Scam call centers operate in Ukraine, [1] [2] including major cities such as Kyiv and Dnipro. Under Article 190 of The Criminal Code of Ukraine, the activities of these call centers are considered illegal. [3] According to Sberbank, the "capital" of phone fraud is Dnipro, [4] and up to 95% of calls to Russians originate from Ukraine. [5]
These organized cells specialize in fraudulent schemes aimed at extracting funds from citizens. According to Article 190 of the Criminal Code of Ukraine, the activities of these call centers are illegal. [3] According to (the Russian) Sberbank, the "capital" of phone fraud is Dnipro. [4] Scammers may call individuals, posing as bank and mobile operator security personnel, to obtain card information and SMS codes for the purpose of misappropriating victims' funds. After obtaining data supposedly meant to prevent fraud, scammers siphon money from victims and transfer it to specific accounts. The operations of such groups are not confined to Ukraine and Russia but target countries with a significant Russian-speaking population, such as Kazakhstan, Poland, and the Czech Republic. However, there are also call centers focused on English-speaking countries. [2]
According to the Geneva-based Global Initiative, which monitors such activities, the proceeds from fraudulent call centers often do not contribute to the development of the Ukrainian economy but are transferred to offshore accounts or cryptocurrencies to avoid taxation. [1]
International media and organizations such as The Times of Israel, Dagens Nyheter, and the Organized Crime and Corruption Reporting Project (OCCRP), have exposed information about scam call centers based in Kyiv. One of the companies associated with these call centers is named "Milton Group".[ citation needed ]
According to Sberbank up to 95% of calls originate from Ukraine to Russians. [5]
The Russian government has said that Ukrainian scam call centers have played a significant role in the many unusual fires that have occurred in Russia since its invasion of Ukraine in February 2022. In December 2022, Russian Federal Security Service (FSB) issued a warning about Ukrainian scam calls, saying that scammers "incline gullible citizens to commit arson attacks on social infrastructure facilities, as well as cars in crowded places". According to the FSB, most of these arsonists were told that they were participating in an operation to catch pro-Ukrainian criminals. BBC believes that the claim is not supported by concrete evidence. [6] [7]
In August 2023, the Russian Prosecutor General's Office and the Ministry of Internal Affairs issued official warnings about a new form of phone fraud in which Russians are forced to set fire to military enlistment offices through pressure or deception. The authorities claim that scammers call from the territory of Ukraine and choose elderly Russians as their victims. The Russian government has not yet offered any evidence of their claims. [8] [9] Russian business newspaper Kommersant claims that fraudsters support the Armed Forces of Ukraine and organize "terrorist attacks". [10]
According to an employee of the Dnipro-based public organization Anti-Corruption Council for Human Rights, fraudulent call centers began to appear in large numbers as early as 2014. [2] [11] The structure of scam call centers includes rented offices equipped with computers and specialized telephones. Important information about the functioning of the offices is stored on remote servers. Call centers have operated or continue to operate in various cities in Ukraine, such as Kyiv, Lviv, Dnipro, and Odesa, as well as outside the country — in Poland, Bulgaria, and Greece. [2]
Investigations by a number of international media outlets have revealed the structure of scam call centers in Ukraine. These structures operate within a professional hierarchy that includes junior “sales managers,” experienced “trainers,” “retention managers,” and office managers. The youthful office atmosphere of these centers is comparable to the 2013 film The Wolf of Wall Street, as they feature motivational speeches, high staff turnover, and parties. [1] Ukrainian job sites such as work.ua and rabota.ua feature high-paying job openings for “sales managers” and “retention managers” associated with fraudulent call centers. [12]
“Sales managers” are mainly young people, including students and recent graduates. Vast majority of call center employees are between the ages of 14 and 20. [2] Their main task is to convince victims to make a small initial deposit. If a potential customer is unwilling to transfer funds, an experienced social engineer intervenes, posing as a senior and competent specialist to ensure the successful completion of the transaction. [1] After the initial deposit is made, the customer is transferred to a “retention manager” whose sole purpose is to extract the maximum amount of money from them. At this stage, large-scale enrichment often occurs, deviating from the initial goal. [1] Office managers, known as “seniors,” are responsible for managing the financial and operational aspects of the business. Most often, it's the “seniors” who decide to use physical and psychological pressure on employees, or, in some cases, do so themselves. “Closers” are responsible for organizing work processes and disciplinary work, including the use of violence against employees. Psychological support for employees is provided by “mentors.” [2]
The ffunds from income are used to cover current expenses, including rent, salaries, cash withdrawals, currency purchases, and bribes to law enforcement officials. Cash withdrawals are carried out through crypto wallets and crypto exchanges. Profits are distributed among “shareholders", individuals who receive a portion of the profits for financing the organization. [13]
In September 2021, during an investigation, Vlad Bovtruk from Strana.ua, got a job at an underground call center operating in central Kyiv. The main requirements were fluent speech, fluency in Russian, basic computer skills, perseverance, attentiveness, and accuracy; no work experience was required. [14] Bovtruk was told that he had to call residents of Russia, introduce himself as an employee of Sberbank, and extort money from them in various ways. Upon being hired, the journalist received a manual consisting of a set of phrases in a specific order to be used when communicating with potential victims. The scammers themselves referred to their victims as “losers” or “mammoths.” As noted, the employees were fully aware that they were involved in fraud. They introduced themselves to the victims using fictitious names and called them using number spoofing programs that copied the numbers of real employees of Russia's Sberbank or the Russian Ministry of Internal Affairs. [14] It was reported that during the day, an operator at such a call center made about 300 calls and managed to deceive up to five people per working day. [14]
There are hundreds or thousands of scam call centers in Ukraine, the vast majority of which, according to Sberbank, target Russians. Ukrainian call centers try to scam Russian bank customers out of their money. [1]
The phenomenon of Ukrainian scam call centers and their activities is due to the difficult economic situation in Ukraine, cultural proximity, and linguistic and mental similarities with Russia. [14] These preconditions, along with the high level of crime and corruption in Ukraine, have led to the formation of large monopolistic holdings in the field of fraud. Against the backdrop of a virtual lack of cooperation between Russian and Ukrainian law enforcement agencies since 2014, Ukrainian fraudsters remain virtually unpunished, exploiting the vulnerability of Ukrainian legislation and the inability of Russian citizens to file complaints. [15]
Stanislav Kuznetsov, deputy chairman of the board of Sberbank, noted that most call centers that use number spoofing to imitate calls from banks in Russia are located in Ukraine. [16] [17] He called Dnipro the “capital of telephone fraud,” to which Dnipro Mayor Borys Filatov responded: “I don't understand why he says that. There are call centers like that all over the country.” [14] At the end of 2020, experts, as Kuznetsov notes, identified about a thousand fraudulent call centers, but as of October 2021, their number had decreased to about 150. [16]
In 2022, according to Sberbank, Ukrainian fraudsters made approximately 1.5 billion attempts to make fraudulent calls to bank customers. The company's report indicates that over the past six months, Sberbank customers alone were victims of such attempts in more than 65 % of cases. On average, the bank notes, about 5 million calls are made daily, and the epicenter of this type of fraud is limited almost exclusively to Russia. A study of 37 million calls conducted by Sberbank experts shows that 99% of such calls were made to Russian citizens, with only 380,000 calls made to residents of Poland and 36,000 to Kazakhstan. [15] According to data from the cybersecurity department of Sberbank of Russia, as of the third quarter of 2022, there were more than 3,000 fraudulent call centers operating in Ukraine. [18]
Ukrainian media Stop Corruption found that most scam call centers use the same lawyers and security guards. For example, the offices are guarded by Puma Security, which was spotted during raids on call centers. [19] According to the Global Initiative, during 2022 Russian invasion of Ukraine, the idea of a “patriotic criminal” became widespread. In Odessa, pro-Russian criminals either ceased their criminal activities or went underground, while pro-Ukrainian criminals became “hyper-patriotic” and even patrol the streets alongside law enforcement agencies. Some members of criminal organizations that previously operated in the now-occupied eastern territories of Ukraine have now allowed criminals under their command to fight against Russia. A similar approach has been adopted by fraudulent call centers, which have used patriotic sentiments to recruit new employees by including questions such as “Do you also hate Russian scum? Do you want to help your country undermine the economy of the aggressor country? We are waiting for you” in their job advertisements. [1] [18]
In August 2022, following a series of arson attacks on military registration offices, Russia's Prosecutor General's Office stated that Russians were acting on instructions received from Ukraine from “individuals financed by organizations linked to the Kyiv regime.” That same month, Russia's Ministry of Internal Affairs subsequently detected “a sharp increase in reports of telephone scammers from Ukraine using new tactics." [18]
Russian Federal Security Service noted[ when? ] that scam call centers were used as Ukraine's response to the war. [1] The war in Ukraine has limited the activities of the Ukrainian police. In December 2022, the FSB issued a warning about Ukrainian scam calls, reporting that fraudsters “persuade gullible citizens to set fire to social infrastructure facilities and cars in crowded places.” According to the FSB, most of these arsonists were told that they were participating in an operation to catch criminals. [20] [21] [22] Russian Prosecutor General's Office claims that Ukrainian agents posing as police officers or bank employees made the calls and incited Russians to attack the centers in exchange for promises to pay off their debts. [21] [23] [24]
On March 13, 2023, Sberbank warned customers about a new scam: fraudsters call customers pretending to be law enforcement officers and say that a bank employee has stolen their data, transferred money from their account “to the Ukrainian army,” and that the customer now faces charges of treason. [7]
In April 2023, Russian media reported that Ukrainian scammers had tricked elderly Russians into setting fire to military comissariats and officials' cars, as well as shouting pro-Ukrainian slogans. Ukraine, for its part, did not comment on the allegations. [1] [6]
In August 2023, State Duma deputy Sergey Mironov informed Russian Defense Minister Sergei Shoigu that Ukrainian scam call centers were legitimate targets for the Russian military. [6] [25]
In October 2024, The Daily Beast reported that Ukrainian scammers were stealing Russians' savings as part of an underground scheme and transferring them directly to the Ukrainian Armed Forces. Call centers across Ukraine operating as part of Operation "Office" are equipped with headsets, software, and Russian phone numbers. “Office” is run by Ukrainian criminal groups and is part of a global fraud network covering India, the Philippines, and Russia. Until February 24, 2022, the victims of “Office” were citizens of Western countries, such as the United States, as well as representatives of European Union companies, but after the start of the war in Ukraine, the scammers switched to Russians. The scheme begins with a phone call from someone claiming to be a representative of a telephone company, who asks for a payment to be made. As a result, all the money in the victims' bank accounts ends up in the hands of the fraudsters. [26]
In December 2024, the FSB conducted searches at an alleged anti-scam call center and arrested its manager, who was of Israeli-Ukrainian origin. According to the agency, the call center was part of an international criminal group acting on behalf of former Georgian Defense Minister and Milton Group founder David Kezerashvili, which engaged in fraud under the guise of investment deals, revenues from illegal activities reached $1 million per day. The FSB stated that the call center was part of an international network. The organization believes that the call center also received instructions from the SBU in 2022 to send out scam warnings about terrorist acts in Moscow, Kursk, Bryansk, and Belgorod. Eleven individuals arrested during the raid were charged with organizing a criminal group, making false terrorist threats, and fraud on an especially large scale. [27]
In December 2022, thanks to the intervention of Kazakh law enforcement agencies, Ukraine shut down a scam call center in Dnipro, which had victimized around 18,000 Kazakh citizens. The group of fraudsters posed as IT security employees of banks. [28] [29]
In October 2023, Kazakhstan's Deputy Minister of Internal Affairs Igor Lepekha shared details about the elimination of a large scam call center in Ukraine, whose activities were mainly targeted at Kazakh citizens. Lepekha noted that the damage caused by them amounted to about 7 billion tenge, 5.8 billion of which were in the form of loans and credits. [30]
In November 2022, the Czech police published a press release on the methods used by Ukrainian scam call centers. The report stated that in December 2020, criminal investigators managed to uncover how the criminal activities of these Ukrainian groups began. The perpetrators transferred funds to foreign accounts, mainly in Russia and Ukraine. [31] [32]
In January 2021, there was a change in tactics, with fraudsters offering victims to transfer money to “safe” accounts in Czech banks belonging to Czech citizens. These funds were then collected and transferred to authorized persons. In the spring of 2021, the attackers changed their approach, demanding cash withdrawals from a new generation of ATMs called “Bitcoinmat” under the pretext of protecting the funds. [32] In November, at the request of the Czech authorities, a case was opened in Eurojust. [33]
In February 2022, the first meeting of the joint investigation team was held in The Hague. In June 2022, with the support of Eurojust, the Czech and Ukrainian authorities set up a Joint Investigation Team (JIT). [33]
In April 2023, the first joint operation of the Czech and Ukrainian police took place, involving 140 police officers. Criminal proceedings against four persons detained in the Czech Republic in connection with scam activities began on April 12. All defendants were charged with fraud and participation in an organized criminal group, which could result in up to 12 years of imprisonment. [32]
According to Czech police, one of the Dnipro call centers managed to defraud more than 600 victims, most of whom live[ when? ] in the Czech Republic. The scammers used Calling Line Identification technology to call victims pretending to be from the bank and police, warning them about an upcoming hacker attack and suggesting they transfer money to a “safe” account. The total damage from this scheme, according to the agency, reached 195,086,374 crowns ($8.7 million). [32]
In November 2023, Europol and Eurojust expressed their support for the efforts of the Czech Republic and Ukraine in combating scam call centers. [34]
In March 2023, during a raid in the Dnipropetrovsk Oblast, 10 members of a criminal group, including a “thief in law” nicknamed Lasha Svan, were detained and charged. They were believed to be the organizers of scam call centers targeting mainly Latvian citizens. At the same time, evidence emerged linking the leader of the drug trafficking organization “Khimprom” to fraudulent call centers. “Khimprom” is one of the largest organized crime groups in the Ukrainian drug market. [1] [35]
In June 2023, Ukraine's cyber police, in cooperation with Israeli law enforcement agencies, exposed the activities of a call center operator whose employees, according to the agency, had illegally embezzled 5 million hryvnia. [36]
In October 2023, Vyacheslav Milenin, head of the department for combating fraud and property crimes in north region, noted: "Today, Internet telephony is used, which makes our work very difficult. It is well known that most call centers are located in Ukraine; this is no secret. But it's difficult to find any leads or evidence to pinpoint one center or another. It can be said that this scheme has been well thought out and the fraudsters have covered their tracks very well. They are well aware of the methods and tactics used by the police, so they carefully disguise themselves at all stages." [37]
According to information provided by Eurojust, the investigation into investment fraud cases was initiated in October 2019 after the victim contacted the Swiss authorities. This led to the discovery of scam call centers and websites allegedly linked to financial and trading companies based in Ukraine and Georgia. The investigation was temporarily suspended due to the war in Ukraine. However, by the end of 2022, coordinated action had been taken in 23 countries as part of international cooperation. As a result of the searches, bank accounts and assets linked to the fraudulent operations were frozen. [38]
Milton Group is an organized criminal network of fraudulent operations operating worldwide and managed mainly from call centers in Tbilisi and Kyiv. An investigation by BBC Eye Investigations revealed 152 brands used by the Milton Group, including the fictitious cryptocurrency trading firm Solo Capitals in Georgia, CoinEvo, and EverFX. [39] A former Milton Group employee contacted the Swedish media after learning that the newspaper Dagens Nyheter had provided him with a hidden camera to record what was happening. [40]
In October 2021, Georgian Prime Minister Irakli Garibashvili said that a former official of the United National Movement (UNM) and former Defense Minister David Kezerashvili was allegedly behind the scam call centers. According to the head of government, Kezerashvili, who previously "had call centers in Ukraine," organized a criminal investment network operating as call centers. [41]
Despite the fact that the organization's scam was exposed by a number of influential world media, Ukraine has not taken any significant actions against scam call centers run by the Milton Group. [11]
In December 2024, the FSB of Russia announced the detention of 11 leaders and employees of the Milton Group. Among them was a citizen of Israel and Ukraine, who, according to the investigation, held a senior position in the company. Moscow has also put an Israeli and Georgian citizen on the wanted list. According to the FSB, these people not only participated in the group's activities, but also in 2022, on the instructions of the SBU of Ukraine, they sent false warnings about terrorist threats in several regions of Russia. [42]
{{cite web}}
: CS1 maint: multiple names: authors list (link){{cite web}}
: CS1 maint: multiple names: authors list (link)