot of money but you can equally make a lot of money.”
These groups had no such disclosure, as they assured investors of returns within 24 hours. Legitimate trading companies, Okore adds, have platforms where one is required to open an account to trade. These often have “know your customer (KYC)” requirements including identity and address verification.
“That account will be holding your money, you are not giving it to anybody, no! You are putting money into an account you have created, then you trade yourself.” Okore says.
He advises against having someone trade on one’s behalf, adding that people who promise huge returns over a short period are more often than not scammers.
The appearance of legitimacy
For scammers, their selling point lies in appearing as legitimate as possible. To do so, the groups we investigated use a number of tactics, including using profile images of reputable individuals, mostly in the economic sectors, as profile images of the group administrators. This is meant to first present a respectable image, and secondly to disguise their identity. For instance, one of the administrators of Trust Binary FX who goes by the name Mrs. Judith, uses the image of Owenize Odia, country manager for Luno Nigeria. Luno is a global cryptocurrency trading company. Another administrator of the same group who goes by the name Mrs. Sarah, uses the image of Linda Raschke, an American commodities and futures trader. The administrator of Bitcoin Trading Investment, who goes by the name Mr. Benjamin, uses the image of Elias Igbinakenzua, the CEO of Globus Bank Nigeria.
All the WhatsApp groups investigated had Nigerians as group administrators. We established that the groups kept changing not only the names but also administrators. In all the groups, the founding administrator would at one time leave the group leaving it in the hands of another. This could imply two things: either they would leave the group to propagate another or they would change their numbers altogether. Some of the numbers the administrators would use to reach out would at some point stop working, in effect going dark.
Evidently, there is some coordination between these groups, particularly in their methods of operation and the nationality of the actors; mostly Nigerian. The other strings that tie all of them together are the manner and tone of their messaging, the obscurity behind the administrators, and the modes of payments they prescribe – mobile money. Two administrators provided Kenyan contacts through which I was required to submit money. Moreover, they request for personal banking details, which can be used by phishing scammers for wire fraud.
The scammers often move their victims off one platform and onto another. For instance, they start out with a website or link, and then lead their victims away to more encrypted platforms – dark socials – including Telegram and WhatsApp. They then take down the initial platforms once the motives of the scams are revealed, moving on to new platforms and even methods of scams altogether. The actors usually depend on social engineering to gain potential victims’ trust, whetting their interest, and assuring huge returns. Eventually, they make the victim surrender personal data or invest money. This personal data can be used further to defraud and the money invested is lost.
This investigation highlights the prevalence of fraudulent forex and cryptocurrency trading platforms on messaging platforms and social media. Such schemes, like any typical scam, have tell-tale signs, including promises of huge returns over a short period, obscure executors, constantly changing identities, and oftenly, some sense of urgency in their messaging. It is imperative to do one’s due diligence before investing in online ventures, particularly those that promise easy and substantial returns. It is worth noting that there are many legitimate forex and cryptocurrency trading ventures. However, when the deal seems too good to be true, always do thorough investigation to verify its authenticity.
This article was produced with mentorship from the African Academy for Open Source Investigations (AAOSI), to tackle disinformation that undermines our democracies, as part of an initiative by the International Centre for Journalists (ICFJ) and Code for Africa (CfA). Visit disinfo.africa for more information.
Add comment