South Africans lose hundreds of millions of rands to Morita Forestry investment scam
Social media influencers helped make the scam possible - and were rewarded handsomely
Add GroundUp on Google
The Morita Forestry offices in Gauteng. Image: Facebook
- Morita Forestry — with an office in Sandton and an address in Colorado, but run from China — has scammed South Africans out of hundreds of millions of rands.
- Morita is a pyramid scheme that claimed to pay people out daily if they invested in woodland projects in the US.
- Social media influencers and the company’s local director, Puleng Violet Phakisi, encouraged people to invest in the scheme.
- Officials from the Department of Forestry, Fisheries and the Environment and the SAPS participated in “trainings” and tree plantings, adding a further veneer of legitimacy to the scheme.
- But it ended in tears for thousands this past week when Morita stopped paying out. People ripped off by the scam expressed suicidal feelings on social media.
You likely know somebody who was ripped off by Morita Forestry. You may also know someone, an influencer with questionable ethics, who made money from this scam, or perhaps one of the lucky people who got in on it early. It has been spreading through TikTok, WhatsApp groups, and Facebook. The concept is simple: invest in a woodland in America, and collect money every day from it.
But there are no woodlands. Morita Forestry is a pyramid scheme operated by a Chinese syndicate. This week, it started to crash.
On Wednesday, 29 July, influencers and victims started reporting that the scheme was “gone”; Morita had started to shut down, and withdrawals have not been processed since Friday, 24 July.
Morita was marketed by influencers across South Africa who got paid by the company. The platform had, as far as I could tell, over 385,000 registered accounts. One of the cryptocurrency wallets associated with the scheme has hundreds of millions of rands. The technical details of how it worked, and how I traced it back to China, can be found at the end of this article.
As the scheme began to collapse this week, influencers took to TikTok with live sessions, claiming that payouts were delayed due to an audit process. Victims of the scheme joined the live sessions and posted comments. During one session, it was said that two people had taken their lives after losing money to the scheme (we can’t confirm this).
Many others in WhatsApp groups shared the same sentiment, saying that they were feeling suicidal following everything that had happened. Others said that they can no longer face colleagues, that they are depressed, and that they can’t even go home.
Messages on WhatsApp by victims of Morita’s scam.
The Pitch
I found out about Morita after GroundUp reported on the SGK pyramid scheme that recently collapsed in Lesotho. In comments to posts about SGK collapsing, Morita was being offered as an alternative. It was immediately clear to me that this is a pyramid scheme. I decided to investigate.
Morita appears to have been primarily marketed on TikTok. You could not simply sign up; you needed an invitation link. I found a “prophet” who was livestreaming, advertising the scam, so I reached out.
I reached out to “theeprophet_”, who provided me with an invitation link to join the scheme. He assured me that it is a safe investment. His TikTok account has over 75k followers.
Upon joining the platform, you receive a free investment: a tree that pays out R3 a day for three days. To earn anything meaningful, you have to buy a woodland investment. The cheapest one is R350, which pays out R12 a day. The most expensive one costs R165,000, and claims to pay R6,600 a day for 300 days, which would come to almost R2 million.
There is no coherent logic behind the scheme’s pitch. No tree is able to produce products so valuable that it can increase your investment by up to 12x in a few months. But in the early days of the scheme, some people were actually paid out. Similar to the SGK app, this made the scheme seem legitimate. Members were convinced to invest more and proof of returns helped in recruiting more people.
That’s how pyramid schemes work. Some of the money invested by new investors is paid out to other members, but eventually, because no value is actually being created, there is no real return on investment, and the scheme collapses. Those behind the scheme can pull the plug when they want to, ensuring that whatever money is left, they keep for themselves.
Morita started hosting regular specials shortly before it started to wind down and stop paying. One of their specials, the carbon credit trading event, claimed to give “investors” up to R110,000 instantly, from just an R8,700 investment. But no one got that payout. This money likely went straight to the pockets of the masterminds in China.
In the final days of the scam, various excuses were provided as to why no withdrawals were going through. “Due to the opening of the carbon credit trading, … the finance department was overwhelmed”; “Delays in the South African banking system’s centralised settlement”; “A 24-hour special financial audit”. All lies. The money was syphoned away mostly through cryptocurrency.
The investment table. You can choose a package from R350 up to R165,000.
Where did the money go?
Option A - Deposit via Bank
When you deposited via a bank, you were sent to a payment page. It looks like some form of payment gateway, and investigating it provided great insight into the Chinese syndicate operating this scheme (more below). The accounts used are not business accounts; they are mule accounts (mules are people who have given control of their legitimate bank accounts to scamsters).
The payment page, hosted by a fake payment processor.
Option B - Deposit via cryptocurrency
Victims also have the option to use cryptocurrency for their deposits. This is favoured by fraudsters, as it means they do not have to syphon the money out of the bank and into cryptocurrency; it is already there. They provide you with a cryptocurrency wallet to deposit into, and you are required to provide the transaction ID so that they can verify it.
One of the cryptocurrency wallets used by the fraudsters.
One of the cryptocurrency wallets used here was created on 23 July. Since then, that one crypto wallet, over just one week, has received close to R58 million ($3.5 million).
Since cryptocurrency transactions are public, we were able to trace the money further. The above wallet paid most of its funds into a centralised hub (controlled by Morita Forestry), and that hub spread the money across 29 wallets (either controlled by Morita Forestry, or the payment processor). The hub has received in total R147-million, and the 29 wallets together add up to over R338-million ($20.2 million). The scheme has, however, earned significantly more from this, as most of these wallets have been made in recent months, and do not account for the earlier months of the scheme’s operations.
Paid to promote it
The scam started in August 2025, but planning for it started at least as far back as April 2024. The scammers started posting messages in their Telegram channel, then it slowed down for a bit, and then in August 2025 it picked up again. From April 2024 - July 2025, only 9 messages were sent. In August 2025, there were over 30.
Influencers who invited a certain number of people, or achieved a set number of likes would get compensated.
Some of the influencers who promoted this pyramid scheme.
A Telegram post on the Morita Forestry channel explaining the partner program and the various rewards.
Some of the promoters reached certain “partner” levels, which resulted in them receiving a monthly salary and some benefits. Some received phones, some received cars. They hosted numerous contract signing ceremonies at their offices in Sandton.
Partners signing their “employee contracts” at Morita Forestry’s office in Sandton.
Morita Forestry bought some of their members’ vehicles.
Ceremonies, offices, and real company documents
Morita Forestry was well orchestrated. There is a registered company in Colorado, USA, and a registered company in Sandton, South Africa. These companies were set up to convince members that it is a real operation.
The South African Morita Forestry
Morita Forestry Environmental Friendly is a registered company (2025/554658/07). Its sole active director is Puleng Violet Phakisi, and its address is 66 Park Ln, Sandton, which is where the Morita Forestry offices are located. There was another director, Simon Aphane, who resigned in November.
Examples of Morita Forestry’s business documents, shared by the company.
Morita shares many of its official documents, including its SARS, company, and UIF registrations. These are all real, but they are irrelevant. The money is never paid into a business bank account belonging to a “Morita Forestry Environmental Friendly (Pty) Ltd”. The sharing of these documents serves just one purpose - to mislead people into thinking that this is a real, legitimate operation.
And many people fell for the scheme. Morita held various conferences throughout South Africa. They donated to schools, and they gave away a ton of T-shirts. They even got the police and government agencies involved. Pictured below is an event that Morita held with police officers, as well as a tree planting event held in Rand West City municipality, with employees of the municipality and the Department of Forestry, Fisheries and the Environment.
An event with SAPS and Morita Forestry.
Morita Forestry’s tree planting event in Rand West City Municipality, Randfontein. Pictured are municipality and DFFE employees.
Morita in the USA
Morita Forestry is a registered company (ID 20191643409) in the state of Colorado. But its history is less clean than the South African one. Originally, the business was called Global Ocean Group Limited. Days before the August 2025 launch, it was renamed to Morita Forestry. It was delinquent before this. Around the same time, the company agent also changed, from Li Mindong to Ronnie Dean Hauer.
Hauer is also linked to various other schemes exposed in the media, including SFCVibe Rating, and Eunhyuk Capital Co. Ltd. SFCVibe was a suspected ponzi scheme that operated in New Zealand where users rated movies for payouts, and Eunhyuk Capital is listed on the Malaysia investor alert list. The former previously listed Chengcan Cai as its company agent, and the latter Shunyong Chen. The syndicate is running a global operation.
All three companies were renamed and listed Hauer on the exact same date - 27 July. Interesting is the fact that they all have similar addresses: 15th and 17th Street in Denver, Colorado.
What to do
If you have money in Morita Forestry, do not pay anything to “unlock” a withdrawal, and do not continue to invest in the platform.
Report the receiving bank account(s) to your bank’s fraud department, and make a case at a police station. You can report unregistered investment schemes to the Financial Sector Conduct Authority on 0800 110 443, or at fsca.co.za.
Watch out for the signs: An opportunity you can only join by invitation; a fixed daily return; paying into a personal bank account (mule) rather than a company one; pressure to recruit; official paperwork displayed to create credibility; and other suspicious signs.
Since the crash of Morita Forestry, similar schemes have popped up. Some seem to be part of the same syndicate, but I have not yet investigated this. Please be cautious if you see one of these with daily returns: investing in a “Li” car; investing in land; investing in solar panels; investing in baseballs; and more. If anything promises a daily return, it’s likely to be a scam.
A collection of the various events held and sponsored by the pyramid scheme.
Tracing it back to China
In my previous article, I traced a job scam back to China. Morita Forestry, too, seems to be operated by Chinese individuals, running a massive scam syndicate that operates schemes globally.
My investigation was centred around the payment platform that they use, and I looked at the publicly available code for the various endpoints. This allowed me to piece together what the operators of the platform could see, and provided insight into the schemes.
The payment platform
Both the bank and the crypto route run through one place, a service called kbpay.io, but this has gone by other domains such as randpay.cc. It is an unlicensed middleman that connects scam and gambling websites to real bank accounts and crypto wallets via a single service.
I was able to download all of the code available on the internet, 122 files in total, and this allowed me to map the inside of the business without having to have direct access. Every control panel is in Chinese. The administrator system was labelled 管理系统, the merchant system 商户系统, and the technical documentation 接口文档. The bulk of the text found in the code was Chinese, and had to be translated.
The payment page that victims see runs on Alibaba Cloud (a large, legitimate company registered in Singapore). There is a separate server handling Nigerian currency; it sits on Amazon in Paris. I was able to reconstruct some technical documentation, which was written for schemes operating in India, Japan, Sri Lanka, Brazil, Chile, Peru, Ecuador, and Ghana. South Africa is one market among many. All of the backends run on Alibaba Cloud.
Additionally, the operators of the payment platform have “partners”, who seem to be the ones supplying the mule accounts. They get a cut of the profit, and have their own dashboards on the system. “Merchants” are the various schemes. The roles on the platform are: Super Admin, Financial Officer, Customer Service, Moderator, Sales.
The platform has an advanced backend. There is a module that reads bank notification messages and matches them to pending orders. Staff manually match SMSes that were otherwise not automatically matched. There are also pages showing the payments made by victims coming into the platform, as well as disbursements made by the platform to victims. In total, there were 29 modules.
WhatsApp support lines
Morita Forestry has four US WhatsApp support numbers - two for deposits, one for withdrawals, and one for passwords. I messaged all 4, and sent them a specially crafted link designed to capture their IP address. Two of them clicked it, and it revealed that they were both sitting in China, using a Chinese mobile carrier as their internet provider.
Support independent journalism
Donate using Payfast
Don't miss out on the latest news
We respect your privacy, and promise we won't spam you.
© 2026 GroundUp. This article is published under the GroundUp Republication Licence Version 1.0. Email [email protected] to request permission to republish.