Crazy. She won an iPhone. Just by taking part in an online survey.
That, at least, is what she thought.
The 50-something woman from Scotland, we’ll call her Martha Campbell, believed what she read on her screen in early 2021. For just a single pound, the new smartphone would be hers. The artist entered her credit card details and the transaction was processed. "It was too good to be true,” she says today. The iPhone never arrived.
"Dirty Payments" is a reporting project involving DER SPIEGEL and 20 international media outlets, coordinated by the consortiumEuropean Investigative Collaborations(EIC). The project is based on documents received by EIC and DER SPIEGEL and shared with the other partners.
The stories published on the basis of those documents offer deep insight in the dubious practices of a European financial giant. The publicly traded French company Worldline and its German subsidiary PAYONE have processed payments worth billions of euros since 2014 that have benefited unsavory porn and dating sites, prostitution, online casinos and suspected money laundering.
"Dirty Payments" shines a light on the structural weaknesses of the financial sector. The reporting shows who stands behind the well-known scams and who their victims are.
Instead, someone sucked more money out of Campbell’s account a few days later, 49 pounds this time, the equivalent of around 57 euros. Unbeknownst to her, she had signed up for a subscription to a music streaming platform.
The website’s imprint lists an address in Cyprus, a shell company like tens of thousands of others registered in the island nation – designed to obscure the true profiteers. But confidential documents now reveal where Martha Campbell’s money likely ended up – in the United Arab Emirates, in Dubai. In the Aether Group empire.
A joint reporting project involving DER SPIEGEL and 20 additional international media outlets, coordinated by the reporting consortium European Investigative Collaborations (EIC), for the first time provides a deep look into the operations of Aether, a group operating worldwide that has likely swindled tens of thousands of people across the globe with subscription traps and fake dating platforms. Aether has denied the allegations.
The "Dirty Payments” project leads to the Philippines, to the United Arab Emirates and to the Netherlands. Internal documents, including emails, presentations and contracts, combined with interviews with former employees paint a picture of an unscrupulous company that appears to have built up a global shadow empire over the years. According to information compiled by a consulting firm in 2024, the Aether Group collected annual revenues worth the equivalent of 180 million euros. According to that report, a 58-year-old German is the company’s advisory director and a member of the board.
The confidential files received by the EIC and shared with its partners now confirm the existence of more than 1,000 authentic-seeming websites operated by around 300 shell companies. In the documents, the websites and companies are attributed to the Aether Group. There are numerous indications that the websites and shell companies mentioned in the documents represent only a part of the entire network.
The international scheme also apparently involves PAYONE, one of the most important German payment service providers, stakes in which are held by the French company Worldline Group and the German Sparkassenverlag. Fifteen of the approximately 300 shell companies revealed in the documents processed some payments through PAYONE, while the rest were processed through the French parent company or its other subsidiaries.
Little can be learned about the beginnings of Aether. What is certain is that the company has been registered in Dubai for almost 10 years as Helpfuel Services. It operated under the name Linkmedia until the end of 2023, when it was then renamed Aether.
On its website, Aether describes itself as a "global omnichannel marketing agency” with "clients across every time zone.” Beyond its Dubai headquarters, the website indicates that the company operates additional branches in Amsterdam, Copenhagen, New York, Hong Kong and Manila and it also claims to have partnerships with Google and Meta. But no addresses for the alleged branch locations are listed.
When contacted, both Google and Meta said that they had no partnerships with Aether. Reporting by DER SPIEGEL and its partners has revealed that the company has apparently specialized in two forms of internet fraud.
[M] DER SPIEGEL; Fotos: manaemedia / ddp, PR
He saw the ad for a projector on Facebook, for "an incredible 3 euros.” This is what one user wrote on the Trustpilot review platform.
When he clicked on the ad, he says, he was redirected to a shop. He filled out a purchase form and the three euros were charged to his card. But instead of buying a projector, the man had actually signed up for a premium membership to an electronics shop. "Three euros is just a partial payment for the total price of 32.99 euros,” the user says. "This shop is nothing more than a subscription trap.”
Documents in possession of DER SPIEGEL and its partners now show that the British shell company that operates the site is listed at Worldline as a company with links to Aether.
A former Aether employee is interested in explaining the connections. But he doesn’t want to talk over the phone or meet in person. Instead, he describes in long emails how victims are defrauded.
According to the former employee, Aether sets up shell companies in the UK, Cyprus and the United States with which the company, on paper at least, is unconnected. Streaming services and shopping sites are then operated via these companies. Aether then brings these supposed merchants together with banks, says the insider. Because the sites act like they sell real products, the banks establish accounts for them. Then Aether takes care of the marketing campaign via text messages and on Facebook or Google – alerting people to alleged prizes they have won or to significantly discounted consumer items. Users who click on the ads are redirected to one of the sites, where they are instructed to enter their credit card details. The fact that by doing so, they are signing up for one or more subscriptions, says the insider, is hidden in the small print and is frequently overlooked. Many users, he continues, also don’t read the follow-up email informing them of their subscription. "That is the real business model,” says the former employee. Whether it crosses the line into illegality or is merely morally questionable has not yet been established.
The net that Aether apparently casts looks vast. Internal files list the names of more than 1,000 websites. An analysis of more than 3,000 Trustpilot reviews of these sites produced an average rating of 1.04 – with the lowest possible rating on Trustpilot being 1.0.
Around 800 of these sites run on the same pair of servers, an indication that they are operated by the same company. An additional roughly 900 websites can be found through a reverse search, and many are similar in structure. The oldest of them are from 2015, and the most recent ones are from December 2024. The site helpfuelservices.com also runs on one of these servers, a website with the name under which Aether has been registered in Dubai since 2016.
DER SPIEGEL and its partners have approached more than a dozen of the websites now known through their contact addresses to ask about their negative customer reviews. Only the operator of the Inn2Flix site responded.
Inn2Flix is a streaming site that promises users they can "watch the best movies.” But the site only has lesser known films like "The Beach Girls and the Monster” from 1965 and "Aerial Gunner,” a black-and-white movie from 1943.
Users can test the site for three days for just 3 euros. After that, the subscription price rises to 64.90 euros per month. Not a particularly attractive offer, particularly given that a subscription for market leader Netflix goes for just 4.99 euros. But it appears that the website’s business model is actually a different one:
According to the site’s imprint, it belongs to the company Syntevy Limited, a shell company registered in Cyprus. Syntevy is also listed as the operator of other entertainment sites, such as online gaming sites. Syntevy is also linked to Aether in the internal documents.
According to the commercial registry in Cyprus, Syntevy was registered in 2019; the sole shareholder is listed as a woman from Lithuania. A 60-year-old woman from Greece is both director and secretary. According to the company’s annual report, Syntevy had revenues of almost 370,000 euros in 2023, but that only translated into a profit of 4,320 euros – for a return on sales of just 1.2 percent.
Most of the company’s revenues, almost 365,000 euros, went toward covering costs, according to the annual report. The director received just 1,000 euros.
When contacted by DER SPIEGEL and its partners, Syntevy claimed to have nothing to do with any form of "scam.” "This is not how we operate.” Questions regarding financial details – "as you understand” – could not be answered.
[M] DER SPIEGEL; Foto: Teraphim / Getty Images
In April 2024, a user experienced the miracle of online love. The man, who calls himself Nathan and claims to be a 70-year-old from the U.S. state of Virginia, exchanged 800 messages with "SOlemnSari4eva.” She is, it seems, a deeply-in-love woman of 33.
The two of them met on a dating platform. In order to write to the woman of his dreams, Nathan has to purchase credits, which are offered in packages. The most expensive of those packages, 300 credits, costs the equivalent of several hundred euros. In April 2024, Nathan had just 100 credits left.
The fact that her messages don’t always match well with his, the changes in spelling and punctuation style, the shifting nicknames – none of that seems to bother Nathan.
He speaks of moving in together. Of the fact that he needs her. That he is waiting for her.
She sends nude photos. Legs spread, no face.
Her profile photo is an image of a well-known influencer. Screen recordings in possession of DER SPIEGEL and its partners show a chat program that matches up professional writers with paying customers. Instead of exchanging messages with "SOlemnSari4eva,” Nathan is chatting with 24 different men and women. Their names are noted beneath the messages.
Home of the Dripdesk call center in the Philippines.
Nathan’s chat partners sit in a glass building on a main traffic artery in Metro Manila in the Philippines, a call center called Dripdesk Asia. Hundreds of employees work here around the clock, posing as attractive women behind photos they have copied from social network profiles and porn websites. When two reporters ask about the company in the lobby of the building, an hour passes before the chief executive appears himself. He acts surprised. "We are a legal business with many customers around the world,” he says. He insists they have nothing to do with fraud.
But the story told by a former employee paints a different picture. "Our job was to engage users in conversation and encourage them to keep spending money,” the man says. "There were set quotas: 32 to 35 messages per hour (around 250+ per day), regardless of whether anyone responded.” He says he needed the job to make ends meet. Over time, though, he says, he found chatting increasingly difficult.
"Eventually, I stopped sexting customers and began asking them about their day, just to make myself feel better. Some users believed they were talking to real people. One even sold their belongings to keep chatting, while others remodeled their homes hoping 'we’ would live with them,” he says. Files in possession of DER SPIEGEL and its partners, including the certificate of incorporation, indicate that this call center belongs to the Aether Group. Some of the dating sites for which the Philippine chatters work also appear to be linked to the company in the Emirates.
Such as the platform called Searchingforsingles. According to the site’s imprint, the platform belongs to the British shell company Hellerman Limited. That company name, along with Searchingforsingles itself, appears in internal documents linked to Aether. The dating platform’s small print reads: "You do understand, acknowledge, and agree that profiles on this Website are imaginary (…). Physical meetings, video calls, or any form of real-world interaction are not possible.” But it isn’t difficult, particularly for older people who sometimes have a hard time safely navigating the internet, to overlook this crucial piece of information.
In response to a written query, the Dripdesk executive reiterated that he categorically denies any involvement in, or responsibility for alleged misconduct. Hellerman Limited left an email unanswered. User Nathan could not be reached by reporters.
[M] DER SPIEGEL; Foto: Verin Makcharoen / Getty Images
For business transactions to work on the web, a payment service provider is needed, companies like Worldline and PAYONE that operate as intermediaries between merchants, credit card companies and banks. Internal files demonstrate that the business relationship between Worldline and companies from the Aether network have existed at least since March 2016.
In November 2021, an agent approached Worldline for the inclusion of 131 additional shell companies. Ignoring the recommendation of the risk manager, Worldline took them on as customers – without prior background checks aimed at preventing white-collar crime, money laundering and terrorist financing. The "estimated required timeline” to "complete due diligence is three to four months,” reads one internal document. Because the agent has been "a trustworthy partner to WL for many years,” the recommendation was made for a "fast track onboarding process.”
One-and-a-half years later, serious doubts apparently emerged about the integrity of the new clients. In a presentation from 2023, those responsible noted "concerning findings.” Among other indicators, they wrote, it was striking that almost half of the companies the agent had brought to Worldline were based in Cyprus. The German supervisory authority BaFin, the paper noted, "has identified additional concerns” – followed by, in brackets: "shell/empty companies & fraudulent activities.”
In response to a query, Worldline said it had increased its standards for agents, especially since 2023. After BaFin initiated a "formal supervisory action” in 2023, the company noted, PAYONE cut ties with numerous merchants "that were no longer aligned with regulatory expectations or updated internal standards.” The German subsidiary elaborated in a statement, writing that it "immediately initiated enhancements to its risk framework, governance structure and control environment” including "mechanisms designed to prevent future transactions with similar customer profiles.”
The internal documents indicate that companies from the Aether empire were also terminated in the purge. Worldline and PAYONE, however, did not answer a question as to whether relations have been severed with all companies linked to Aether. The two companies wrote that they were unable to provide comment on individual customer relationships.
It’s an April week in Dubai. A concrete desert surrounded by desert sand, 39 degrees Celsius during the day but a bit cooler in the evenings. This is where the Aether empire is apparently headquartered, in the Dubai Multi Commodities Centre (DMCC), one of the Emirates’ 23 free trade zones that have their own laws and where taxes are low. Insiders say that the group is made up of half a dozen companies, but only one of them is real. The others are also shell companies.
"These companies act as service providers to merchant companies and then charge those companies for these services,” says a former employee. Because there is no legal requirement in Dubai that annual reports be made public, it isn’t possible to determine how much money flows through the companies and where it ends up. If former employees are to be believed, the money ultimately ends up with Aether.
On the internet, the companies present themselves as advertising or digital agencies, but they provide no information on company executives or ownership structure. In the free trade zone’s commercial registry, three different men with anodyne-sounding names are listed as "sales license manager.”
The companies declined to respond to queries from DER SPIEGEL or its partners and there is no clear paper trail to Aether. There are, however, indications – such as a paycheck that names one of the alleged shell companies and Aether together as an "account,” and a pair of servers that runs the websites of all the DMCC companies named by insiders – in addition to the Aether website itself.
Is work actually performed in these companies?
No, says the concierge in a lobby decorated with a large aquarium, the employees of these companies don’t show up very often.
No, nobody is there from the company, says the receptionist of a different building. But it is possible to take a look at their desk. It is a so-called flexi-desk – a shared workspace that can be had for a yearly rate of 4,700 euros, including internet, tea and 100 black-and-white copies per month.
Alleged offices in Dubai: "They just need it for the trading license."
[M] DER SPIEGEL; Fotos: DER SPIEGEL
In a well-secured building on the side of a busy road, the security guards laugh when the reporters ask about the company they are looking for. "It’s just a desk, no name on it. It’s just a virtual address. They need it for the trading license."
A few kilometers further on, at Aether headquarters, is where the heart of the fraudulent activities is thought to beat. Photos and videos, posted to the internet by workers themselves, show what the daily workday looks like inside the high-rise, with its façade of glass and stone in the middle of Dubai: free lunches, town hall meetings, family days and charity events.
They celebrate Iftar together, the breaking of the fast during Ramadan, and when someone has a birthday, they are allowed to spin the wheel of fortune, where they can win gift certificates for the cinema, the shopping mall and supermarket, or flowers, or even extra vacation days.
Photos also show two top executives: Niels Denekamp, a 36-year-old from the Netherlands, and Peter Burchardt, a 58-year-old from the German state of Lower Saxony, born and raised in a town of 1,400 between Berlin and Hamburg. After spending six years as Aether’s CFO and acting operational director, Burchardt is now apparently working as an advisory director and member of the board. He declined to respond to a query from DER SPIEGEL and its partners.
In contrast to the other buildings, there are no security gates at Aether. Instead, you say hello to the portier, take a right and push the button for floor 6 in the elevator. The ride takes just a few seconds before the elevator doors open onto a modern reception area with a scratched linoleum floor and a counter reading "Helpfuel Services DMCC, Dubai Branch.”
Empty meeting rooms have names like "Tulum” and "Beverly Hills,” and a light-colored Maltipoo, a cross between a Maltese and poodle, runs through the deserted corridors. The company is once again in the process of relocating, with the new, open-plan office on Sheikh Zayed Road, one of Dubai’s main thoroughfares, becoming the company’s third address in six years.
When asked about the whereabouts of Mr. Denekamp, a woman says: "Niels is out of the office today, maybe tomorrow too. You know how he is, always busy. In and out.”
Denekamp’s lawyer gets in touch late in the evening, however. A man from the Netherlands, specializing in real estate law. In the name of his client, the lawyer demands that the journalists refrain from seeking to meet in person with Denekamp without prior arrangement or to approach his office.
Reporters from DER SPIEGEL and its partners spent several months trying to meet with Denekamp in a number of different countries. To no avail. He did eventually send answers to a 15-page catalog of questions through his lawyer: The company "categorically denies any involvement in unlawful or fraudulent activity,” in addition to claims that the company is the economic beneficiary of a network of shell companies. Aether, the statement insists, is a provider of digital infrastructure and marketing services, with the merchants acting independently. "Our role and visibility as a service provider does not equate to ownership.”
Denekamp also commented on his personal role. Any suggestion that he is "involved in unlawful or misleading practices is unfounded.” In his work, he claims to "have consistently aimed for transparency and compliance with applicable regulations.”
Aether moved into its new space in late April, around three dozen desks on the 24th floor of a skyscraper. Out of the free trade zone and into the heart of the city. An employee took her TikTok followers along to her first day working in the new environment. "It’s a coworking setup, which means we don’t have to go in every day,” she narrates off camera. In the video, she shows a large glass wall and waving colleagues – and herself: eating, typing, at the coffee machine.
In a mix of English and Flipino, a user asks about her line of work: "Hi, ano po line of work mo? if u don't mind :)"
With reporting by Friederike Röhreke
