My "public services" hacked

How not to become a victim of scammers and lose an account (if you are not in Russia)

The hacking of accounts on the website of the “State Services” is not a new phenomenon, but for Russians the restoration of a hacked profile that has left the country becomes an almost unsolvable task. The correspondent of the "cold" Julia Selikhova became the victim of scammers who hacked her personal account at the "public services". She described her own experience, gathered similar stories of other people and lawyers' advice on how to protect her account. However, she failed to regain control over him. Why - in the material "Cold".

In order not to miss the main materials of the "cold", subscribe to our Instagram and telegram .

In early June, I decided to go to my “State Services” account and suddenly found that nothing was happening. The password did not fit. I thought that my memory was bringing me, I tried several other combinations, but nothing worked. Then I clicked on the “password restoration”, entered my passport data, the sequence of letters and numbers from the picture, with the help of which the “public services” check if you are a robot. The site issued a window with the question "Where to send a confirmation code?" - On the phone or email.

But neither the phone nor the postal address had nothing to do with me and my account. At first I did not understand anything. And then she looked more carefully at the displaying part of the email " 9*************@mymail.lol ". Google prompted that the domain @mymail.lol provides the user with temporary or disposable e -mail. Apparently, they hacked me.

Having cracked the “public services”, scammers gain access to a huge amount of information about a person: passport data, TIN, SNILS, OMS, information about cars and real estate, foreign passports and, in the case of some users, to an electronic digital signature. Having gained access to personal information, they can issue microcredits , real estate transactions , and parallel access to the FTS website will change the tax status (for example, issue an individual entrepreneur or self -employment) and even apply for a tax deduction.

In recent years, accounts have been hacked, including for further resale of personal data for advertising and fraudulent purposes. One hacked account costs a penny, so thousands are hacking at once. In addition, through access to “public services”, scammers can arrange an electronic SIM card in your name, with which you can access online banks. And this already threatens the withdrawal of money, opening accounts and new loans.

Attempts to restore "public services"

In the evening of the same day, I decided to deal with this situation and restore access to my personal account at all costs. Found on the site step -by -step instructions .

1) If there is access to the phone and mail that were indicated during registration, you can restore access online

For recovery, you need to enter either an email address or a phone number, and then - the data of the passport, SNILS or TIN. This option is not suitable for me, because the phone number and e -mail in my account are no longer mine.

2) If there is no access to the phone and mail, you can restore access through the online bank

The instructions say that you can use the site or application of one of the partner banks: Sberbank, Mail Bank, VTB, Tinkoff, RNKB Bank, MTS Bank, Otkritie Bank.

I think: "Hurray, this is my option." But Sberbank does not go out to enter the personal account. For more than a year of life outside Russia, they make themselves felt: the unused Russian SIM card was deactivated. “Okay,” I think, “I have access to my personal account at Tinkoff - there I managed to re -arrange access to my personal cabinet.” I enter the phone number, enter the code from SMS, enter my password from the Tinkoff personal account. Again it did not work.

If your personal account of the online bank is not tied to the Russian SIM card, it is impossible to restore access to “public services”. We try further.

3) If there is no access to the phone and mail, you can restore personally at the service center

This option is not an option for me, since going to Russia now seems dangerous to me. Well, I think it's time to contact the support service.

4) recovery through the support service

In order to ask a question on the "public services" in writing, you must first shake yourself in your personal account. Since I do not have the opportunity to enter the site-in fact, due to the fact that my account was hacked-I am looking for another option. I find it. For calls, not from Russia there is a separate line.

"They already have your data"

By the indicated number I get to the robot with screenshot answers. I have already tested everything that he offers me. I'm trying to get a conversation with the operator. “Repeat your question,” the robot asks. “Connect me with the operator,” I say. “Repeat your question,” he demands again. So several times in a circle, until by some miracle they throw me into a living person.

They offer to wait for the connection for 14 minutes. Well, what are my options? I listen to music, I'm waiting. After 20 minutes, the young man picks up the phone, it seems to Dmitry. I explain to him my situation, he says: “Yes, I see that all the data in your profile was deleted, it looks like a hack. Now it is displayed that your account was created on June 4, 2023. ” That is, the day before I found it.

I ask what can be done now. I explain that I do not plan to go to Russia (and I will not come to the MFC) and I would like to block the account, access to which the scammers remains.

“Yes, in principle, they already have your data, it makes no sense to block the account,” says the operator. “Then come to Russia, restore access.” I insist: “No, it won't. I want to block the account, to which scammers have access. After all, they can use them for some services. ”

“Not many services can be issued through“ public services, ”says the operator. “Unless voted in the elections.” I recall that in the fall there will be, maybe not the most important vote , but in the spring of 2024 - quite: the presidential election. I do not intend to voluntarily give my voice to scammers. I ask: “How can I, without coming to Russia, apply for an account blocking?”

“No way, there is no such option. We remotely do not block accounts, only with a personal turnout, ”says Dmitry.

In bewilderment, I ask how this is possible. I propose to transfer me to the head of the department, to the technical service or to someone who can help. “No, this is impossible,” I hear in response. I say: “Dmitry, you are not lucky that it was you who were on this shift. I will not leave you until we solve this problem. Let's figure out what you can do. ” Dmitry does not sigh, silently, then suggests: “Let me apply for an application that the account was not created by you, then technical specialists will be dealt with.”

"And the account will be blocked?" - I ask. And I hear in response: "No." At this moment, our conversation is interrupted. “Apparently, the money has ended in the account,” I think.

How the "public services" hack

A similar story happened with the reader of Cold Julia. At the end of May, she tried to enter the account, but could not. “I tried to return access for two hours, tried different ways: through the phone, mail and bank,” says Julia. -It turned out through Tinkoff, with the help of the Russian SIM card. When I went into the account, I changed my password, mail and phone. ”

The technical expert of Roskomsvoboda told the Cold that there are two main options for hacking an account at “public services”:

• Fishing is a type of Internet canvas, the purpose of which is to obtain access to login and user passwords. The owner of the account comes a fisch letter, he goes to the fake site of the State Services and enters the user and password there. According to the expert, this is the most common option that is used to hack "public services";
• Buying passwords with passwords. “If the owner of the account has the same passwords everywhere and the current password is in a leak, then scammers can buy it. On specialized sites, it costs inexpensively, ”says the expert.

In addition to these common options, he calls several more hacking ways:

• reset of the account to the hacked email address;
• tax collection using the virus on the device;
• Hacking through physical access to someone else's device on which “public services” are logged in.

Elizabeth told another way to hack the cold: “At the end of April, a man called my mother and introduced himself as an employee of the“ State Services ”. He asked his mother to name the code from SMS, and she called it. The password was changed, and she lost access to the account. ” Elizabeth says she tried to help mom restore access to the account. She called the Support Support Service, but they did not help her there. “Mom’s account was not found either by the name or her phone number, nor at the email address,” says Elizabeth. - The operator said that nothing could do in this situation. As a result, I got a new account to my mother. ”

The reader of Kholoda Daria found out about the hacking of the account at the “State Services” in late May thanks to the application for the receipt of the passport. She was waiting for the document and regularly went into the account. During the next check, she found that the account was hacked: the phone number and email were alien.

Daria was able to restore access to the account through Sberbank-Online. “I went to my account at“ public services ”, and there is empty, there is not a single certificate, services, nothing. And the address of the registration was changed to the Crimea. I changed all the data, changed my password and wrote to the support service, ”she says. In response to her message about the hacking of the account of the Support Support Service, she threw her only the instructions “how to protect the account” .

Daria was frightened for the passport and went to the department on migration issues: there she was told that the passport was being prepared, the application, despite the missing entry on the "State Services", is valid. They also recommended that they go to the MFC or to the district police officer in order to report on the hacking of the account. At the MFC, she was advised to check whether fraudsters were issued loans according to her passport data. “I checked on the site , there are no loans for me. This reassured me a little, then I didn’t go anywhere, ”says Daria.

The story of the account of the account on the “public services” for Mary (the name changed) was not so harmless. In January, she discovered a letter from the tax service for sudden debt. “I went to my account at the“ State Services ”and found that in the summer, in August 2022, self -employment was issued to me,” she says. This happened in the Altai Territory, although Maria was registered in Moscow and was not in Altai.

In January, Maria discovered a message according to which it was necessary to pay a tax - 300 rubles (a tax certificate is at the disposal of “cold”) . She wrote a statement, knowing the tax service that the self -employment regime was framed by scammers. “I cited all the evidence that it was not me. I indicated that the scammers indicated the address of my registration with an error, indicated not my phone number. But the tax came from the tax that they were not authorized to check it all, ”says Maria. - As a result, I paid the tax and wrote a statement about the termination of the self -employed regime. I didn’t go to the police, firstly, because the amount of only 300 rubles, and secondly, I now live in Russia. ”

Whether the hacks of the "public services" have become more frequent after the departure of many Russians from the country is unknown. Lawyer Stanislav Seleznev explained to the “cold” that it is difficult to analyze such information, because “public services” do not disclose such statistics. “Cold” sent requests to the leaders of the Russian cybersecurity market: FACCT (former Group-Ib) and Positive Technologies with a request to comment, but did not receive answers at the time of publication.

Continuation of a long recovery history

Throwing the money to the phone’s account, I tuned in that I would have to go over again. But I was lucky: the same operator - Dmitry again picked up the phone. Upon learning that I was calling the previous requirements, Dmitry sadly explained that he could apply for technical support and they will conduct a trial. But you can’t block an account without a personal turnout. I tried to convince Dmitry that I could confirm my identity by phone in any possible way, just to return access to my account, but it was adamant.

A day after talking with the operator, a letter received me to the e-mail-technical support said that, hacking my account, scammers “confirmed my personality” in the service center in the Dagestan village, which they allegedly already blocked due to unscrupulous work.

For another week I corresponded with the technical support of the “public services” by mail, but I could not get blocking the account. Moreover, even the power of attorney will not help restore access to the account.

The technical expert of Roskomvoboda compiled a list of recommendations for the protection of the account on the "State Services":

1. Include two -factor authentication by installing the second level of the audit through a special application (for example, Andotp, Authy, Google authenticator).

Lawyer Stanislav Seleznev adds that in this case it is important to write down the recovery codes and secret words. Otherwise, you can forget how to get into an authentication application - then it will not be possible to get into the "State Services".

1. Do not use the same passwords on different accounts and on different sites.

2. Follow the equipment . Do not let strangers use your gadgets with which you go to the "State Services".

Seleznev adds another important advice: “If you have left for another country, do not forget to perform a paid operation (call or SMS) every 80–88 days -this will prevent its deactivation.”