In a hospital bed, hooked up to a drip and waiting for surgery, Rodger could no longer pretend things would be fine. His body was failing, and so was his bank balance. Years of careful saving had been poured into an investment platform called The FBTC, a name that sounded as ordinary as it was obscure, and now all of that money was out of reach. He had handed over about $125,000 after listening to a man who claimed to be a financial professional in Switzerland. The instructions had seemed plausible at first: move a little more here, pay a small fee there, trust the market to do the rest. But when Rodger needed cash for a basic piece of medical equipment, the professional disappeared into a maze of excuses. “You guys have all of my money tied up,” he texted his broker. “I need … to buy a wheelchair.” The replies were polite and useless. The broker told him to switch to a new bank. His account was frozen. There were liquidity issues. He had to pay another fee. Each new hurdle seemed designed to pull him deeper into the trap, and each time Rodger complied, the finish line moved again. Soon he was scrounging for money to pay his medical bills. As Christmas approached, he told his tormentor that he couldn’t even afford presents for his family. The response was chilling in its casual cruelty: “Sorry to hear that, Rodger. If you manage to come up with the 5k [more to invest] … would be perfect.” That was the last real message he ever received from his broker. The money was gone. The man in Switzerland was gone. And Rodger was left in a hospital bed, no wheelchair, no savings, and the growing realisation that he had been carefully, methodically ruined by people he would never meet.
Rodger’s story is not an isolated tragedy. He was one of more than 4,000 Australians who have been targeted by a sprawling criminal operation known among investigators as the Sapphire Network. The network is not a single company with a clear leader; it is a decentralised web of dozens of companies and hundreds of people, working together to build fake investment platforms, attract victims, and move money before it disappears. It has been operating since at least 2021, and its operational base is central Tel Aviv, with call centres linked to Bulgaria, Ukraine, Cyprus, Macedonia and Israel. The method is almost mechanical. Victims are recruited through fake news articles and false promises of AI-assisted trading, then guided through a series of payments that are disguised as legitimate business transactions. Once the money enters the system, it is nearly impossible to retrieve. The Organised Crime and Corruption Reporting Project, or OCCRP, estimates that the Sapphire Network has defrauded victims of hundreds of millions of dollars, entirely through investment scams. That estimate is based partly on internal documents that were leaked from inside the network to Swedish broadcaster SVT in 2025 and later shared with the OCCRP and its reporting partners, including the Swedish media foundation Qurium and the amaBhungane Centre for Investigative Journalism. The ABC was given access to those files. They contain spreadsheets with the names, phone numbers and payment amounts of thousands of Australian victims, along with emails, screen recordings and transaction records that trace the flow of stolen money. What emerges is a picture of an industrial-scale fraud machine, hiding in plain sight behind a maze of shell companies, encrypted messaging apps and call centres designed to sound professional. For every Rodger, there is a Toby. And for every Toby, there is a Susan or an Anna. The story, pieced together from those leaked documents and from interviews with victims, shows how the Sapphire Network works—and how it destroys lives.
Toby, an Australian man whose name has been changed for his protection, fell into the same trap in 2026. He was lured by a fake news article published on an almost perfect clone of the ABC website, a trick the Sapphire Network uses to create an illusion of legitimacy. Over several months, a broker convinced him to hand over more than $500,000. The relationship began with small talk about markets and ended with Toby taking out loans against his home and business to pay a debt that did not exist. At first, the broker asked for a modest payment to open an account, a common tactic to make sure the victim has skin in the game early. Toby then deposited money into what he was told was a bank account set up in his own name, but which he did not control. On the broker’s platform, he was able to trade oil and gold, and they followed world events together. When the Strait of Hormuz closed and reopened, they discussed what it meant for energy prices, sharing links to news articles about the deepening US-Iran conflict. On his dashboard, Toby watched his money multiply. The illusion was perfect, and it had to be, because none of it was real. There were no trades, no oil, no gold, no profits. The money was gone almost as soon as it arrived. When the scammers decided the time was right, the psychology shifted. Some trades supposedly went wrong, and Toby was told he was now in debt for hundreds of thousands of dollars. The broker presented himself as Toby’s only ally, suggesting loans against his home and business as the way to “fix” the problem. The pressure was relentless, and the shame of having been tricked made it even harder to step back. Only later, when the broker stopped responding and the fake platform vanished, did Toby begin to understand. He was not an investor; he was a mark. The broker was not a professional; he was a predator using a made-up name and encrypted messages. The documents he had sent were forged, and every promise had been a lie.
The breakthrough in the investigation came from a single receipt. In the early phase of the scam, Toby’s broker asked for a small payment to open the account on the fraudulent platform. This is standard practice for the Sapphire Network. Initial payments are usually around $350, and they are designed to get victims emotionally invested. To avoid detection, these payments are often disguised as fees for online courses or immigration services. Toby’s initial payment went to a Melbourne company called Trigo XO, based in the affluent suburb of Toorak. The rest of his money went into an untraceable bank account, but the smaller payment left a forensic trail. Trigo XO ran three websites advertising online courses. When ABC journalists tried to purchase courses from those websites, no one answered the phone and the checkout systems failed repeatedly. Another Australian victim who paid Trigo XO after being scammed received a 35-page PDF titled as a business leadership course, filled with generic platitudes about leadership that seemed designed to look like a product but had no real value. The company’s accountant told the ABC he was so worried about the operations that he had already complained to AUSTRAC, Australia’s anti-money laundering regulator, saying he had “no way to check” whether the invoices coming through Trigo XO were legitimate. AUSTRAC refused to comment on individual cases. After the ABC made inquiries, the accountancy firm, the company’s director and its sole shareholder all cut their ties with Trigo XO. The ABC does not suggest that Trigo XO or anyone connected to it was directly making the deceptive phone calls or publishing fake articles. Rather, the evidence suggests the company was used to launder payments generated by the scam, transforming stolen money into apparent sales of online courses. The director told reporters that the company’s real owner was based in Israel, and he arranged a call with a man named Shefi Goldberg.
Shefi Goldberg is a name that has surfaced repeatedly in connection with the Sapphire Network, although he denies any wrongdoing. On the call, Goldberg insisted that all questions about Trigo XO should be directed to him, not to his Australian colleagues. “We didn’t have any fraudulent activity,” he said. But Goldberg’s name was not on Trigo XO’s official filings, and he offered no proof that he owned the company. Later, in a statement to Swedish media foundation Qurium, he claimed, “I have no ownership, control, or any corporate involvement of any kind with Trigo XO Pty Ltd.” A closer look at his business interests, however, tells a different story. Goldberg is co-director of GoBe Marketing, a company that has operated call centres in Israel, Cyprus, South Africa, Spain and the Philippines, mostly selling visa services by telemarketing for immigration to the US and Canada. In South Africa, an offshoot called MSG Marketing was found by a court in 2021 to have processed payments for an investment scam, without a financial licence, while misrepresenting the transactions as immigration-related. Goldberg said he had never been involved in processing such payments. Then there is USC Market Place, another company linked to Goldberg, which received payments from Australian victims of the Sapphire Network in 2024. The ABC found that payments made by two victims, Susan and Anna, were logged in the Sapphire Network’s internal spreadsheets—the same spreadsheets that contained the contact details of more than 4,000 Australians. Susan had paid $378.50 to an unregulated trading platform called Finterex Capital, later added to Australia’s MoneySmart watchlist. Anna’s payments involved a platform called Ambit Capital. When asked about Susan’s payment, Goldberg texted, “Sorry but I have no clue about any of this.” But his fingerprints were all over the network’s documents. In a leaked screen recording from inside the Sapphire Network, a worker is seen using a payment processor called Smart Pay, inputting transactions into the same spreadsheets where Susan and Anna’s payments appear. Company records show Smart Pay was a trading name of Allegiant Holdings Ltd, a Cypriot company whose sole shareholder is Shefi Goldberg. He first denied owning any companies in Cyprus. When the registration documents were produced, he said he was only “registered” and not involved in day-to-day operations.
The impact of the Sapphire Network cannot be measured only in dollars. Rodger spent two years trying to cope with the aftermath of a fraud that took his savings, his security and, for a time, his dignity. He has now moved on with his life, but only by giving up any hope of recovering the money. He still remembers the hospital bed, the drip in his arm, the text message asking for money to buy a wheelchair, and the reply that suggested he scrape together another five thousand dollars. That memory does not fade. Toby is still close to the experience. He is trying to make sense of the psychological tricks, the fake dashboard, the fabricated debt, and the half a million dollars he is unlikely ever to see again. The shame of being scammed can be almost as painful as the financial loss, because the victims are left asking what they could have done differently, even when the machinery against them was designed by professionals to be invisible. The Sapphire Network operates like a corporation: it has call centres, software, payment processors, and front companies. It hides behind the anonymity of the internet and the secrecy of shell-company registries. It is part of a global epidemic of investment fraud that feeds on ambition, fear and trust. The journalists who exposed it, using leaked documents from inside the network, have made it easier to see how the system works. But seeing it is not the same as stopping it. For every company like Trigo XO that loses its accountant and gets exposed, another front company opens. For every broker who vanishes, another takes their place. The court records, the bank receipts, the spreadsheets and the photographs are all evidence of a crime that continues. Ultimately, the people who run the Sapphire Network are not strangers in a distant country; they are the men and women who once told a sick man in a hospital bed that they were sorry he couldn’t afford Christmas presents, and then asked him for more money. Until they are brought to justice, there will always be a Rodger, a Toby, a Susan or an Anna—someone who trusted a smiling face on a screen and lost everything because of it.