Scam payments lead to an Australian business and its Israeli owner

By Julian Fell

Story Lab

Topic:Scams and Fraud

Shefi Goldberg is linked to payment processing for investment scams in multiple countries. (ABC News)

In short:

Receipts from two victims of financial scams led to an Australian company called Trigo XO.

Trigo XO is part of a network of companies registered in multiple countries and linked to Israeli national Shefi Goldberg.

Leaked documents from inside the scam network contain multiple references to Goldberg's businesses.

Hooked up to a drip and awaiting surgery, Rodger was running out of options.

"You guys have all of my money tied up," he texted his broker. "I need … to buy a wheelchair."

Having put about $125,000 into an investment platform called The FBTC, he'd run into problems withdrawing his money.

He'd followed instructions from someone claiming to be a financial professional in Switzerland, who was now failing to return any of his money.

The broker said Rodger needed to switch to a new bank. His account was frozen. There were liquidity issues. He had to pay a fee. The excuses went on and on.

In the meantime, Rodger had to scrounge around to pay his medical bills.

He became increasingly desperate, telling his tormentor that he couldn't even afford to buy Christmas presents for his family that year.

"Sorry to hear that, Rodger," came the reply. "If you manage to come up with the 5k [more to invest] … would be perfect."

He never heard from his broker again. His money was gone.

The Sapphire Network

Rodger had fallen victim to an investment fraud group headquartered in Israel.

It is a decentralised network made up of dozens of companies and hundreds of people that has been operating since at least 2021.

More than 4,000 Australians have been targeted to date, often through fake news articles and false promises of AI-assisted trading. Once victims put their money in, they rarely see it again.

The scam group — dubbed the Sapphire Network — is known to operate out of central Tel Aviv and has been linked to call centres in Bulgaria, Ukraine, Cyprus, Macedonia and Israel.

Investigators at the Organised Crime and Corruption Reporting Project (OCCRP) estimate that the Sapphire Network has defrauded its victims of hundreds of millions of dollars, entirely through investment scams.

A call centre run by an Israeli company with links to the Sapphire Network. (Facebook: Sara Ieo)

Now, an ABC investigation has identified a network of companies that received payments from its victims, using documents from inside the Sapphire Network, which were leaked to Swedish broadcaster SVT and shared with the OCCRP in 2025.

Two reporting partners of the OCCRP — Swedish media foundation Qurium and the amaBhungane Centre for Investigative Journalism — also contributed to this investigation.

Fake articles, made-up names and invented debts

Rodger was scammed by operatives working with the Sapphire Network in June 2024.

Two years later, another Australian man, whom we'll call Toby, fell into the same trap. He was lured in by a fake news article, published on an almost-perfect clone of the ABC website.

A global scam is targeting Australians using AI-generated images of ABC journalists and politicians.

Over several months in early 2026, Toby was convinced to part with more than $500,000.

Toby deposited the money into a bank account his broker told him was set up in his name, but that he did not control. He was then able to trade in the oil and gold markets on the broker's platform.

As the Strait of Hormuz closed and opened again, Toby and his broker discussed the effects on global markets, sharing links to news articles about the US-Iran conflict.

As the trades played out, Toby saw his money multiplying on the dashboard.

But the entire situation was fake. There were no trades, and Toby's money was already long gone.

Just like Rodger had been two years earlier, Toby was eventually subjected to psychological tricks and pressure tactics. After some trades supposedly went wrong, they told him he was in debt for hundreds of thousands of dollars.

A screenshot of the trading platform that Toby was signed up to.

To pay down the fake debt, the scammers suggested that he apply for a range of loans against his home and business.

As they ran through their well-worn playbook, Toby and Rodger's "brokers" hid their identities and tried to avoid accountability.

They operated under fake names and communicated through encrypted messaging apps. They sent their victims fake documents in the name of non-existent companies.

But the money they stole was real, and it left a paper trail.

Do you know more?

Contact Julian Fell at tips@jtfell.com if you have any information about investment scams.

The receipt that led to a money laundering front

In the early stages of the scam, Toby's broker had asked for a small payment to open an account on the fraudulent trading platform.

This is a common tactic to onboard potential victims, ensuring they have money on the line early.

These initial payments—usually about $350—are often disguised as payments for online courses or immigration services. But this is only an accounting trick to pass them off as legitimate transactions.

In Toby's case, the payment went to a company called Trigo XO, which was based in the Melbourne suburb of Toorak.

The receipt for Toby's scam payment to Trigo XO. (Supplied)

The rest of Toby's money was sent to a bank account, which the ABC has been unable to trace to an owner.

But the more modest payment made to Trigo XO proved more fruitful.

Trigo XO operates three websites, each of which advertises online courses. When we tried to purchase courses on these sites, the cracks in this cover story immediately started to show.

No-one answered the phone number listed on the sites and the online checkouts were broken, displaying error after error when we tried to purchase a course.

After sending $365 to Trigo XO, another Australian scam victim was emailed a business leadership course by Trigo XO.

It was a 35-page PDF filled with generic platitudes about leadership.

The business leadership course that no-one asked for. (Trigo XO educational materials)

When we contacted Trigo XO's accountant about Toby's payment and the malfunctioning course sites, he expressed concern about the business's operations.

The accountant said he'd already made a complaint to Australia's anti-money laundering regulator AUSTRAC, as he had "no way to check" that the invoices coming through Trigo XO were legitimate. (An AUSTRAC spokesperson said the regulator could not comment on or confirm investigations into individual businesses.)

The accountancy firm, director and sole shareholder all cut ties with the company after the ABC contacted them.

The ABC does not suggest that Trigo XO or anyone associated with it was actively defrauding prospective investors through fake news articles or deceptive phone calls.

Rather, the company appeared to be used to launder payments made as part of the scam's operation.

Its role was to disguise the payments as sales of online courses for its ultimate owner.

The true owner of Trigo XO

Trigo XO's director said the company's real owner was based in Israel. He then set up a call with someone named Shefi Goldberg.

On the phone, Goldberg insisted that all questions about the business should come to him rather than to his Australian colleagues. "We didn't have any fraudulent activity," he said.

Goldberg's name was not on the company's official filings with Australia's business registry, and he provided no proof that he owned Trigo XO.

Goldberg later tried to distance himself from the company, telling Swedish media foundation Qurium he had no link at all.

"I have no ownership, control, or any corporate involvement of any kind with Trigo XO Pty Ltd," Goldberg said in a statement seen by the ABC.

However, a close look at Goldberg's wider business interests leads right back to the Sapphire Network and financial scams.

Shefi Goldberg at a call centre in Israel in 2018. (Facebook: Sara Ieo)

Goldberg is co-director of GoBe Marketing, which has operated call centres in Israel, Cyprus, South Africa, Spain and the Philippines. Its main business is selling visa services via telemarketing, mostly for immigration to the US and Canada.

A South African offshoot of GoBe Marketing, called MSG Marketing, was found to be processing payments for an investment scam in 2021, according to a South African court judgement.

MSG Marketing, which had no financial licence in the country, misrepresented these transactions as immigration-related. The payments were then flagged as suspicious or fraudulent by its bank.

"I was never involved in processing any of such payments," Goldberg said.

And then there's a third company, also linked to Goldberg, which received payments from Australian victims of the Sapphire Network back in 2024.

Victims logged in scammers' spreadsheet

Payments from two Australian scam victims were made to USC Market Place, an Israeli company that lists an employee of GoBe Marketing as its director.

New South Wales Mid North Coast resident Susan paid $378.50 to Finterex Capital, an unregulated trading platform that was later added to Australia's MoneySmart watchlist.

The ABC found Susan's contact details — and this exact payment — logged in the Sapphire Network's internal spreadsheets, along with those of another 4,000 Australian victims.

Susan was later refunded when she disputed the charge.

Two payments from another Australian victim, Anna, also line up exactly with the scammers' internal spreadsheet. The fraudulent platform she interacted with, Ambit Capital, was named alongside her transactions.

When asked about Susan's payment, Goldberg texted back: "Sorry but I have no clue about any of this".

And yet, the Sapphire Network's internal documents contained another clue about his involvement.

Goldberg's fingerprints in the Sapphire Network

In a screen recording leaked from inside the Sapphire Network, a back-office worker is surveilled as they toil away in a spreadsheet.

The video shows an inside view of the scam network's money laundering operation, in which a payment processor called Smart Pay plays a starring role.

On one monitor, the worker pulls information from the Smart Pay dashboard.

A screenshot of a Sapphire Network staffer using the Smart Pay dashboard to log payments. (Supplied: OCCRP)

On their other screen, they log payments in a spreadsheet similar to the one where we found Anna's and Susan's payment details.

Later, the worker switches to an encrypted message thread titled "Smart pay — ScholarCloset", and continues their mind-numbing work of logging payments.

Several other videos in the leak connect this payment processor to Shefi Goldberg.

Smart Pay was integrated into the Sapphire Network's payment processing infrastructure. (Supplied: OCCRP)

A spreadsheet of transactions is shared by an email address info@smart-pay.biz — the main email address of a company called Allegiant Holdings Ltd. That company previously traded as Smart Pay.

The same company name appears in another video, in which someone named Ronen demonstrates how to create payment invoices for $US250 each — the exact cost of the initial charge made to many scam victims.

Company records show that this company, Allegiant Holdings Ltd, is registered in Cyprus and is not to be confused with the unrelated Allegiant Holdings Ltd registered in the UK.

When first asked about Allegiant Holdings Ltd, Goldberg denied owning any entities in Cyprus. But the company registration documents tell a different story: Shefi Goldberg is the sole shareholder.

It's another link between Goldberg and the Sapphire Network, in addition to the scam payments made to three separate companies connected to his business.

Goldberg later said in a statement: "With respect to the Cypriot company, it is used for the provision of services. I am merely registered in connection with the company and am not involved in the management or day-to-day operation of its business."

It has been two years since the Sapphire Network scammed Rodger. He's moved on with his life, having given up on getting his money back.

But for Toby, the effects are still fresh. He is trying to make sense of the tricks played on him, the lies he was told, and the half a million dollars he is unlikely ever to get back.

How we reported this story

See more ABC coverage in your search results

Practice Listening