€250 Is the Hook: The FTD in Online Investment Fraud
Court records, regulators and fraud operators’ own scripts show that the FTD (first-time deposit) is the designed entry point of investment fraud, not a small loss
The victim sees a test. The operators see the start of a relationship
Every victim of organised online investment fraud remembers the first payment. It was small, only 250 euros, 300, or 400 euros and and very often made by card within minutes of a phone call. A (fictitious) trading account appeared on screen with the money already booked. The losses that followed were a hundred or a thousand times larger, often arriving by bank transfer weeks later. It is natural to see two events: a small experiment, then a disaster.
The operators saw one event. They had a price for the person who made the first payment, a script for what to say next, and a handover from the team that obtained the first deposit to the team that obtained the rest. The first deposit was already a loss for the victim. For the operators, it was also the acquisition of a depositor whose larger losses lay ahead.
The documents expose the connection between those two moments. The small payment opened a relationship designed to produce the large ones. Its size made the decision feel reversible; the machinery waiting behind it made that decision the beginning of a sustained attack on the victim’s money.
The criminal complaints and transaction records submitted by victims registered with EFRI show the same pattern across different fraud operations. EFRI’s extensive knowledge of the Lenhoff and Barak investigation files allows it to recognise this operating model far beyond those networks: this model has remained unchanged since 2016, in EFRI’s assessment partly because the affiliate marketing agencies feeding victims into these schemes have never been targeted by criminal enforcement.
1. One system, five parts
The Lenhoff/Barak network, platforms including Option888, zoomTrader, XMarkets, XTraderFX and Cryptopoint, was an integrated production line. The criminal files document five parts:
- Lead generation. Affiliates advertised easy wealth, collected contact details and were paid per delivered depositor.
- Conversion. A first call-centre team phoned the lead and had one job: obtain the first deposit.
- The (fictitious) trading account. Platform software — Tradologic, later Panda, created the account, displayed the deposit and showed whatever trades, profits and bonuses the operators chose.
- Retention. A second team of “senior brokers”, “account managers” and “analysts” worked by script towards larger deposits while preventing withdrawals.
- The payment layer. Card acquiring, payment gateway provider (rerouting) for bank payments, a customer-relationship system mapping payments to accounts, selected small payouts and alternative payment routes as the operators’ bank accounts were closed.
The Fourth Circuit described the same architecture in a different network in United States v. Elbaz. Customers responding to advertisements for BinaryBook and BigOption were contacted by conversion agents who persuaded them to deposit at least $250. Once a customer was “on the hook”, Yukom Communications took over retention. Agents lied about their identities, qualifications and investment performance to obtain further deposits and refuse withdrawals. The scheme netted more than $100 million in deposits. [1]
The CFTC’s complaint against that network sets out the same vocabulary: conversion means obtaining an initial deposit, typically around $250; the customer then becomes a “first time depositor” or “FTD” and is referred for retention. These are the regulator’s allegations in its civil complaint, distinct from the court’s account above. The operators count depositors, not deposits. The first payment is the unit of production. [2]
2. What a first depositor costs — and what that price says
On 3 May 2017 Uwe Lenhoff negotiated by Skype with an affiliate offering Turkish customers for zoomTrader. His answer, recovered from a seized device in the Saarbrücken investigation, set the price:
“kommt drauf an was ihr als first deposit eingestellt haben wollt. bei 100 Euros FTD, 250 Euros CPA, Chargeback, Fraud und Kunden die nicht traden werden abgezogen” followed by: “250 Euro / 450 CPA.” [7]
In English: “It depends on what you want to set as the first deposit. For a €100 FTD, €250 CPA; chargebacks, fraud and customers who do not trade are deducted.” Then: “€250 / €450 CPA.”
CPA is cost per acquisition: the affiliate’s fee for each first depositor. Lenhoff offered €250 for someone depositing €100, and €450 for someone depositing €250 — 2.5 and 1.8 times the initial payment. The first deposit could not cover the acquisition cost. The price depended on expected later receipts. In this operation, the retention scripts show exactly how the operators intended to obtain them.
Acquisition costs above an initial payment are not, by themselves, evidence of fraud. But they establish the economic dependence on what comes next. Here, the pricing sits alongside a manual for extracting further deposits through deception and preventing withdrawals. The platform was buying the depositor, and retention was expected to recover the price many times over.
The deductions complete the picture. Chargebacks, “fraud” and customers who “do not trade” were excluded from the affiliate’s remuneration. The chat does not equate “not trading” with refusing further deposits. What it establishes is that payment alone did not make every depositor valuable: the operators paid for customers who remained usable within their fraud system.
3. The trading account: a balance that exists to be added to
The first payment moved money to the operators and created something on the victim’s screen: a personal account, an account number and a balance on which trades, profits and bonuses could be displayed.
That account is the pivot of the system. Every later payment, by whatever route, was booked to it. Retention conversations revolved around its “performance”, its bonuses and the money needed for “gold” or “VIP” status. When victims requested withdrawals, the account was “locked”, “under verification” or “subject to a bonus condition”. The account was the stage, and the first deposit built the stage.
The seized “Retention Pitch – Important Points” makes the sequence explicit. Brokers must “implement small trades for clients that have just deposited”, show “no more than a 1-4% risk on their account balance per trade”, separate clients with and without “potential”, and “trade w/them every other day on small amounts and after 1-2 weeks ask for more.” [8]
The apparent restraint was part of the persuasion. A customer saw small trades and a broker who seemed careful with risk. The operator saw a period of preparation before the next request. The account gave both sides a continuous reference point, while concealing that the displayed performance was controlled by the people asking for the money.
Real payouts (also called net withdrawals) served the same design. Lenhoff/Barak court files as well as Belgium’s FSMA records show that fraudsters sometimes allow a small withdrawal to gain trust; the Euro Retail Payments Board’s fraud working group describes early withdrawals followed by blocked ones. In the Lenhoff/Barak files, a chat of 25 April 2017 records the processing of customer payouts through the acquirer and updates to the platform’s customer system: “I process them from PV and send him confirmation to update the CRM.” A victim who receives €300 back on the card has a different relationship with the platform from someone who has only seen numbers on a screen. And card payments are great for intransparency purposes as the money trail can only be reviewed by discussions with the Issuers.
4. The script: social engineering, step by step
The retention script is a manual for converting a person who has paid €250 into a person who pays €25,000. Nothing in the victim’s experience was left to chance. The following instructions come from the OptionStars script in Barak’s court files. [8]
The first call. The broker uses a false name and title “one of the Senior Brokers here at OptionStars” and confirms the customer signed up for automated trading software. The relationship is repositioned: “I am here to monitor your account and make sure you are maximizing your potential.”
The financial interview. Questions about employment, retirement, mortgages and debt lead to the instruction: “I need you to tell me what your financial situation is in order for me to assess what we need to reach your goals.” The purpose is to identify available money and frame the next deposit as the path to the customer’s ambitions.
“Are you looking to pay off your mortgage? Set up a retirement account? Pay off debt?” These were the script’s questions, not an adviser’s independent assessment. The victim’s answers supplied the personal reasons the broker would later use to make another payment seem necessary.
Risk management as the reason for more money. “By having as much liquidity in the account as possible, the less risk we need to take and the more profits you will essentially make.” Ten per cent a month is compared with ten years of bank returns. The larger deposit becomes the cautious choice.
The card. “If you are limited in funds, it is OK. A lot of my clients use credit cards to make their investment.” Credit-card customers are “perfect”; debit-card customers are asked about credit cards or other liquid funds.
Objections, pre-answered. Each resistance has its prescribed reply:
- Afraid of losing: “offer 5 risk free trades”; the customer “can withdraw at any time”.
- “But I signed up for the software and you’re asking me for more money”: “Don’t treat this as a payment. All you are doing is simply transferring funds from one account to the other.”
- “The account manager told me the robot will double my account”: “the account manager is not a broker. All they do is open accounts.”
- “I need to talk to my wife”: start small, show her the results, and “Don’t worry she won’t kill you for making a good business decision.”
- Lost money before with this company: blame “bad account management”, open another account and “put a small amount into there”.
- “I saw bad reviews, people say you are a scam”: claim that the website publishing them “is a scam”.
- “Are you regulated?”: “You can say that we are a licensed company working with different corresponding banks all over the world. You cannot say regulated but licensed is a good way to put it.”
Every doubt is turned into a reason to deposit again. The small amount is never the point, it is just the start of the fraud trail. The point is that the account keeps moving.
5. Why the card? and why the chargeback promise?
In EFRI’s analysis of 3,788 German XTraderFX customer accounts in seized payment data, 3,751 first deposits — 99.02 per cent — were made by card. The first deposit in this dataset was almost always a card payment. The card performed three functions in the conversion process. [10]
It was instant. Authorisation came back in seconds (as Payvision (the acquirer for Barak/Lenhoffs plattforms) had an API with the software used by the scammers); the balance appeared while the caller was still on the line. The victim watched their money enter “their” account. A bank transfer would have broken that moment.
It carried a trusted brand. Victims interviewed by EFRI repeatedly describe the same reasoning: a platform accepting Visa and Mastercard must have been checked; a fraudulent operation would not be allowed into the card system. [12] The script’s reference to “corresponding banks” uses the same appeal to institutional legitimacy. Separately, Anderson and colleagues’ research on victim testimonies identifies interactive investment balances as a source of perceived legitimacy. [5] The platform borrowed trust from both the card brand and the bank-like display.
It came with a safety net the agent could point to. Conversion agents told hesitant customers that the card company would return the first deposit if anything went wrong. EFRI’s victim files repeatedly record this reassurance as decisive: victims believed they were making a protected payment, not sending money to strangers. [12] The promise turned chargeback protection into the argument that unlocked the first deposit.
Once retention took over, the larger sums (especially with German, Austrian and Swiss victims) were often were requested by bank transfer, outside the card chargeback mechanism. Victims of the Lenhoff/Barak platforms describe brokers directing them to the payment route. The reassurance that secured entry into the system did not travel with those later transfers. [12]
By then the victim was dealing with a familiar broker and an account that already appeared to be working. A later transfer did not feel like a fresh payment to an unknown operation. It felt like adding money to something established, precisely the interpretation the retention script demanded when it told brokers to describe payment as a transfer between the customer’s own accounts.
A fourth and the fith elements was invisible to the victim:
According to the merchant records in the investigation file, Payvision B.V. processed the platforms under merchant category code 6211, reserved for (licensed) securities brokers and dealers, across fourteen merchant identifiers. The transaction data presented the platforms to the Issuers of the victims`cards as the kind of business they claimed to be. [11]
Payvision brought an additional advantage to the fraud operation: a connection to ING Bank that remained in place long after other banks had terminated their relationships with the network.
Data note: The 99.02 per cent figure is 3,751 divided by 3,788 customer accounts in EFRI’s German XTraderFX dataset (“DepositsSummary”). It describes those accounts, not all victims or platforms. The full methodology and limitations will accompany EFRI’s full analysis. [10]
6. One fraud operation, multiple payments
The operators bought, organised and managed a continuing relationship. Conversion handed the account holder to retention; retention worked the account until the money ran out or the victim stopped answering. The customer system recorded the first card payment, later transfers, bonuses and payouts against the same (fictitious) trading account.
The handover did not require the victim to choose a new service or trust a new platform. The next broker inherited the account and the confidence already built around it. Every line in the retention manual presupposes that first commitment and turns it towards the next deposit.
Nothing in that design changes when the second or fifth payment travels by bank transfer. The rail changes; the account, the broker, the script and the deception do not. The victim wiring €25,000 in week six remains inside the conversation that began with €250 in week one. The payment method is a detail of execution. The first deposit is where the victim entered the system, and the system was built so that entering it was the only decision that mattered.
Our Assessment
EFRI represents victims of online investment fraud and works to establish accountability of the intermediaries without which the money could not have moved. The evidence demands three starting points for that work.
The fraud is the relationship, not the transaction. An analysis that isolates one payment without examining the organised sequence misses the mechanism that connects the losses.
The small first payment is the design. A €250 deposit is not a minor loss that merely preceded the real fraud. It is the mechanism by which the larger losses were made possible.
The card system was integral to that mechanism. Its speed, brand and chargeback protection made a stranger’s request for €250 feel safe. Securities-dealer coding reinforced the appearance of legitimacy in transaction data. Any analysis of payment infrastructure must start with the role it played in bringing victims into the operation.
This article forms part of EFRI’s forthcoming paper, The Role of Financial Crime Enablers in the Global Scam Epidemic, to be published shortly on SSRN. The paper examines how payment providers and other intermediaries sustain and expand the infrastructure of organised investment fraud, with particular attention to Payvision’s/ING Bank’s role in the Lenhoff and Barak networks.
Sources
- United States v. Elbaz, 52 F.4th 593 (4th Cir. 2022), No. 20-4019, amended opinion of 3 November 2022. Court opinion.
- CFTC v. Yukom Communications Ltd. et al., N.D. Ill., No. 1:19-cv-05416, complaint filed 12 August 2019, ¶¶ 8, 51–52. Civil complaint.
- FSMA, Invest with AI and become rich with 250 euros. Beware of fraud!, 15 May 2025. Regulatory warning.
- ERPB Working Group on Fraud, Interim findings, ERPB/2023/017, 20 November 2023. Working-group report.
- Anderson, M., March, E., Land, L., & Boshuijzen-van Burken, C. (2024). Exploring the roles played by trust and technology in the online investment fraud victimisation process. Journal of Criminology, 57(4), 488–514. Research article.
- Landesgericht für Strafsachen Wien, judgment of 1 September 2020 against Gal Barak; Staatsanwaltschaft Saarbrücken, indictment in case 05 Js 221/18. Sources for the network structure and payment arrangements in section 1.
- Lenhoff affiliate Skype chat, 3 May 2017, Saarbrücken investigation file, forensic extract, sheet 403, entries 11:47:01 and 11:47:10 UTC. English translation provided above.
- “Retention Pitch – Important Points”, OptionStars call-centre script, Saarbrücken investigation file, sheets 269–271.
- Customer-payout and CRM chat, 25 April 2017, Saarbrücken investigation file, forensic extract.
- EFRI analysis of seized XTraderFX “DepositsSummary” data: 3,788 German customer accounts; 3,751 card first deposits. See data note above.
- Payvision merchant identifiers and category coding, Saarbrücken investigation file; see also EFRI, Payvision Report, 15 May 2026.
- EFRI victim files, 2019–2026: Lenhoff/Barak victim statements on initial calls, card payments, chargeback assurances and payment instructions.
