Anxious bell

The Russians steal money with the help of old SIM cards. Under the blow of "public services", banks and personal data. How to avoid losses?

The mass emigration of Russians because of the war gave rise to new methods of fraud and updated the old ones. For one of them, old SIM cards are used: along with unused numbers, attackers get access to all accounts of citizens who were attached to the old number. Thus, scammers apply for loans and gain access to different services at someone else's expense. Employees are more difficult in these situations, because the proceedings almost always need a personal presence, but the problem is also relevant for those who remained in Russia. "Cold" talks about such cases and explains how to protect yourself.

In order not to miss the main materials of the "cold", subscribe to our Instagram and telegram .

From the scheme with SIM cards, the Russian woman Marina Tashireva, living in Canada, suffered. She said that scammers issued a two million rubles loan for her and her husband. In October, she and her husband received several emails from different banks, which talked about applications for loans that Marina and her husband did not execute. The emigrant Anna (the name changed), who moved from Russia to Germany, faced a similar situation: her account on the “public services” hacked, and fraudsters filed applications on her behalf for the issuance of a loan. Alfa-Bank, one of the largest banks in the country, agreed to issue a loan.

According to the lawyers with whom the “cold” talked to, such cases in Russia are regularly happening: it is impossible to calculate them, but people often turn to lawyers, who were tried to apply for scammers to the loan. The scheme is not new: for example, accounts on public services were hacked in a similar way. Typically, scammers use merged databases, checking the phone numbers whose owners do not use them anymore. In the risk zone are not only people who have left the Russian Federation, but also those who live in the country.

This happened to Marina Tashireva. After the spouses departed abroad, MTS resell their numbers to other people. Probably, the fraudster was able to go to the “public services” husband’s number and submitted applications for loans to several different banks-only Alfa-Bank, in which the man received a salary, received the agreement to issue an agreement. By that time, he had not lived or earned in Russia for a year and a half. According to his stolen data, the bank issued a loan in cash for the amount of two and a half million rubles.

When can a SIM card be resold?

If the SIM card does not work for some time, and the balance in the account is negative, then the mobile operator has the right to block it, and another subscriber will receive the number. For Megafon, this period is 90 days, for Beeline and Tele2 - 180 days, for MTS - from 60 to 183 days.

“On October 9, we received a message from Alfa-Bank on a loan that we did not issue. Six documents were attached to the letter, and everywhere there were ticks - we allegedly left electronic signatures, ”Marina told the cold. - The list included: a payment schedule, insurance, Policy Offer and several insurance documents. We used to have a credit card in Alfa-Bank, but we closed it through the application. And after this situation, we learned that the account was not completely closed. I don't know how it works. And even in the payment schedule, two million and 500 thousand. The amount of the main loan debt is 1 million 758 thousand, the amount of interest on the use of a loan is in the region of 830 thousand. ”

The spouses found a lawyer and sent applications for the abolition of insurance and the “Cheap Bet” service by e -mail, SDEC and “Russian Post”. Under the terms of the contract, all this had to be done in 14 days - otherwise I would have to pay for services. Then the spouses wrote a statement asking the agreement to be non -concluded and asked the bank to cancel the loan and return the money to them.

“In the statement, we wrote that the bank conduct an internal investigation and announced how this happened. In response, we, of course, received nothing and even now we don’t know what happened, ”the couple said.

Alfa-Bank demanded to pay interest or resolve issues through the court. Marina and her husband had to pay 50 thousand rubles - for the interest and services of a lawyer. Tashireva later informed Kholoda that Alfa-Bank reimbursed this money for them.

“From Cringe: the employees [bank] did not meet, it was no matter for them who eventually issued a loan. The power of attorney was not accepted, despite the fact that it is complete. Not everyone else will get through the first time, and according to the classic, all services transferred us to each other, the result: the loan was not recognized as invalid. The bank requested evidence that it was not us that we issued a loan. And you do not want to prove how you approved a loan to a person who has no salaries in Russia at all? " - says Tashirev.

She suggests that MTS or Alfa-Bank employees could be involved in fraud, but she has no evidence. The victim advises the Russians, especially to emigrants, order an extract from the bank, check access to the Russian number, “public services” and make sure that the accounts and cards of all banks in Russia are closed.

“Cold” sent Alfa-Bank questions about how they allowed the loan to scammers and why employees refused to accept the power of attorney. At the time of publication, the company's press service did not respond to a request from a journalist. In the remarks to the thread, bank employees write that they “understand the problem” and promise to strengthen protection and verification when drawing up loan agreements.

Help from above

Lawyer Dmitry Grustatov in the commentary "Cold" also believes that Alfa-Bank employees could be involved in fraud.

“The bank employees were probably involved in this scheme. Because security systems in banks are built quite reliably to avoid such schemes, ”said Grazov.

Another way of "hijacking" accounts is to gain access to the SMS code. In this case, fraudsters also use merged databases to find the most vulnerable victim, after which they try to take the account, receiving a short code from the SMS necessary for two -factor authentication. They can get the code through social engineering (call the victim and get it with deceit) or with the help of complex technical solutions-for example, the release of a duplicate of a SIM card and interceptions of an SMS-community.

In such a situation, there was a Russian Anna living in Germany (the name changed). She told the Cold that last year her scammers hacked her account at the “State Services”. who received her passport data and tried to hack a personal account in Sberbank.

“They recognized the number of my card and intercepted the SMS ( the fact of the“ cold ”cannot confirm the fact of interception ). I saw how I was authorized on the website mos.ru and signed for donations to the Russian military, although I was not going to give them money. Fraudsters threw applications to different banks through the Bank.ru portal, and they automatically came to the answer that they need to go to the department with documents and they will be a loan. The list included “Mail Bank”, “Alfa-Bank”, VTB, Svokombank and “Tinkoff”, which managed to approve the credit card to me-fortunately, I managed to see a notification about this, ”says Anna.

Remote issuing loans can be prohibited

According to the client, some banks may impose a restriction on financial transactions on the Internet. Only lending can be prohibited, or you can set the maximum amount for banking operations. Now this can only be done in branches of several large banks. In October, the State Duma adopted in the first reading amendments to the bill on self -violation on loans, but in January 2024 the law has not yet adopted.

Anna came to Russia and turned to the MFC, where she was advised to go to each bank and sign the prohibitions on remote issuing loans. Anna was able to put the function of self -embodiment only in Tinkoff and Sberbank. Alfa-Bank refused her because she was not their client, and in the “Svombank” they said that they did not have such an opportunity.

Anna said that she filed online against the police last year, but to no avail. In Russia, she came to the department personally, but here she was refused to initiate the case, since no one stole the money. Anna was given a written refusal (the “cold” has), which stated that the statement did not see the signs of a crime.

“They said that it is impossible to take loans through“ public services ”, although fraudsters succeed. They talked politely, but the general meaning of the conversation was “go to hell,” Anna notes.

You can unexpectedly find out that “you” took a loan from a microfinance organization. The lawyer who worked with digital fraud anonymously told the Cold that people often come to people to recover money from him under an agreement with a microfinance organization that the client did not conclude. At the same time, the document was electronic, and it indicated that the parties recognize the electronic signature as an analogue of the hand -handed.

“Most often, people accidentally leave a copy of the passport in the public domain, and scammers use it. Clients sent complaints to the Central Bank, and then checked the microfinance offices. But, as I understand it, scammers trying to conclude contracts are not particularly found, ”says the lawyer.

Irrevocable losses

For several years have been known about the theft of data through the “public services” and hacking of accounts for several years. For example, in May 2021, Russians Diana Zabelina hacked an account. She said that she tried to contact the support service, but she could not help her. And in November 2023, in the Arkhangelsk region, scammers gained access to accounts on “public services” at once with 10 people per day. Despite the growth of technical threats, the state of social engineering still has the vast majority of cases when scammers gain access to the accounts of banks and “public services”.

With access to “public services”, scammers can arrange an electronic SIM card for someone else's name and gain access to online banks. So they can get a loan on a person, withdraw his money or gain access to other services: for example, re -registered real estate or open a business.

According to the Bank of Russia, for the first three quarters of 2023, 11.3 billion rubles were stolen from bank customers, that is, about 1.26 billion rubles a month. In 2022, the amount of stolen funds from Russians broke the 2019 record and amounted to 13.3 billion (approximately 1.113 billion per month). Thus, while maintaining the average annual dynamics, 2023 in the volume of fraud may surpass the 2022th. The share of returned funds still remains at a negligible level-around 4.8%. The total number of identified cases of fraud in the first three quarters of 2023 almost reached the level of only 2022: 819.3 thousand cases versus 871.7 thousand.

What to do so as not to get to the scammers?

The lawyers of the First Department and the lawyer who asked for anonymity, the candidate of legal sciences told the "cold" about the main rules of information security, which must be observed so as not to fall as of the scammers:

1. Do not open scans and photos of official documents - passports, TIN and others in the public domain.
2. Use two -factor authentication means on all devices.
3. Do not report passwords from personal accounts of bank applications.
4. At the slightest doubt, double -check the information.
5. If you need unsafe services, come up with very complex passwords for them.
6. Do not use passwords from merged databases .
7. From time to time, check your personal accounts on “public services” and in Russian banks. It is important that the phone and mail to which the account is registered are in your use. If you have lost access to them, you need to immediately change them in your personal account.
8. Order an extract from the Bureau of credit stories at the "State Services" and double -check it every month.
9. Set a ban on remote issuing loans in those banks where it is possible.

If you find that scammers are trying to issue or have already issued a loan for you, you need to write statements to the bank, the police and the Central Bank. It must be sent by mail and attach a copy of the letter about the conclusion of the contract to the police and the Central Bank.

Lawyer Dmitry Pravitov told the cold that the court is obliged to take the side of the plaintiff if the person himself did not draw up a loan and did not sign the documents for him. A notarized power of attorney for relatives in the bank is also required to accept - you have the right to write a complaint about the refusal.

Always remember that your data can sell fraudsters. You are at risk if:
- You have an unclosed bank account whose services you no longer use;
- Your "public services" or personal account of the bank are tied to the already invalid phone number;
- You have not entered the application of the Russian bank or “public services” for a long time.