The Scam-App Factory Feeding the OpenPayd–Klickl Payment Rail
Scam-Or Project has reviewed a victim-organized app list that significantly expands the scope of the OpenPayd–Klickl investigation. The material identifies dozens of victim-linked entries and at least 27 separate app or frontend brands allegedly used to channel investors into the same OpenPayd–Klickl payment infrastructure.
The findings suggest that KXTRA and Peelhuntaicore were not isolated scam operations. Instead, they appear to have been part of a broader disposable app ecosystem designed to direct victim funds into OpenPayd Malta vIBANs associated with BIC CFTEMTM1 and subsequently routed to Klickl Europe.
2-Minute Briefing
The OpenPayd–Klickl rail appears to have been powered by an entire network of fake investment applications. A victim-generated list reviewed by Scam-Or Project identifies 46 victim-app records and at least 27 different app or frontend brands, including:
- Peelhuntaicore
- KXTRA
- PHFINCORE
- FinTechX
- BMEBEX
- MirrorTrd
- SSGM Pro
- YHT
- KKRDE
- kkr-am-pro
- KzipPro
- FD MIN
- Quantanils
- Phantom
- Voya
- SSIM INT
- KIZ / Kl Zep variants
This materially changes the picture. The evidence no longer points to a single fake trading platform or one-off impersonation fraud. Instead, it indicates a scalable multi-app fraud architecture built around:
- disposable investment app frontends,
- WhatsApp and Telegram grooming,
- fabricated trading dashboards,
- blocked withdrawals,
- and a stable payment-processing backend.
The consistent backend infrastructure remains the most critical element.
Previously reviewed OpenPayd payment summaries showed a recurring pattern in which victim deposits were routed into OpenPayd vIBANs and then immediately transferred to Klickl Europe Sp. z o.o. using references such as “Sweep to Primary Account.”
OpenPayd’s GDPR response to victims reportedly confirmed the structure behind the system. According to those disclosures, OpenPayd’s corporate client was Klickl Europe, while the victim-facing IBANs functioned as named virtual IBANs connected to Klickl Europe’s payment account. Once funds were credited, they allegedly became the property of Klickl Europe.
Public Warnings Support The Multi-App Pattern
Several public warnings appear consistent with the victim evidence.
The legitimate investment firm Peel Hunt publicly states that it does not conduct regulated investment activity through WhatsApp groups, downloadable trading apps, or social media channels. The company specifically identified PEELHUNTAICORE and PHFINCORE as fraudulent applications unrelated to Peel Hunt.
Germany’s regulator BaFin has also issued warnings regarding WhatsApp-driven crypto trading schemes linked to FintechX and FNTCX applications.
In addition, public scam reports and complaint forums have connected several other names from the victim list — including BMEBEX/BMBEX, MirrorTrd, SSGM Pro, and YHT — to high-risk investment or trading-app activity.
The frontend branding repeatedly changed, but the payment rail allegedly remained identical.
Key Findings
Large-Scale App Ecosystem
The victim list represents evidence of a highly scalable fraud structure. The screenshots reviewed contain dozens of victim-linked entries and at least 27 different app or frontend brands.
This was not a single rogue app. It appears to have been a repeatable frontend deployment model.
Peelhuntaicore Was Only One Brand
Although seven victim entries reportedly relate to Peelhuntaicore, the same dataset also references:
- KXTRA
- PHFINCORE
- FinTechX
- BMEBEX
- MirrorTrd
- SSGM Pro
- YHT
- and numerous additional brands.
Stable Payment Backend
The OpenPayd–Klickl infrastructure appears to be the common denominator.
Multiple OpenPayd payment summaries reportedly show the same pattern:
Payin → Transfer → Klickl Europe → “Sweep to Primary Account.”
While app names and frontend identities constantly changed, the underlying payment route allegedly remained stable.
Scam Typologies Match Public Warnings
Peel Hunt explicitly denied any relationship with Peelhuntaicore and PHFINCORE.
BaFin and other public warnings describe nearly identical WhatsApp-based crypto investment schemes involving:
- FinTechX / FNTCX
- BMEBEX
- MirrorTrd
- SSGM Pro
- YHT
The overlap between regulator warnings and victim files strengthens the hypothesis of a coordinated app-front fraud network.
Questions Around Klickl Europe
If dozens of separate app schemes were funneling money into Klickl Europe accounts through OpenPayd vIBANs, then Klickl Europe would likely possess:
- customer onboarding records,
- wallet destinations,
- conversion logs,
- ledger entries,
- and transaction-monitoring alerts.
This raises significant questions regarding compliance oversight and merchant monitoring.
OpenPayd’s vIBAN Exposure
OpenPayd allegedly supplied the virtual IBAN infrastructure used in the transactions.
Key unresolved issues include:
- how many Klickl-linked vIBANs were issued,
- how many complaints were received,
- and why repeated retail-investor deposits allegedly continued flowing through the same rails.
Regulatory Implications
Regulators may ultimately view the structure not as isolated compliance failures, but as a payment-enabled investment-fraud ecosystem.
Disposable apps combined with stable banking and crypto-payment rails are increasingly becoming a standard operating model for cyber-enabled investment fraud.
Key Data Table
| Entity / App / Mechanism | Alleged Role | Evidence | Main Concern |
|---|---|---|---|
| OpenPayd Malta / CFTEMTM1 | vIBAN infrastructure and payment facilitator | OpenPayd files and GDPR responses | Victim-facing vIBANs allegedly used for scam deposits |
| Klickl Europe Sp. z o.o. | Corporate client and sweep recipient | Payment summaries showing transfers to Klickl Europe | Repeated sweeps to same Polish VASP |
| Peelhuntaicore | Fake Peel Hunt investment app | Victim files and Peel Hunt warning | Peel Hunt denies any association |
| PHFINCORE | Fake Peel Hunt-related app | Victim list and Peel Hunt statements | Publicly identified as unauthorized |
| KXTRA | Fake investment app | Victim files and Humer materials | Linked to KKR-style investment narrative |
| FinTechX / FintechX | Investment app/frontend | Victim files and BaFin warning | WhatsApp-driven crypto-trading scheme |
| BMEBEX / BMBEX | Trading-app frontend | Scam reports and victim data | Identity-shifting pattern |
| MirrorTrd / Mirror Trade | Fake trading app | Public warnings and victim reports | Scam-related trading interface |
| SSGM Pro | App frontend | Public low-trust reports | Disposable download ecosystem |
| YHT | Investment app/frontend | Multiple victim reports | Repeated high-risk investment pattern |
| Other listed apps | AbrI3, AGAMK, CSCpro, FD MIN, Gimch Elite, KR, Phantom, Quantanils, SSIM INT, Voya and others | Victim-organized app list | Requires further forensic analysis |
Alleged Rail Structure
Payment Flow Map
Fake investment app → WhatsApp / Telegram grooming → OpenPayd Malta named vIBAN (CFTEMTM1) → Payin → Transfer → “Sweep to Primary Account” → Klickl Europe Sp. z o.o. → crypto conversion or settlement layer → unknown operators
According to the available evidence, the apps functioned as disposable victim-facing interfaces designed to simulate investment activity, fake profits, and withdrawal functionality.
The real infrastructure allegedly sat behind the scenes:
- OpenPayd handling vIBAN intake,
- Klickl Europe acting as recipient or settlement layer,
- and an unidentified downstream crypto infrastructure receiving the funds.
Scam-Or Project Assessment
Established Facts
The reviewed victim list contains 46 victim-app entries and at least 27 separate app/frontend names.
OpenPayd payment summaries previously reviewed by Scam-Or Project reportedly show transfers from victim deposits into Klickl Europe accounts using “Sweep to Primary Account” references.
OpenPayd’s GDPR disclosures allegedly confirmed that the relevant named vIBANs were connected to Klickl Europe payment accounts and that credited funds became Klickl Europe property.
Strong Inferences
The available evidence points toward a scalable fraud architecture involving many disposable frontends connected to a single stable payment backend.
KXTRA and Peelhuntaicore appear to have been only two brands inside a much larger ecosystem.
Working Hypotheses
Klickl is presented publicly as a global crypto and Web3-focused operation with entities connected to multiple jurisdictions. Klickl Europe, registered in Poland as a VASP, appears to have functioned as a payment-processing layer within the broader network.
OpenPayd, meanwhile, operated as the licensed EMI providing the vIBAN infrastructure through its Malta-regulated entity.
This means investigators are not dealing solely with anonymous online scammers. The structure also involves licensed and registered payment intermediaries whose beneficial owners, executives, and compliance systems may eventually face scrutiny regarding investor losses and transaction monitoring obligations.
Whether Klickl Europe merely acted as an onboarding and settlement layer or maintained closer operational proximity to the underlying fraud operators remains unresolved.
However, the repeated transaction patterns and volume make passive ignorance increasingly difficult to argue.
Open Questions
Several major questions remain unanswered:
- Who controlled the apps?
- Which merchants or customers were onboarded by Klickl?
- Were deposits converted into crypto assets?
- Which wallets or exchanges received the proceeds?
- What transaction-monitoring alerts were triggered?
- Why did the same payment rails continue operating across so many app brands?
Victim & Whistleblower Call
Scam-Or Project is currently collecting:
- OpenPayd GDPR / DSAR responses
- OpenPayd payment-summary Excel files
- app screenshots
- APK files and download links
- WhatsApp and Telegram screenshots
- fake broker names and phone numbers
- vIBAN records and bank receipts
- Klickl references
- wallet addresses and transaction hashes
- police reports
- BaFin and regulator complaints
- emails and chats involving Klickl or OpenPayd
Particular interest remains focused on:
- Peelhuntaicore
- PHFINCORE
- KXTRA
- FinTechX
- BMEBEX
- MirrorTrd
- SSGM Pro
- YHT
- KKRDE
- kkr-am-pro
- KzipPro
- FD MIN
- Quantanils
- Phantom
- Voya
- SSIM INT
- KIZ / Kl Zep variants
Source material reviewed from uploaded file.
