BELGRADE -- Last September, 86-year-old Ann Bratton thought she'd stumbled onto the investment of a lifetime.
An ad on one of the encrypted Telegram app channels the Nashville-area retiree had joined was offering debit-like "Trump cards" featuring the billionaire U.S. ex-president's image, each supposedly preloaded with $200,000. After years of forking out tens of thousands of dollars on souvenir banknotes, coins, and other Trump memorabilia, she calculated that she could quickly and easily turn a $6,000 investment into a $4 million nest egg.
What she didn't know was that behind the offer of "Trump Collection" cards was an opaque group of web-based vendors from a faded industrial city 8,500 kilometers away. And that city, in the Balkan country of North Macedonia, was already notorious for being home to legions of scammers who had fraudulently monetized Donald Trump's popularity in the United States and around the world.
Neither the Republican presidential hopeful Trump nor any of his organizations appear to have any connection to the manufacturers, platforms, or sellers.
But it's an open secret in this corner of the Balkans that a startlingly successful digital disinformation and fake news industry that emerged in the Macedonian city of Veles alongside the political rise of Donald Trump helped lay the groundwork for a thriving new business in fraudulent goods marketed through encrypted channels to Trump-style conservatives and "patriots" an ocean away.
And local authorities have acknowledged that the perpetrators appear to be netting huge profits by convincing pro-Trump Americans that a return to power of the 45th U.S. president will ensure huge windfalls for holders of the knockoff goods.
"I believe in President Trump, and I think he is honest. I believed that I was investing in the future," Bratton said of her seven-year splurge on quasi-banknotes, tokens, coins, and more recently the bogus debit cards. "I can't even remember where it was all advertised."
Months of research and infiltration of closed groups on the Telegram platform by RFE/RL's Balkan Service have identified 69 individuals who posted offers for such fraudulent cards, with the digital trail placing two-thirds of them in Veles. The journalists found that most of the 88 websites actively hawking such products to "American patriots" had domains registered in Reykjavik, the capital of Iceland.
The number of vendors offering them to unwary customers is likely to be much higher, since several of the closed Telegram channels that they were using had upwards of 300 members.
One of the typical Telegram communications -- carefully protected by an administrator acting as a gatekeeper but seen by RFE/RL journalists -- offered the advice: "Be sure to...[get] specific instructions on how to deceive the Americans."
One of the websites selling the Trump-themed debit cards
Veles and its 45,000 or so inhabitants became synonymous with opportunism around the Trump movement ahead of the 2016 U.S. presidential election, when more than 100 political websites sprung up there spreading fake news and appeals on hot-button campaign issues.
SEE ALSO: 'Fake News' Sites In North Macedonia Pose As American Conservatives Ahead Of U.S. ElectionThe sites used content from fiercely partisan blogs and advertised it via Facebook, generating millions of views per month.
Veles, North Macedonian
How Does The Latest Scheme Work?
So far, there has been no apparent response to the misleading ads by the competent authorities in the United States -- the FBI and the Federal Trade Commission -- or in North Macedonia.
RFE/RL's Balkan Service sent multiple e-mails to Trump's campaign press team inquiring whether they were aware of the "Trump cards" or were planning any response. RFE/RL has not received a response.
The formula is remarkably simple, on its face: A story is promoted with American readers in mind according to which products with Trump's image -- for example, coins, stickers, and stamps -- will become a currency in the future and worth millions once he's back in power. Stories suggesting swift financial returns are also distributed via digital channels, frequently zeroing in on Trump supporters.
It is a new, supercharged spin on an old grift.
Back in 2016, advertisements for collectibles like "Trump coins" or "Trump dollars" appeared on Telegram channels. Fraudsters' follow-up stories suggested the novelties would become legal tender in a "future Trump monetary system," sometimes making references to cryptocurrency.
The New York Times reported in 2022 that the fraud hinged on the sale of "Trump coins" that were free for the asking but included a $9.99 charge for "shipping and handling." The ads included fake screenshots of celebrities urging people to invest as soon as possible "because the real money will soon disappear."
In the middle of 2023, NBC News revealed that three companies based in Colorado were behind a "Trump bucks" scheme. The report detailed the machinations behind the "Trump Rebate Banking System" (TRB) and described the experiences of some of its victims.
The "Trump card" strategy that was analyzed by RFE/RL has been employed since at least September 2023 and is mostly based on individual sellers' networking through online platforms, rather than any single entity. Communication is conducted through closed Telegram channels, while virtual marketers post false ads to Telegram channels that are open to the public. News that is thought to be of particular interest to a conservative U.S. audience is also shared on those same public channels.
An ad on a Telegram channel advertising a "TRB Collect Card"
It peddles the premise that people who own TRB products can retrieve returns on previous investments, encouraging them to believe they are simply cashing out with the use of the new cards. The prices of the cards can reach into the thousands of dollars.
"In short, the story will be that they need this product so they can cash in on other TRB products by withdrawing $5,000 every day at the ATM," one of the closed channels promoting the cards says. The language used to promote the products is often vague and obfuscating. "They can register up to $500,000 on each card."
It was just such an ad that roped in Bratton, dangling the prospect of cashing in on years of online purchases. She ordered her cards in late September 2023 and received the first one by mail by early October.
"I have been through a nightmare for the last year," Bratton told RFE/RL. "Counting all the people I have worked with during this time, I have spent well over $30,000 just for cash-out."
Multiple individuals have contacted her, purporting to be "support" within the TRB, including someone calling themselves Abigail.
"This Abigail person, she told me I needed to get those [cards] and she would activate these cards after I got them in the mail," Bratton said. "So, I did get them in the mail, and then when I got back on her site, I couldn't find Abigail anywhere.... It's just like she dropped out of the sky or something, you know?"
Bratton shared detailed information about the shipment and a photograph of a "Trump Card" with RFE/RL.
An investigation by RFE/RL's Balkan Service showed that the card was offered on a closed Telegram channel through which Macedonian merchants communicate. The card's QR code leads to a website, Trbcollectcard.net, presented by something called "Agenda 47" with a headline boasting that "America's Comeback Begins TODAY!" An image of a "Trump Card" with the ex-president's likeness bounces tantalizingly above a big, red "Order Now" button. The site's online registration and other clues lead squarely back to the Macedonian city of Veles.
Payment-platform data showed that Bratton's card purchase was registered by an individual identified as Vesna Laftova. There are no e-mails, phone numbers, or other contact listings for such a person.
The 'Clicksters' From Veles
Of the 69 creators of similar products for sale, data from social networks shows that at least 45 declare their location to be Veles. They include individuals describing themselves as students, superintendents of children's playgrounds, men's suit salespeople, the owner of a local butcher shop, and many other ordinary walks of life. RFE/RL contacted some of them, but all of them declined to talk.
Once the second-largest industrial city in the former Yugoslav Republic of Macedonia, Veles was suffering unemployment of around one-fifth of its population, or 10,000 people, by the 2002 census, 11 years into its post-Yugoslav transition. That number was down to 3,000 declared jobless residents by the last census, in 2021.
Veles has seen significant industrial decline.
Veles Mayor Marko Kolev says signs of the industrial collapse of the 1990s are still apparent. He told RFE/RL's Balkan Service that the breadwinners in many families, including his own, lost their jobs.
"Some of the young people have found a way to quickly earn serious financial resources, but now I see that the next generations of young people are also following the same path," Kolev said. He'd heard that "some Trump products" are being sold, he said, but the city can only speculate about such things.
Veles Mayor Marko Kolev
Still, he acknowledges, it is something of an open secret. "Honestly, I don't know how legal or illegal it is, but there is probably abuse because some of the things that are marketed in those [Telegram] groups are that 'if Trump came to power, some of the things being sold would have a higher value,'" he said. "This is how U.S. citizens are [being] manipulated."
Kolev says he hasn't discussed such things with investigatory authorities, because there's not enough evidence.
Local IT professional Borce Pejcev says he believes not all of what's happening is legal. He is a programmer for an international high-tech company but has been offered outside work designing websites for some of the scammers.
"Two years ago, they contacted me to create their websites and to create scripts for them. I turned them all down," he said. "They offered me a percentage, but I told them I didn't want to." He acknowledges that his refusal was motivated at least in part by not wanting to "help people who break the law." He declined to name any specific websites or their backers out of concern for his personal safety.
He says there's a new term among locals for the new generation of people peddling fraudulent products like fake debit cards. "When you see, for example, a 20-year-old driving an [expensive] car in town, you can tell that these are what we call 'clicksters' here," Pejcev said, "because, actually, their job comes down to that: clicking."
Veles's mayor describes the luxury cars zooming around the city as window-dressing by their owners, intended to recruit more people into the business. "You can't force someone to work and advance step by step when someone of his age has earned half a million euros or 1 million or 2 million euros overnight," Kolev said. "You see him in Dubai on a yacht -- how can you force his peer to be an engineer and work for an average salary in a local factory?"
Covering Their Tracks
One of the websites selling a version of the "Trump Card" was registered in early February to Veles resident Borce Velkovski. Contacted by RFE/RL's Balkan Service, he described his role in the business as minor. "Only my name was put there because I have partners who were not allowed to put their name [in the registry]," he said. "Now I have a percentage of it, but it's nothing special." He declined to elaborate, and said everything connected with the operation of the website was carried out by other people.
One of the websites that has now been deactivated
"There are things I can't and don't want to say -- who my partners are and what they're doing. That's a secret," he said. "They work like everyone else worldwide, they sell. That's how this is sold. I don't know what the dispute is." Saying he was "on a completely different side," Velkovski pledged to deactivate the site. Within days of his conversation with RFE/RL, the site was down.
Deepfakes
The "TRB Collect Card" that Bratton bought from Tennessee is a product that was routed through the closed Telegram channel "TRB Collect Card + Save America Coin," which began operating on September 12, 2023. Instructions to would-be vendors are written in Macedonian. Almost daily, new ads are posted that sellers are encouraged to disseminate through specific Telegram channels populated by users mistrustful of traditional media.
Over the course of the "TRB Collect Card + Save America Coin" channel's first four months, more than 150 ads were placed that appeared designed to attract U.S. customers. Many used images of Trump or members of his family or associates, or public figures seemingly holding the products. All of the images were doctored, with the cards or coins inserted into the original photos.
The doctored photo, on the left, and the original image
The doctored photo, on the left, and the original image
The recognizable faces used by the scammers included entrepreneur Elon Musk, actors James Woods and Russell Brand, political commentators Tucker Carlson and Ben Shapiro, and Donald Trump Jr. and Ivanka Trump.
It also included deepfake video of ex-President Trump seemingly advertising TRB cards and calling them a unique product that will make money for everyone.
Analysis of fake video of Melania Trump and Tucker Carlson
Such ads subsequently appeared on open Telegram channels where dubious and conspiracy-minded reports from right-wing American blogs are frequently shared, perceived Trump successes are glorified, and U.S. President Joe Biden and other administration figures are harshly criticized.
How A Network Of Sales Sites Is Created
From such misleading ads, Telegram links lead to similar websites. The texts on those websites are brief and, in many cases, use identical keywords and catchphrases.
None of the owners of the 88 websites that RFE/RL analyzed using the DomainTool application were identifiable through a simple search. Their domains are registered with Namecheap, an ICANN-accredited domain-name registrar and web-hosting company that is based in Phoenix, Arizona. In nearly all 88 cases, the site address is listed as being in Reykjavik.
"The Icelandic company that exists to hide the real owners of the site is called Withheld For Privacy, and the Icelandic police are investigating this company," Steinarr Kr Omarsson, detective and chief inspector with the national police force, told RFE/RL. He said the company had no functioning local offices, local operations, or staff in Iceland and that their investigation showed the company to be an outpost of U.S. Namecheap.
"The main reason for Withheld For Privacy seems to be to obfuscate the path for legitimate authorities to access relevant information in their investigations," Omarsson said. He added that Icelandic authorities would cooperate in any investigation if they received a proper request from the competent authorities of other countries.
The Role Of Payment Platform CopeCart
The websites' digital path next leads customers to a payment platform, which in this case is CopeCart. CopeCart was established in Germany with a U.S. branch that has been licensed to do business in Florida since January 2022.
More than 80 of the websites analyzed by RFE/RL are connected to CopeCart's Florida operations. A review of registered products showed that 90 percent of the offers for virtual merchants to participate in sales involved "Trump" cards, coins, or similar products.
"In terms of your question about '90 percent of products sold on CopeCart'...there are no products or services sold on CopeCart. Perhaps the confusion is with an affiliate marketplace where a small percentage of registered vendors offer 'affiliate commissions' and are looking for referrals to their sites (not CopeCart)," a Florida company representative told RFE/RL. "This product set is not representative of the products and services sold using CopeCart technology."
In a brief telephone conversation with RFE/RL in which he was told that multiple Internet users had complained of being deceived by "Trump" products bought through the platform, CopeCart Florida manager Vsevolod Onyshkevych stated repeatedly that the CopeCart platform did not tolerate fraud.
"If there is any fraud, they should first get [the] vendor, they can get to us, or their bank," Onyshkevych said. When asked if CopeCart had reported any such cases to the authorities, he said that they "strictly follow the procedures."
The company insists it has a "strict zero-tolerance policy regarding the sale of certain products." All memorabilia-like offers must state that they are of "no cash value." All of the products scrutinized by RFE/RL included a warning in their description stating that they were souvenirs.
ATMs Just 'Shoot It Right Back Out'
After Bratton received 20 "Trump Collection" cards in October 2023, eager for her payout, she tried to use them to withdraw some of the promised cash from a local ATM. "The point I saw [advertised by the vendor] was that I can go to any ATM and withdraw cash, so I did that," she said. The ATM "just shot [the card] right back out, you know." She tried several other ATMs, including one operated by Bank Of America.
A doctored image, on the left, alongside its original
Bank Of America, the United States' second-largest bank, was among the institutions most frequently mentioned in the false ads as locations where purchasers could use their "Trump" cards to withdraw money.
"Bank of America has nothing to do with those products. These are souvenirs," William Halldin, a senior bank media representative, told RFE/RL. He said there were no figures to suggest how many people had tried to cash in on such products. Asked whether there was any way the cards could be turned into cash from his institution, Halldin was brief: "No."
A Freedom of Information request by RFE/RL to the Federal Trade Commission, which is tasked with protecting U.S. consumers, had not yielded a response by the time this article was published.
If It Sounds Too Good To Be True...
Retired FBI agent and cybercrime-prevention expert Scott E. Augenbaum says the toughest part of the job is explaining to citizens who buy items like Bratton's that they will most likely never get their money back. "If it seems too good to be true, it probably is. I'm just telling people, be careful. Because if we had this one lady in Tennessee, I guarantee you there are thousands of people falling for this scam," Augenbaum said.
He points to the FBI's 24-hour Internet Crime Complaint Center, known as IC3, where public complaints are filed and FBI cases are opened if the scale of the alleged fraud is "high enough."
In response to an RFE/RL query touching on the Macedonian fraudsters, the FBI said that "as a rule, they do not make any statements about possible ongoing investigations."
Blazo Trandofilov, director of the Macedonia's Financial Intelligence Office, which combats money laundering and terrorist financing, told RFE/RL that the bulk of such groups' illicit earnings went unseen and some of their funds might be received in other countries.
"If someone were to report [a credible crime] to the U.S. intelligence services, the procedure is that they would inform us," Trandofilov said. "However, we have not received such notifications or reports of any fraud."
Veles
According to data from North Macedonia's Public Revenue Office, over the past two years 98 individuals under the age of 35 from Veles and the surrounding area have reported a combined 634,198,939 denars (around $11 million) in income from the United States. Most of it was said to have been generated from marketing and Internet services, the office said.
Across the Atlantic, back in Tennessee, Bratton said she hadn't reported her case to authorities because she was still "waiting for the last chance" to recoup at least some of her money.
One day before speaking to RFE/RL in late January, she had been contacted again by "TRB support." They told her she would lose her entire investment if she didn't provide another $400.
She vowed to try one more time somehow to save her investment before going to the FBI.
"What would you do?" she asked.