With stolen identities and forged ID cards from Kosovo and Albania, perpetrators siphoned money from quick-loan companies in the country. Innocent citizens—among them mentally disabled individuals and displaced persons—were left to face the consequences of a crime they didn’t commit.
Reported by: Aleksandra Denkovska Gocevska
Marija Kostovska is a 44-year-old woman from Skopje who works in a well-known wholesale drugstore, or beauty shop. When her working day is over, she continues to work on a second job.
“I have never taken out a loan in my life,” says Marija, who works extra so that she does not have to go into debt with banks.
But even though she works two jobs to provide a decent life for her family, in May 2023 she received an unexpected phone call.
It started with a phone call. A male voice informed Marija Kostovska that she had an outstanding debt with the financial company “M Cash.” He explained that she was behind on payments for a quick loan taken out in March 2023—two months earlier.
“At first, I thought it was a mistake,” Kostovska told IRL. “But then I realized someone had created a fake ID card using my personal information to take out quick loans.”
Alarmed by the telephone warning that she owed money for a loan she had never applied for or ever taken out, Maria reported the incident to the police. They advised her to obtain a report from the Macedonian Credit Bureau to confirm the claims.
But when Marija obtained her credit report, the reality was far more shocking. Loans in her name had been taken from seven financial companies, totaling 146,000 denars (nearly €2,500). The debts spanned “M Cash,” “SN Finance,” “Credisimo,” “Flex Credit,” “Tigo,” “Iute,” and “Monimax.”
“Almost all the money was withdrawn by the fraudster at Capital Bank, where she opened a transaction account on my name using the fake ID card. She managed to take about 120,000 denars from that account.”, Kostovska explained.
When Marija discovered that a fake ID card was being used—bearing her personal details but the photo of another woman—she began piecing together how the scam had worked and how “the fake Marija” managed to take out loans. Checking with telecommunications providers A1 and Telekom, she uncovered that two phone numbers had been registered in her name. These numbers were listed as contacts at finance companies, enabling the fraudsters to communicate and apply for loans in her name seamlessly. Marija’s story highlights the dark side of a system designed for convenience but ripe for abuse.
While Marija Kostovska, the police, and the prosecutor’s office investigated who had stolen her identity, the nightmare escalated. Orders from bailiffs began arriving at her home, demanding repayment for loans she had never taken.
Marija hired a lawyer to fight back, presenting evidence that she had been defrauded and that the prosecutor’s office was handling the case. Six of the financial companies involved agreed to pause their collection efforts during the investigation. But “SN Finance” refused to relent. Despite knowing that someone had used a fake ID card to take the loan, the company pursued Marija for full repayment.
In December 2023, enforcement proceedings began. Marija’s bank account was blocked, leaving her no choice but to start repaying a loan she never applied for. The original loan from “SN Finance” was around 30,000 denars, but the company calculated she would owe nearly three times that amount.By May, Marija had already paid 67,000 denars. Only then did “SN Finance” agree to pause collection efforts, but only temporarily, until the courts and prosecution could prove her innocence, i.e.she was deceived and that it was not she who took out the loans, but some fraudster with her fake ID card.
The tactics were chillingly precise. Fraudsters altered the victims’ addresses slightly—adding a number, letter, or a nearby street name—so the loans wouldn’t raise immediate suspicion. The only thing that was different was that for one victim, who was unemployed, the fraudsters even falsified employment records, creating the illusion of stable income in case the finance companies decide to check the employment status.
Fictitious Employment: A Gateway to Fraud
As the investigation into Marija Kostovska’s stolen identity unfolded, IRL uncovered a meticulously organized network of fraudsters. Their schemes extended beyond forged ID cards, involving the fictitious employment of unsuspecting citizens. This tactic exploited finance companies’ minimal loan approval checks, using false employment records as leverage for quick loans.
One victim of this elaborate scheme was Mile Kosteski, a 20-year-old from Skopje. In May 2022, without his knowledge, someone registered him as an employee of a company called “Tradepoint.” This false employment status became the gateway for fraudsters to access quick loans. Just one month later, i.e. by June 22, 2022, loans totaling 60,000 denars were taken out in Kosteski’s name across three finance companies—”Flex,” “Monimax,” and “Credisimo.” The fraudsters didn’t stop there; they also purchased a mobile phone under his name through “Telekom.”
For months, Kosteski remained unaware of his false employment or the debts being racked up in his name. The truth came to light in November 2022 when a letter from a notary arrived at his home, demanding repayment of the debts. Stunned, Kosteski realized he had been scammed. He had never applied for a single loan, let alone multiple quick loans, nor had he ever worked for “Tradepoint.”
IRL’s investigation into the fraudulent employment of Mile Kosteski uncovered a tangled web of companies and individuals tied to suspicious activities. The company where Kosteski was falsely employed, “Tradepoint,” was founded in November 2019 by Vasil Simonovski. Its management was initially under Marjan Dimovski. However, in June 2021, the company changed hands—it was gifted to Muhamed Nezirovski. A closer look into Nezirovski revealed that his registered residential address was the Inter-Municipal Center for Social Affairs in Skopje. When IRL inquired about him, the institution responded that he was most likely a child who had previously lived in some of the foster care group institutions and had not updated his ID card.
Notably, the subject employments at “Tradepoint” began shortly after Nezirovski assumed ownership of the company.
Digging deeper into the Central Register documents, IRL discovered that Marjan Dimovski, the former manager of “Tradepoint,” was also linked to several other companies:
- “MD Trading”: Founded in June 2022, owned and managed by Dimovski.
- “Mobi Lobby”: Established in November 2022, with Dimovski as both owner and manager.
- “The Vault”: Registered at the same address as “Mobi Lobby,” with Dimovski as a manager and Dimitar Kratovski, a 30-year-old from Skopje, listed as the owner.
Documents provided by a whistleblower at the Employment Agency shed further light on these companies. Over 50 individuals were employed across the four entities linked to Dimovski. However, employment records revealed irregularities:
- Some employees were registered and deregistered within a matter of days.
- Others, like Mile Kosteski, remained on the payroll for up to two years, even though their employment was fraudulent.
“We went to the Employment Agency several times to deregister me, but they refused to do this without the signature of the owner or manager,” says Mile Kosteski. “In October of this year, the inspectorate gave me a letter stating that the company was fictitious and didn’t exist. I took the letter to the Employment Agency, and only then was I able to deregister.”
Take 50-year-old Pance Georgievski from Skopje, for example. Pance, who suffers from a severe mental disability, spends more time in hospitals than at home. His mother, unaware of the fraud, discovered something was amiss when they visited their family doctor to obtain a prescription. “The doctor told us Pance was employed at MD Trading, and the company wasn’t paying his health insurance,”she recalls. Previously, Pance had been receiving state-funded healthcare as an unemployed individual.
The nightmare didn’t end there.
“That’s when letters from notaries and bailiffs started arriving,” she says. “I can’t pay that debt—I don’t have the money. Someone cheated Pance, but we have enough problems at home. We didn’t report it to the police. Realistically, I didn’t expect anyone to solve this.”
The pattern repeats with 57-year-old Zoran Todorovski and 27-year-old Fljurim Golic, both of whom have psychiatric diagnoses. Todorovski, who lives alone in Skopje’s Lisice neighborhood, relies entirely on the charity of neighbors to survive.
“The man is not well,” a neighbor says, speaking in hushed tones for fear of retaliation. “Once, he came back bruised and beaten. He said they forced him to take out a loan. I don’t even know if he got any of the money they borrowed in his name.”
The third man in question is Fljurim Golic, whose sister confirmed a grim reality. “I don’t know how many loans were taken out in his name or from how many companies,” she admits. “They gave him just 5,000 denars, and the rest was taken by the people who scammed him.”
All these victims, including Fljurim, were fictitiously employed by two companies: Tradepoint and MD Trading. The supposed owner and manager of MD Trading, Marjan Dimovski, claims he was scammed too. “I didn’t employ any of these people,” Dimovski tells IRL. His suspicions were piqued when a letter arrived at his home—the same address registered for MD Trading. The letter demanded that he withhold part of an employee’s salary to repay a debt.
“I immediately thought it was strange because I didn’t have any employees,” he explains. Alarmed, he visited the Employment Agency to request a list of registered employees under his company. “There were 12 names on the list,” Dimovski recounts. “Seven were deregistered either the same day they were registered or within a few days. The eighth person, whose salary I was supposed to withhold, was still listed as employed.”, explained further Dimovski at the meeting with the IRL journalists.
Dimovski obtained the list on October 12, 2023. The very next day, he went to the police to report that someone was falsely employing people under his company’s name.
Dimovski isn’t the only connection to this fraudulent activity. He reveals that he had a former business partner, Dimitar Kratovski, who had been a manager at one of his companies, The Vault.
Their partnership began when a company owned by Kratovski started maintaining the entrance of Dimovski’s building.
“They were a group of guys, eager and full of energy. They asked me to open a company for them—a mobile phone shop. I agreed, but I quickly realized they weren’t serious. They didn’t pay rent or bills, so I ended the cooperation,” Dimovski says.
When asked if he suspected anyone specific of deceiving him, Dimovski claims he told the police everything he knew. Regarding Kratovski, he says only this: “I’m familiar with his work.”
From Whistleblower to Fraud Suspect
The road to unraveling the intricate web of identity theft and quick-loan frauds led IRL journalists through hundreds of documents, hours of interviews with victims, and consultations with legal experts. Kratovski came onto the radar early in the investigation, flagged by an anonymous source.
While IRL cannot reveal who or why this person pointed to Kratovski, protecting this individual’s identity was paramount. What was clear was that Kratovski might hold the key to exposing the mechanics of quick-loan fraud involving stolen identities and fake ID cards.
When IRL first approached Kratovski, he painted himself as an outsider with insider knowledge.Kratovski claimed he was not directly involved in the fraud but knew of people who were.
In the initial interview, his initial role was one of a whistleblower and he was filmed with his identity concealed. “The data on the defrauded people is usually taken from state institutions,” he revealed.
He went on to describe an organized network with operatives embedded within various institutions, including banks. The individuals whose photos were used on the forged ID cards, he said, often came from Serbia or Bulgaria, not Macedonia.
“This group doesn’t have a fixed structure,” Kratovski explained. “If one person is stopped, others step in. The scheme keeps growing—it’s never just a small operation.”
Months after the interview, as IRL continued its investigation, a startling turn of events unfolded: Dimitar Kratovski himself became a suspect in the prosecution’s fraud case. The once-guarded whistleblower was now under scrutiny.
When pressed about his potential role in fictitiously registering citizens in companies linked to his name, Kratovski firmly denied direct involvement.
“I never interacted with the defrauded people or took money from them,” he stated. “I’ve always been in the background. I’ve seen what’s happening and who’s doing it. It’s not that I haven’t been close to it—directly or indirectly—but I’ve never been an advocate for fraud.”
In addition to his company “The Vault,” IRL uncovered several other businesses connected to Dimitar Kratovski, where he was or still is listed as an owner. Initially approached as a source to explain how these fraud schemes operated, evidence later pointed to Kratovski as the mastermind behind the network of loan frauds involving forged IDs and fake employment records.
This conclusion aligns with the findings of an ongoing pre-investigation by the Basic Public Prosecutor’s Office in Skopje. Prosecutors suspect Kratovski and several associates of exploiting stolen identities to siphon money from the quick loans providing finance institutions.
Months after IRL identified the companies and associates linked to Kratovski, journalists confronted him again with allegations of his central role in the operation. Kratovski denied any involvement.
“My client has never personally been involved, nor has he incited others to deceive, defraud, or cause harm to individuals for financial or material gain, either personal or for others,” stated a letter sent to IRL by Kratovski’s lawyer.
The letter also emphasized that Kratovski was fully cooperating with the Prosecutors, ready to clarify any uncertainties and answer their questions.
IRL’s investigation revealed that this was not Kratovski’s first run-in with the law. He and his associates were also implicated in another high-profile case known as “Chain.” In this scheme, individuals were charged with money laundering, organized crime, and tax evasion. According to the indictment, Kratovski was responsible for identifying fake legal entities and creating new companies to generate fraudulent claims against the Public Revenue Office. In the “Chain” case, Kratovski pleaded guilty and was sentenced to three years in prison. However, he evaded capture until this summer.
After Dimitar Kratovski’s arrest, the police and the Prosecutor’s Office expanded their investigation, suspecting him of involvement in the widespread quick-loan fraud scheme. The Prosecutor’s Office confirmed to IRL that the criminal group responsible used two primary methods to deceive citizens and finance institutions.
The first method involved creating fraudulent identities by combining stolen personal data. According to Gavril Bubevski, head of the Basic Public Prosecutor’s Office in Skopje, scammers would mix information from different people—using the ID details of one individual and the photo of another—to apply for and secure loans.“In some cases, the victims were citizens whose identities were exploited. In others, where the fraudsters couldn’t repay the loans, the financial companies themselves became the victims,” Bubevski explained in an interview with IRL.
The second method revolved around falsified employment documents. Vulnerable citizens were targeted, offered small compensation to participate in the scheme. They were unwittingly used to apply for loans with forged employment verification documents.
“Most of these participants belong to vulnerable categories. Sadly, they never receive the money; they only apply with fake documentation, while the real beneficiaries are those currently under investigation. Both the Ministry of Interior and the Prosecutor’s Office are closing in on the evidence and those involved,” added Bubevski.
So far, the pre-investigation has identified three primary suspects, but authorities believe more individuals are involved. Prosecutors are confident they will find evidence to implicate at least one additional person.
