- GroundUp spoke to a woman whose personal bank account was used as a deposit channel for Morita Forestry, an investment scam that collapsed at the end of July.
- Morita called people like her “mentors”. Her job was to collect investors’ money, convert it to cryptocurrency, and send it to the scammers.
- Our source, who lives in Gauteng like most others involved, was employed by the scheme for a few months.
- People who put money into her bank account want their investment back, but she doesn’t have it. Some have threatened her.
Jill (not her real name) was not stealing this money. Her job was to pass it on, with strict instructions sent to her over WhatsApp. Morita Forestry called her a “mentor”, but in reality, she was a money mule, and one of many key pieces in making the scam work. One of her five accounts used by the scheme had over R3-million paid into it, in just one month.
Since Morita Forestry has been exposed, shut down, and the scammers have run with the money, Jill has received threats to her and her family’s lives from people who invested money in Morita, and lost it. They want their money back. But Jill was also duped, and does not have anyone’s money — it was all converted into cryptocurrency and sent offshore. We have seen her bank statements; her bank accounts are empty.
Why the scam needed Jill
Morita Forestry was run from outside South Africa by a Chinese syndicate. That created a practical problem for the operators: they needed to collect rands from thousands of South Africans, but they could not open South African bank accounts to receive them.
There was a second problem. Money sitting in a South African bank account can be traced, frozen, and clawed back. Banks and the courts can reach it. Money converted into cryptocurrency and sent to anonymous wallets abroad cannot be reached by anyone, at least not without great difficulty.
So the operators needed local people who would do three things: receive rands into their own bank accounts, use those rands to buy cryptocurrency, and send that cryptocurrency to wallet addresses the operators controlled. That is what a money mule does.
Using dozens of ordinary personal accounts solved a third problem too. Banks watch for accounts that suddenly start receiving payments from hundreds of strangers. A single account doing this would be frozen within weeks. But spreading the money across many accounts lasts far longer.
Following a payment
Morita sold what it called woodland: stakes in forests in the United States that supposedly earned money from renting the land, selling the timber, and carbon credits. They started selling carbon credit packages. The most common one cost R8,700. It was all lies. This was a straightforward pyramid scheme where some early “investors” may have been paid out with subsequent “investments”, but eventually the scammers took the money and ran.
Here is typically what happened when someone “invested”, step by step:
- The investor signed up, or already had an account, and was given a Morita ID number.
- They were told to pay R8,700 into the bank account of a “mentor”, like Jill, using their Morita ID as the payment reference. They were told to use an immediate payment. Jill’s boss sent her and other mentors’ account details into investor WhatsApp groups, and passed them directly to investors.
- Jill saw the money arrive. She posted the investor’s Morita ID and the amount into the group chat with her boss. Her boss replied to confirm, and the investor’s balance then reflected on the Morita Forestry site. As far as the investor could tell, they now owned a piece of forest.
- Jill then took that R8,700 out of her own account and used it to buy cryptocurrency on Binance, one of the world’s largest crypto exchanges. Specifically, she bought a coin that has the same value as one US dollar.
- She sent those “dollars” to a wallet address her boss had sent her on WhatsApp.
- Within hours, that wallet forwarded the money on again. At this point it is impractical for South African authorities to trace or claw back the money.
The entire chain often ran in a single day. An investor’s savings existed as rands in a personal bank account in the morning, and by the evening, as untraceable cryptocurrency in a foreign wallet.
To buy and move large amounts on Binance, the mules had to verify / FICA their identities under South Africa’s law. Every transfer they made is therefore linked, at Binance, to their real name and ID number. The operators, however, never had to touch an exchange account, and left no such trail.
A boss sharing bank account details to an investor group
A boss explaining to one mentor how to complete their work and earn money.
Morita ranked its investors in six levels, which it called partner levels. You climbed by recruiting other investors. Higher levels earned bigger commissions on your recruits’ deposits. Somewhere along that ladder, the more successful recruiters were offered what looked like a promotion: work directly for the company, handling deposits, for a commission and a salary. That is the point at which an investor becomes a money mule, but Morita called such a person a “mentor”. Jill got to this level.
Mentors earned 5% of everything they processed, plus bonuses. Many of them were also investors. On Radio 702, another Morita mule explained that he started as an investor, and then a “partner”, and eventually he was offered a position in the company.
“We were supposed to open up new Absa accounts and start trading on the Binance platform. We had to FICA ourselves onto the Binance platform so that we could get the money into crypto. Everybody was depositing money into my account and into my fellow members of the partners group, and we were getting the money into crypto,” he said.
When asked if he was in trouble, he said that he “was in super trouble now”, as everyone wants their money back from him, even though he does not have it. As with Jill, victims are threatening his life.
Billions of rands scammed worldwide
The balance of Jill’s Binance account in just one day. Mules are required to send their balance to the scheme regularly.
We obtained numerous cryptocurrency wallet addresses from our sources. These were wallets into which the mules paid the cryptocurrency they had converted.
This allows us to expand on the estimate in our previous article and provide a more accurate figure. Previously, the wallets we knew about added up to over R300-million (converted from US dollars).
After analysing the new wallet addresses and tracing the transactions, we calculated that at least R511-million ($13.2-million) was sent to Morita-controlled wallets. Across Morita Forestry’s 385,000 members, this is an average investment of about R1,300, although many invested up to R165,000, numerous times.
Most of these wallets were new, and provide a recent snapshot of Morita’s earnings. They don’t tell us how much Morita was raking in from August 2025 to May 2026.
These wallets did not hold the money. Nearly all of it was swept onward within hours, so we then went one step further and traced where the confirmed wallets sent the funds to. This unveiled just how big the syndicate is.
Those wallets forwarded the money to a set of about 14 accounts, which we refer to as hubs. These hubs have together received more than R3.9-billion ($240-million). These hubs form part of the larger syndicate, who are operating various schemes across the world, but using the same wallets and tools for moving money. This is consistent with our reporting on the payment processor used, as well as our reporting on the shell companies used for schemes registered through the same agent in Colorado.
The hubs were still in use at the time of publication.
“Don’t accumulate too much”
The chat groups show the boss managing the mule network closely, and openly telling mentors how to avoid their banks noticing. “Don’t always use the same bank [account]”, he wrote. “If the [account] is frozen, you won’t be able to accept any orders”.
He followed this up later with an instruction: “Record your funds and transfer them to Binance before starting work. Don’t accumulate too much, as this could lead to your bank [account] being restricted”. The boss kept a daily record of how much was sitting in each mentor’s account.
A spreadsheet kept by one mentor group’s boss to keep track of their accounts and how much they’ve sent to the scheme via cryptocurrency.
As the scam started winding down, deposits had to be made as immediate payments, which are harder to reverse since they clear in real time. Refunds were refused, and non-immediate payments went uncredited.
“The funds are in her Morita account, and we cannot return the money to her”, a boss said when someone queried about a refund in the last four days of the scheme’s operations.
The collapse
In the last few days of the scheme, Jill’s boss told her that the scheme was short of money. There was increased pressure to process orders and to get the money into cryptocurrency quickly.
One evening closer to the final shutdown, as payouts to investors dried up, Jill asked her boss for help. “Boss, I don’t feel well. I think I’m going to die. The people are calling me, threatening my life. Boss, help me,” she texted.
The next day, she reported that her Absa account had been frozen. A planned investor conference in Cape Town, for which she had already booked a flight, was cancelled. The boss told her that going would put her personal safety at risk.
She asked if Morita Forestry was crashing, to which the boss replied, “No. We are resting today.” He also advised her to change her phone number, and on 29 July, her boss went dark after also changing their phone number.
Activity continued in social media groups, however. On the morning of 31 July, a notice went out to mentors from a different boss. It explained that a “financial compliance audit” was nearly complete, that withdrawals were suspended for a “financial settlement holiday”, and that the Morita website would be “temporarily inaccessible” for a 48-hour update. They said that all pending withdrawals would be paid the following week.
They weren’t. On 31 July, Morita Forestry shut down their South African online assets: websites, app, Telegram, and WhatsApp numbers. Many of the mentors started stating that their bank accounts were being frozen as people started to report them, but many of them still remained hopeful.
Where does this leave Jill?
Jill’s bank accounts are frozen. Her main account, where a million rand passed between January and August, had just a few rands left in it. On 29 July, two days before the shutdown, she wrote to her boss: “I don’t want to go to jail 😭😭. My children are so small”.
She told us that she has been too scared to go to work. She fears for her family’s lives, and is desperately seeking assistance from the police. To date, they have been unable to help her. All she wishes is for “everyone to get their money back”.
