Marwan Ouarab is an unlikely hero.
The convicted con artist, once almost sent to prison for selling fake concert tickets, has found a new calling: saving scam victims from their online predators. For many, he’s their last hope of recovering stolen savings or cherished treasures.
Anne – who asked that only her first name be used for privacy reasons – is a 53-year-old French woman who was swindled out of €830,000 ($860,000) by fraudsters who convinced her she was dating Hollywood actor Brad Pitt for over a year and a half. The criminals bombarded her with fake photos and deepfake videos purportedly showing the real actor talking to Anne and asking her for money.
The videos sent to Anne are slick and – at least at first glance – look convincing, only betrayed by the sometimes-bizarre audio and unnatural eye movements of the AI-generated fake.
Contacted by TF1, a French broadcaster that was reporting on Anne’s story, Ouarab used open-source intelligence (OSINT) techniques to track down her scammers in Nigeria.
To track down those accused of defrauding Anne, Ouarab relied on a tried-and-true tactic: taking advantage of the alleged scammers’ greediness by sending them a booby-trapped link disguised as a legitimate banking platform.
The art of exploiting a scammer’s mistakes
“Basically, (OSINT) is the art of finding a person using very little information,” explained Ouarab. With just a phone number or an e-mail address, the 29-year-old can unmask online scammers, finding their real name, age, and location.
“To collect their data, I just had to wait for them to click on the link, and give me their consent,” Ouarab explained. This method ensures that the data obtained can be lawfully passed to the police. It’s not only reformed scammers who can master these tricks. “Anyone can use these tools,” he emphasized. “It’s really basic-level OSINT I used for this case.”
While Anne’s story seems extraordinary, for Ouarab and the FindMyScammer team, it’s sadly all too common.
In 2024 alone, consumers lost more than $1 trillion to scams globally, according to an international survey by the Global Anti-Scam Alliance.
With the French government’s international AI Action Summit taking place in Paris this week, the rise of sophisticated deepfakes and the urgent need for better detection methods are expected to be on the agenda.
French President Emmanuel Macron says he is personally committed to ensuring the summit’s success and numerous world leaders are participating, including Indian Prime Minister Narendra Modi, China’s Vice Premier Zhang Guoqing and US Vice President JD Vance.
‘Anyone can fall victim to these scams’
Falling prey to an online scam doesn’t require sophisticated AI-generated videos and deepfakes. “Anyone can fall victim to these scams,” warned Ouarab. He speaks from personal experience: A few years ago, he says his aunt lost 80,000 euros’ ($82,880) worth of Cartier jewellery while trying to sell it on Leboncoin.fr, a French online marketplace. Desperate, she asked Ouarab if he could help track down the scammers.
“I learned all my skills on the dark side. I realized they could also be put to good use,” he recalled. Ouarab says he managed to track down the swindler and scare him into returning the stolen jewellery to his aunt.
Until only six years ago, Ouarab himself was the one scamming people. He would sell fake concert tickets by printing out working barcodes onto blank tickets that he stole from his local shop.
The scam worked for a while, but the police eventually caught on. At the age of 25, he was convicted of fraud, handed a 10-month suspended prison sentence, and ordered to pay 11,000 euros in compensation to the victims.
He decided to turn his life around and, in 2023, officially launched FindMyScammer.com, which he claims is the first company devoted to tracking down online scammers, although other companies such as Forward Global offer a similar service in the United States. What began as a one-man operation has grown into a thriving 14-person business. It’s a success that is set to continue as online scams figures soar.
In the United States alone, reported losses tied to so-called “pig butchering” scams – a blend of “romance” and financial investment fraud – skyrocketed from $907 million in 2020 to a staggering $2.9 billion by November 2023, according to the FBI.
“Over time, the number of victims will only keep rising,” said Ouarab, who says his company receives between 100 and 150 new scam-related requests for help every day.
“I was totally helpless. When I went to the police to file a complaint, they made me understand that there was nothing they could do for me,” Luca said.
In 2022, Luca met “Zara” on Tinder, and the two quickly began an online relationship, sending text messages and making video calls. They never met in person, as “Zara” claimed to work in finance in London and Luca was in Paris.
Four months into their relationship, she told him she was making money investing on a crypto-investment platform and suggested he give it a try.
Luca first invested 10,000 euros ($10,400) and seemed to double his earnings. He then invested 40,000 euros and, after two months, his virtual wallet was worth 100,000 euros. When he wanted to withdraw some of his money, he was asked to pay 17,000 euros ($17,700), he said. “Zara” assured him that this was a normal procedure for paying taxes on profits made. Luca paid; he never saw any of the money or “Zara” again.
For a fee of 2,500 euros ($2,600), Ouarab identified “Zara,” Luca’s accused scammer, and traced her to Dubai, where she is allegedly part of a larger fraud ring, according to Ouarab. With this information, Luca was able to demand his bank reimburse nearly half of his losses and prompted an official investigation into his case.
Banks have certain obligations to clients. According to Louis Audibert, director of the investigation and dispute department at Forward Global, “if you transfer money to someone, the bank has to make sure that the name of the bank account holder matches the number of the bank account.” In Anne’s case, he said, this means that they had an obligation “to verify that the bank account was really held by Brad Pitt.”
They also have an obligation of prevention. “If I, as someone who earns a salary in France, start wiring large amounts of money abroad, the bank should flag those transactions because they are irregular,” said Audibert.
Combating prostitution networks
While not every case will result in a success story, FindMyScammer.com investigates a wide range of scams. From “romance” scams and “pig butchering” to blackmail over intimate photos and financial fraud, the work of the company now extends beyond individual clients.
Corporations are hiring Ouarab and his team to test their security by attempting to defraud them. Even governments and public institutions, such as the French governmental center for child welfare, collaborate with FindMyScammer.com to combat underage prostitution networks, he said.
“We work to identify the leaders of these prostitution networks. It’s been highly effective,” said Ouarab, visibly proud of his company’s broader impact.
Tracking down crooks comes with its own risks. Ouarab and his team have received numerous threats, which is why the identities of all employees, except Ouarab’s, are kept secret. He himself takes care to conceal where he lives, having been forced to move several times because of safety concerns.
“I have to be very careful, but I know it’s for a good cause,” he said. “I’ve been a crook before, and I deeply regret it.
“If this is the price I have to pay to redeem myself, then so be it.”