The cooperation between Payvision B.V., a Dutch-supervised payment service provider, and the cybercriminals Gal Barak, Uwe Lenhoff, and his accomplices (Gery Shalon, Vlad Smirnov, and others) began in 2013. The cooperation ended at the end of January 2019 with the arrest of Gal Barak and Uwe Lenhoff.
When reading the summary below, please remember that ING, Amsterdam, one of the leading European banks, acquired the shares of Payvision in March 2018 at a valuation of € 360 million and after thoughtful (?) due diligence.
The marketing material!
Payvision B.V. Amsterdam – a 100% subsidiary of ING Groep, Amsterdam – has been a technical payment service provider for high-risk online customers (CardNotPresent) since its inception in 2002.
After Payvision became a licensed and supervised payment institution and a license partner of the VISA/Mastercard credit card companies in 2012, Payvision offered its own acquiring activities to high-risk merchants. In its statement to the Austrian investigative authorities, Rudolf Booker, the founder and general manager of Payvision B.V. until 30 April 2020, summarised Payvision’s activities as follows.
Onboarding of NOVOX Capital Ltd in 2013
Since March 2013, Payvision has been working with NOVOX Capital Ltd, the predecessor company of the criminal organisation associated with Gal Barak and Uwe Lenhoff. In April 2014, the Cypriot regulatory authority (CySec) onboarded NOVOX Capital Ltd. (hereinafter referred to as “NOVOX”) as a licensed investment services company. NOVOX operated the following “approved” binary options websites (also referred to as “brands”): OptionsBit.eu, zoomtraderglobal.com, optionstars.com, and optionmerchants.com. Additionally, it operated the following “non-approved” binary options websites: optionbit.com and optionstarsglobal.com (CySec approves each separate domain). NOVOX Capital Ltd appeared on the cybertrading websites as the owning and operating company for all supported binary options platforms.
Before Payvision B.V. onboarded NOVOX and its brands, the web was full of negative comments about optionbit. On February 24, 2014, the French supervisory authority AMF, warned about the binary options website www.optionbit.com, operated by NOVOX Capital Ltd.
On December 6, 2016, the British Columbia Securities Commission in Canada warned about Option Stars and OptionStarsGlobal, which is by NOVOX Capital Ltd.
Payvision was one of several credit card processors (acquirers) for NOVOX Capital Ltd. Payvision B.V. processed card transactions for both approved and non-approved websites, according to Booker’s statement dated 12 July 2019. Payvision B.V. onboarded NOVOX Capital Ltd, the supervised entity. The domains, operated by NOVOX and not approved by CySec, showed operating companies based in the British Virgin Islands and Seychelles, respectively, and falsely claimed to have a license from Vanuatu. According to Booker´s statement to the Austrian prosecutor and the unapproved domains, NOVOX was the onboarded merchant.
The beneficial owners of NOVOX were the Israeli brothers Elan and Shoram Hilel, also known as the Hilel brothers. Back in 2013, the Hilel brothers, along with Ilan Tzorya, Vlad Smirnov, and Gery Shalon, also owned Tradologic, a trading and CRM software used by NOVOX for all its brands.
Payvision was connected to various binary option websites operated by NOVOX through technical interfaces to the Tradologic software and also served as a payment gateway software provider.
When Barak and Lenhoff came in!
In early 2014, Israeli Gal Barak began building a call centre in Sofia, Bulgaria. Being referred by Tzorya, I started managing the brands (binary option websites) OptionStarsGlobal (not licensed) and OptionStars (licensed) for NOVOX Capital Ltd. Back then, NOVOX was the onboarded merchant for both binary options websites, and Payvision B.V. was just one of several payment processors working for the scammers.
In the spring of 2015, the German Uwe Lenhoff began establishing the brand option888. Initially, Option888 was operated under the NOVOX license. Lenhoff paid NOVOX a license fee for “using” their license. Additionally, for this website, NOVOX was the onboarded merchant with Payvision B.V. for card payments processed by Payvision B.V.
Agressive selling style and a dispute!
Gal Barak applied very aggressive sales methods (even compared to the Hilel brothers). The boiler room employees got special training, promises of high bonuses, and threats for underperformance. Lenhoff was heavily impressed by the performance of Gal Barak`s boiler room employees. He turned to Barak for support in educating his people and convincing victims to transfer money for fictitious trading.
This resulted in increased investor warnings from regulators and a rise in customer complaints to the Cypriot regulator regarding OptionStars, OptionStarsGlobal, and Option888.
In 2015, disputes between Barak/Lenhoff and the Hilel brothers intensified as NOVOX withheld increasing amounts of money for the platforms operated by Gal Barak and Uwe Lenhoff, due to the growing number of customer complaints and an ongoing audit by CySec. At the same time, Barak/Lenhoff claimed that NOVOX repeatedly used the customer base of the “new” platforms to operate their platforms.
The arrest of Gery (Gabriel) Shalon!
In 2015, Gery Shalon, co-owner of Tradologic Software in Israel, was arrested as a Georgian criminal. He became one of the foremost perpetrators of U.S. history’s most significant data theft. Shalon was the mastermind behind cyberattacks on financial institutions and other companies worldwide. In October 2015, Shalon was arrested and charged with two other suspects. They were accused of being involved in several crimes, including hacking, identity theft, fraud, and money laundering. The charges were varied and included stealing information on more than 100 million customer records.
Lenhoff and Booker met
In the winter of 2015, Lenhoff personally got to know Rudolf Booker/CEO of Payvision B.V., through a mutual business partner (Dirk-Jan Bakker). A close business and personal cooperation started, resulting in thousands of consumers losing their lifetime savings.
CySec got active!
At the end of 2016, the Cypriot regulator imposed the highest fine (to date) of €175k on NOVOX Capital Ltd for non-compliance with the imposed rules.
The fine split as follows:
€70,000 comes for providing investment advice without authorization. The remainder of the fine is imposed for the defendant’s violations:
€10,000 for not maintaining proper internal control mechanisms for the approval of advertising materials
€20,000 for inadequate outsourcing activities to third parties, such as customer service and call center activities.
€30,000 for not acting in the best interests of the clients.
€30,000 for the dissemination of misleading advertising materials by third parties.
€15,000 for providing information unsuitable for clients.
VISA/Mastercard fined Payvision B.V. for high charge-back ratios
Payvision B.V. was fined for too high charge-back ratios in processing optionstars/optionstarsglobal and optionbit with € 480.000 in March 2017.
Splitting up with NOVOX
Late in 2016, Lenhoff and Barak finally parted ways with the Hilel brothers due to numerous complaints and ongoing disputes over the money. The Hilel brothers rejected Barak and Lenhoff’s aggressive selling methods. They requested a substantial share of the stolen money to compensate the licensed entity and assume the risk with CySec.
2017 also saw the Hilel brothers’ exit from the Tradologic software investment (this software was used for all NOVOX brands). So, in 2017, Vlad Smirnov and Gary Shalon acquired the majority stake in Tradologic Software. Gal Barak and Uwe Lenhoff acquired 10% each in the company holding the IP rights to Tradologic Software.
Payvision also made its choice.
At the end of December 2017, they stopped working for NOVOX and joined Lenhoff and Barak`s criminal organisation.
Payvision`s processing volume for NOVOX
The total volume of card payments processed by Payvision for NOVOX from 2013 to 2017 for the brands amounted to € 23 mio. according to the information provided by Booker to the Austrian authorities (no guarantee for completeness!). There is no documented personal relationship between Booker with the beneficial owners of NOVOX, and there is proof that Payvision was only one of several acquirers working for NOVOX.
The criminal organization Uwe Lenhoff and Gal Barak prospers.
In March 2016, Uwe Lenhoff acquired the brands zoomtrader.com, zoomtraderglobal.com, and zoomtrader.info in addition to the fraud platform option888, which he operated anyway. In the following months, Lenhoff also opened the brands xmarkets, tradovest, and tradeinvest90. For all these brands’ aggressive
Due to the close personal relationship between Lenhoff and Booker, Payvision became the leading payment gateway provider and card processing entity for Lenhoff´s brands.
As early as spring 2016, Uwe Lenhoff took it upon himself to resell Payvision’s services to his business partners. Gal Barak was the first one to be introduced.
So, starting in the summer of 2016, Payvision B.V. also became the leading payment service provider (payment gateway provider and acquirer) for Gal Barak and his fraudulent brands. From 2015 to 2019, Barak operated the investment scams optionstarsglobal, cryptopoint, xtraderfx, safemarkets and goldenmarkets.
In total, Payvision processed victim credit card payments totalling €55.6 million for Uwe Lenhoff from 02/2016 to 01/2019.
In the period from September 2016 to 01/2019, Payvision processed a total of €75.6 million in victim payments for Gal Barak’s online fraud websites (again, the figures are taken from the info provided by Booker, so no guarantee for completeness can be given):
Payvision's contribution to the fraud.
Payvision’s services to the brands included acquiring (processing the card payments), acting as a payment gateway provider (providing alternative payment methods and rerouting), and crediting Ponzi refunds for the victims.
By ignoring and violating all applicable care of duty and legal money laundering rules, Payvision B.V., a European-supervised credit card company, has onboarded pure shell companies with (homeless) strawmen posing as beneficial owners and managing directors.
Neither of the onboarded merchants had a license for offering investment services in Europe nor a money transmitter license.
Nevertheless, Payvision B.V. used a Merchant Category Code (MCC) for licensed services. So, Payvision B.V. purposefully miscoded the types of transactions processed, defrauding the issuing banks and drastically increasing the transaction volume.
The fraudulent brands’ websites displayed offshore companies registered in the Republic of Samoa, Seychelles, and the British Virgin Islands.
Regulators in Europe have frequently issued warnings about xtraderfx, Option888, GoldenMarkets, OptionStarsGlobal, and SafeMarkets due to massive consumer complaints.
Hundreds of defrauded consumers desperately filed charge-back requests and fraud complaints with their banks (the consumers’ card issuers). Payvision B.V. received all of them and was contractually required to review them.
But Payvision continued and ignored all red flags. This unscrupulousness, in combination with the aggressive selling strategies of Barak and Lenhoff, resulted in a massive increase in the number of transactions processed by Payvision B.V. for the fraud platforms, created a source of income for all those involved in the fraud, and led to thousands of innocent consumers losing their lifetime savings.
Gery Shalon reentered the scene!
2017 also saw the exit of the Hilel brothers from the Tradologic investment. In 2017, Vlad Smirnov and Gary Shalon acquired a majority stake in Tradologic Software. Gal Barak and Uwe Lenhoff acquired 10% each in the company holding the IP rights to Tradologic Software.
With Gery Shalon being a big scammer and promising a massive number of transactions, Booker was also eager to be acquainted with him. Subsequently, through the mediation of Uwe Lenhoff, business relations were also established between Payvision, Gery Shalon, and Vladimir Smirnov. So Payvision also processed the BINEX brand. The trading platform www.binex.ru used to work with Tradologic software and used DreamsPay as its payment system. BINEX primarily focused on customers in Russia and Ukraine, where offices are also maintained. According to the documents available, the center of the BINEX operation was Moscow, but an office in Kyiv was also operated to acquire Ukrainian customers. Already in August 2018, a police raid was carried out on facilities in Kyiv. There were no issues at all for Payvision; Payvision continued its services.
Soon after his arrest, Gery Shalon was able to agree to a (whistleblower) deal with the FBI. When he was held in home custody in New York, he was heavily involved in Barak and Lenhoff`s brand development and defrauding European consumers.
2018 was the harvesting year for the scammers
2018 was the best-performing year for the scammers.
With the support of Shalon´s marketing capabilities, the deposits and number of transactions in 2018 peaked, mainly for the websites xtraderfx and optionstarsglobal.
Higher charge-back ratios accompanied the increased transaction volume. More frequently, Booker called Barak, informing him about more significant risks and requesting higher transaction fees and charge-back handling fees. In June 2017, Payvision B.V. and Gal Barak established a new merchant agreement for all brands managed by Barak, which included a processing fee of more than 7% and a fixed fee of €24 for handling every charge-back request. (Keep in mind that this amount was calculated without factoring in the payment gateway service fees and the costs associated with handling the Ponzi refunds.)
The high fees charged and the aggressive selling volume paid off well for Payvision B.V. Payvision’s gross revenue in 2018 increased accordingly. Booker pushed Payvision’s gross income from 2017 €119 million to €192 million (in total €73 million or 61 % increase) in 2018.
With this excellent business performance, Rudolf Booker could sell his shares in Payvision B.V. to ING Bank N.V., one of the largest European banks, for a valuation of €360 million. (In 2017, the EBIT of Payvision B.V. was €886k, and the net result was – €465k). ING Bank N.V. celebrated the acquisition, and thousands of European consumers lost all of their savings to unscrupulous criminals.
The next part will tell how the success story of Barak and Payvision B.V.ended. Stay tuned
