‘Wolf of Sofia’ ‘Stings’ Tens of Thousands of Europeans with Over EUR 100 Million

Atanas Tchobanov

Israeli citizen Gal Barak, suspected of financial fraud, was detained in Sofia in February 2019 at the request of the Austrian authorities. The next hearing on his extradition to Austria is scheduled for Thursday, September 12, 2019. Because of this, the Vienna-based European Financial Recovery Initiative (EFRI) has disseminated an open letter to the media detailing the extent of the fraud and a petition to the prosecutors-general of Austria and Bulgaria in support of Barak’s extradition. An investigation by Bivol reveals how the funds have been siphoned – through accounts of offshore companies in Bulgarian private lender Investbank, huge cash withdrawals and purchases of expensive properties.

Israeli Gal Barak and Austrian national Uwe Lennhof were arrested earlier this year. According to the Austrian prosecutors, who conducted the operation, they are the leaders of an international cybercrime organization operating in several countries that is accused of stealing around EUR 100 million per year through illegal online trading platforms. The blow to the group was first reported at a special news conference by the Austrian police at the Austrian Federal Crime Agency (Bundeskriminalamt BKA).

Nonetheless, this blow to the international network of financial fraudsters and Barak’s arrest never made the headlines in Bulgaria. Neither the Ministry of Interior nor the Prosecutor’s Office nor the National Security Agency (DANS) have boasted the successful arrest of the “Wolf of Sofia“, as is the alias of the Israeli Gal Barak. He has been released from detention for health reasons and is currently awaiting extradition to Austria under house arrest.

Bivol conducted its own investigation into the case, showing that huge amounts originating from illegal activity had been deposited in accounts at Investbank. A detailed research reveals that the accounts had been opened by shell and offshore companies, and large amounts of cash had been withdrawn from them.

Boiling investors in the boiler room

The fraudulent scheme is known as “boiler room”, a metaphor for “boiling” gullible, but greedy customers, tempted by an easy profit. In a nutshell, the scheme involves convincing people with average financial capabilities to transfer some money to a phony investment firm against the promise of quickly earning large sums of money.

The coaxing is done on the phone or by email, therefore, a call center is needed for this purpose. It also requires a site that looks like a professional trading platform with real-time graphics. After the coaxing, the victim receives an account, invests with a credit card a small amount of real money, and enjoys the steady movement upwards of his profit’s graph. Said graph is nothing more than an algorithm generating figures and convincing pictures. At the same time, the investor is being taken care of by email and phone by their “personal financial advisor” who sweet-talks them with promises of a bright financial future, thus earning the victim’s trust.

The decisive moment comes when the advisor makes an emergency call to the client to persuade them to wire as much money as possible for a hugely profitable financial deal. If the victim takes the bait and transfers the amount, this is the end of any and all communication. The victim’s account disappears, the calls to the company are blocked for anyone who rings to ask to get their money back.

EFRI claims to have Gal Barak’s lists of the customers of the international cybercrime organization and they include more than 35,000 European “retail” investors. Gal Barack’s target market for criminal activity has been mainly Western Europe (Germany, Austria, Switzerland and the United Kingdom). There are no known victims from Bulgaria.

The organization has taken on the protection of about 1,300 victims of various cyber fraud who have approached it. According to EFRI, more than 90% are European citizens with a poor knowledge about the internet, between 50 and 75 years of age. The cash invested by them came mainly from personal savings and inherited money. About 250 of the victims, mainly Austrian and German nationals, have authorized EFRI to collect their payments to the platforms managed by Gal Barak’s group.

EFRI aims “to address the Bulgarian Prosecutor General with a petition email with a copy to the diplomatic representation concerned. The petition asks to further the investigations, to find the truth as well as to provide justice to victims by supporting the extradition of Gal Barak”.

According to the petition, “based on years of investigation and compelling evidence, an EU arrest warrant was issued against Gal Barak early 2019 at the request of the Austrian authorities. However, Gal Barak is currently in Bulgaria, where the Bulgarian authorities have not prevented him from continuing his fraudulent activities and from cheating investors. His cyberscam organization represents a direct and present threat to European investors.

The Austrian authorities have been trying for months to obtain extradition without success (Bulgarian case No вчнд 159/2019 г). No result! This also means for the victims in Britain and Europe that they will not be given justice. This petition is intended to respectfully draw the attention of the Bulgarian authorities to their support for an Israeli citizen and his accomplices in the practice of investor fraud”.

According to information obtained by Bivol, Gal Barak’s defense in Bulgaria’s is handled by the office of notorious lawyer Todor Batkov, a former legal representative of Israeli businessman Michael Chorney, extradited from Bulgaria in the 1990s and wanted by several countries for financial crimes.

Precisely Batkov had met the investigators who had come to detain Barak in the latter’s office and to seize evidence from company computers. Apparently, someone had warned of the arrival of the anti-mafia police, because eventually no servers or computers had been seized from Gal Barack’s offices, and the call center continued to work after the arrest of its boss.

Todor Batkov did not respond to our email with a request to comment on the case by the editorial closure of the article.

Accounts in “bad apple” bank

Gal Barak’s companies are served by a Bulgarian bank with a scandalous reputation – Petya Slavova’s Investbank, described as a “bad apple” in classified US diplomatic cables, leaked to Wikileaks. An analysis of the transactions of several Barak-related companies, available to Bivol, shows serious divergences with bank anti-money laundering regulations.

First, companies that are offshore, registered in tax havens and without any information about them having activities and an address in Bulgaria open accounts in Investbank. The offshores affiliated with Barak – Global Media Partners Ltd. with an address in Tortola, British Virgin Islands, Dynamicsolutions Ltd, Rockarage Ltd, Seagulf Ltd and Bright Ideas with an address in the Marshall Islands – have such accounts in Investbank. In addition, the registered in the United Kingdom company Gpay Ltd., whose listed owner is someone named Georgi Komissarov, born in 1959, is also key. Formally, it is not offshore because it is registered in the European Union.

The bank statement of the account of Gpay Ltd. in Investbank shows that in just one year, EUR 27 million has passed through it. The deposits came mainly from credit card companies that collect payments from naive investors. For example, in just one month, the Dutch Payvision https://www.payvision.com transferred more than EUR 5 million to the Gpay Ltd’s account in Investbank.

However, the money is not kept in the accounts of these companies but is quickly transferred in tranches of EUR 150,000 to the Bulgarian company E&G Bulgaria, where Barak had been a manager, as well as to the accounts of Bright Ideas Ltd and Seagulf Ltd. Fintelegram claims that the latter is owned by Barak.

In addition, huge amounts of cash had been withdrawn from the accounts of Gpay, Global Media Partners and Dynamic Solutions, without prior request to the bank, by the one and same person – Marina Ivanova Andreeva. Bivol’s research established that she is 37 years old from the northeastern city of Razgrad and is the proxy of the listed owner of the offshore company Bright Ideas Ltd. Andreeva has full banking rights on behalf of the company – remotely and at the counter. She has gotten the same rights from the “strawman” behind Dynamic Solutions, who is a Bulgarian with no business record. To be able to withdraw cash from accounts, she had been obviously authorized by the other companies with accounts in Investbank as well.

As of this year, a person with the same personal identification number appears in the Property Register, but with the name Marina Ivanova Barak. Apparently, the girlfriend has become Gal Barack’s wife. She has no joint ventures with him, but has been the CFO of E&G Bulgaria and has managed the cash flows of the offshore companies through which the money flows, Fintelegram claims.

In September 2018 alone, Marina Andreeva had been able to withdraw from Global Media Partners Ltd’s account over EUR 415,000 in cash, while also withdrawing smaller amounts from the other offshore accounts, bank documents show.
Withdrawals of large amounts of cash without prior request should not be possible, but they do happen.
We approached Investbank to inquire whether these offshores, bank transfers amounting to millions and withdrawal of hundreds of thousands in cash from company accounts are controlled as mandated by the anti-money laundering measures. The Bank replied that it had no legal obligation to refuse to open offshore accounts; it knew who the actual owners were, while all suspicious transactions have been reported to DANS.

Property acquisitions

At the height of his activity in Bulgaria, the “Wolf of Sofia” was known by the city’s highlife for his luxury cars and lavish parties. Famous public figures readily socialized with him. Fintelegram published photos featuring Gal Barak with Bulgarian Prime Minister Boyko Borisov and the Chief Rabbi of the Habad center for Bulgaria, Yosef Salamon.

In addition, Gal Barak has spent the easy money he has earned on real estate in Bulgaria, entries in the Property Register show. The first purchase of a property by Gal Barak has been modest. At the end of 2016, the Israeli acquired a studio of 38.5 square meters in the Studentski Grad (College City) district for BGN 74,321.54. Two months later, he bought a second studio of 38.9 square meters, again in the same apartment building on “Jacques Nathan” Street for the exact same amount.

The following year, Barak acquired an apartment of 129 square meters in the Dragalevtsi district on “Bistar Ruchey” (Clear Stream) Street. The “Wolf of Sofia” also became the happy owner of three garden terraces, from which he could enjoy the view of the conquered by him Balkans capital. All this cost him the modest BGN 117,349.
At the beginning of 2019, Gal Barak expanded his assets with two stores on 5 “Gluharche” (Dandelion) Street, for which he paid a total of BGN 1,202,582. There is no indication that these properties had been acquired through bank mortgages.

After Barak’s arrest and the start of the processes for his extradition, his wife, Marina Barak, acquired a lucrative, regulated plot of nearly two acres in Dragalevtsi. In August 2019, she paid BGN 273,816 to the SOFIA-BPM EOOD company, which is owned by her.

A year earlier, SOFIA-BPM had managed to buy the same land plot for a slightly smaller amount. Despite these amounts, it should be noted that SOFIA-BPM has a capital of BGN 100 and is not even registered for VAT. Through it, another BGN 0.5 million of Barak’s money has materialized as real estate.

Bulgaria – a paradise for cyber fraudsters?

Why are cyber fraud schemes thriving in Bulgaria? The reason is obviously not only the benevolent law enforcement agencies that turn a blind eye to budding call centers and trading companies and to their quite important lawyers.

Our country is a preferred destination for fraudsters because in Bulgaria it is possible to transfer money from criminal activity through financial institutions that serve dubious offshore companies without problems, while the competent authorities close their eyes even when receiving alerts. These practices are not that recent and several years ago, Bivol wrote about a similar scheme operating in Bulgaria but through other banks. Obviously, however, the flaws of the “bad apples” are persistent to this day, which embarrasses the country in front of its European partners at a time when Bulgaria aspires to join the euro area.


If you find this article useful, support our work with a small donation.

Pay a Bivol Tax!

We will highly appreciate if you decide to support us with monthly donations keeping the option Make this donation monthly.

Select Payment Method
Personal Info

Credit Card Info
This is a secure SSL encrypted payment.

Donation Total: 5.00€

Извършвайки плащане Вие се съгласявате с Общите условия, които предварително сте прочели тук.

Биволъ не записва и не съхранява номера на Вашата банкова карта. Плащанията се обработват през системата Stripe. Даренията за Биволъ с банкови карти се управляват от френската неправителствена организация Data for Reporters Journalists and Investigations - DRJI.

This post is also available in: Bulgarian

Вижте също / Read Also