most likely the developers themselves did this, as this is a very simple scheme of fraud, and at the moment it looks exactly like this!