The Role of Card Payments in Online Fraud
Card payments remain one of the most widely used online payment methods. In many cases, the only way to trace the acquiring bank behind a transaction is by reviewing the billing descriptors set by the acquirer.
Investigations have revealed billing descriptors that were used by Payvision when processing transactions linked to cybercrime operators Gal Barak and Uwe Lenhoff. Victims who lost money through these schemes may have encountered the following descriptors on their credit card statements.
Gal Barak and the Network of Broker Scams
Gal Barak, also known as the Wolf of Sofia, operated the cybercrime organization E&G Bulgaria, which facilitated numerous fraudulent broker brands, including:
-
OptionStarsGlobal
-
Safemarkets
-
XTraderFX
-
Golden Markets
Payvision played a key role as a payment facilitator for these operations. Court documents and independent investigations have identified specific billing descriptors used in the processing of payments for these scams.
Billing Descriptors Linked to Payvision
The following table summarizes the known descriptors connected to fraudulent brands associated with Gal Barak and Uwe Lenhoff:
|
Scam Brand |
Billing Descriptors |
|
OptionStarsGlobal |
OptionStarsGlobal, 442080687603 BG; OptionStarsGlobal, 442080687603 BGR; OptionStarsGlobalFBX*OptionStarsGlobal 442038070647 GBR; OSTARS 442038070647; OSTARS 44203767791 |
|
Safemarkets |
Safemarkets TallinCity; Safemarkets 10117 TallinCity EST; safemarkes TallinCity EE |
|
XTraderFX |
Cryptopoint 442033183272; Cryptopoint 442033183272 GBR; xtraderfx W3 GAY 442033183272 GBR; Cryptopoint, W3 GAY 442033183272, GBR; xtraderfx,442033183272; xtraderfx/+442033183272; xtraderfx 442033183272 GBR; INTL xtraderfx 00507750420; xtraderfx; VISA xtraderfx |
|
Option888 |
Option888, Haslemere; Option888 Gzira MLT; Option888 Gzira MT; Option888 BIRKIRKARA; Option888 BIRKIRKARA 046; Option888, GU27 zLA Haslemere, GBR; Option888 London |
|
Tradovest |
Tradovest 442037691058; Tradovest Doncaster; Tradovest |
|
Tradeinvest90 |
Tradeinvest90 442080685120 |
|
Golden Markets |
Goldenmrks |
What Victims Should Look For
If any of the above billing descriptors appear on a credit card statement, it indicates that payments were processed through Payvision on behalf of these fraudulent platforms.
How to Share Information
Victims and whistleblowers with knowledge about Payvision’s involvement in these activities are encouraged to report their information. Submissions can be made confidentially through the Scam-Or Project website.
Additionally, individuals can share information directly with Scam-Or Project, an independent investigative media platform monitoring financial fraud.
Key Point: If your credit card statement shows any of the listed billing descriptors, it strongly suggests that your payment to the scammer was facilitated by Payvision.