There are more and more scammers in Max. Why the new messenger turned out to be more dangerous than the old ones and how the authorities are trying to hide it

The fight against scammers has become a pretext for blocking Telegram and WhatsApp. The Russian messenger Max was positioned by the authorities as a safe alternative.

In practice, already in the summer of 2025, cases of fraud in the messenger became known, and by the spring of 2026 there were many more of them. Warnings about new schemes developed by attackers specifically for Max are published daily in city and district public pages, organizations and management companies. Sometimes scammers themselves persuade victims to download Russian messenger. At the same time, the authorities are trying to hide the real scale of the problem.

“Paper” tells what is known about cases of fraud in the Max messenger, hacking methods and account purchases, and whether RuNet will become safer without WhatsApp and Telegram.

Fraudsters have been working at Max since the summer of 2025. They adapt classic schemes to the Russian messenger or come up with new ones

A 70-year-old pensioner from St. Petersburg was persuaded to install Max by an unknown person who introduced himself as an employee of Rosfinmonitoring. He told the St. Petersburg woman about the need to declare savings and the vulnerabilities of bank accounts. Already at Max, the woman received a call from another person who introduced himself as an FSB officer and instructed the pensioner. He convinced her to give her savings to two couriers. The first - 1.1 million rubles, and the second, a couple of days later - 1.4 million. This is one of the first publicized crimes committed using the Max, occurring in August 2025.

A little earlier, a resident of Kursk lost 444 thousand rubles due to scammers in the Max messenger. She was informed that a package had arrived and was asked to dictate the code from the SMS. After this, a man who called himself an “employee of Roskomnadzor” convinced the woman that the previous call was made by a fraudster and in order to return the money she needed to transfer first 300 thousand, and then 144 thousand rubles to the specified details.

The methods of deception used by scammers in Max are often similar to those used in other instant messengers. Victims receive calls from “government agencies” or “from banks”, they are convinced to give codes from SMS, transfer money to a “safe account” or “invest” it. It was under the pretext of “investment” that in March a Tyumen college studentwas defrauded of 3.6 million rubles.

Neural network imitations of voices or images are used to ask for a loan on behalf of acquaintances. So a few days ago a resident of Vladivostok lost her funds . Often, under various pretexts, victims try to gain access to “Government Services.”

The schemes are adapted to the infrastructure and content of the new messenger. Participants in house chats in Max write about replacing the intercom, introduce themselves as employees of management companies or emergency services, ask to pay off utility debt or provide access to “Government Services” to return the overpayment.

Work correspondence is also not protected. On March 10, the Public Council for Taxi Development spoke about a case of deception by the manager of a taxi fleet in the Rostov region in the Max work chat. The unknown person introduced himself as the current driver and provided his personal information. The scammer said that he was writing from a new phone number and asked to link the number to the system, and after logging into the account, he withdrew the money that was on the balance.

There is also a case where a fake account was created in Max for an official - the head of a district in Udmurtia. Deception of residents on behalf of officials was previously used by scammers in other messengers. For example, Governor Alexander Beglov called St. Petersburg residents asking for help in returning money stolen from the budget.

The more new features added to Max, the more reports of hacks, viruses and leaks

They started talking about the fact that the Max messenger could be connected to State Services in June 2025. Then they promised to integrate the service into the new messenger by October or November 2025. However, on August 6, the FSB expressed concerns about the risk of leaks and asked to eliminate vulnerabilities before connecting Gosuslug to Max. And already on August 8, the head of the Ministry of Digital Development, Maksut Shadayev, announced that the messenger had fulfilled all the requirements.

On August 25, the electronic signature “Gosklyuch” was integrated into the messenger, and on September 15, an electronic analogue of a passport appeared in it . The developers promised that it could be used in stores to confirm age, in cultural institutions, and for access to the territory of a college or university.

Chatbots, which are used for electronic signatures in Max, are less protected by encryption protocols than the Gosuslug and Gosklyuch services themselves, notes RKS Globa analyst and media lawyer Sarkis Darbinyan. He is sure that using an electronic signature in Max is unsafe, since fraudsters can spoof traffic or wedge themselves between the bot and the server. In addition, a chatbot can be faked.

In early March, the pro-Kremlin publication Gazeta.Ru, with reference to the head of the department for analysis and assessment of digital threats at Infosecurity, Kristina Burenkova, published news that attackers were spreading the Mammoth virus that hacks accounts in Max; the news has now been deleted. “Mammoth” allegedly hacks into the account of one of the chat participants and, on his behalf, publishes a message about an incident in which his friends were injured. The message asks you to follow a link to find out more details.

“People, excited about the news, click on the link and see a file with supposedly photos, but in fact it is an installation file for an Android application,” explains the expert. — Inside such a file is the Mammoth Trojan. This is malware that steals payment data and also intercepts push notifications and SMS with authorization codes in banking services.”

Almost immediately, the publication issued a refutation of the news from the messenger’s press service - it is still available on the website.

At least twice, information about the leak of Max user data appeared in the media , but the company also denied them.

Authorities continue to claim that Mach is safer and helps catch criminals. Experts explain that this is not so

Cyber ​​fraud today is most often the work not of individuals, but of entire organizations, put on stream, experts say.

“These organizations are in many ways similar to commercial ones,” explains IT expert Vladimir Lazarev. - Because they have a division of labor. They have a structure with a constant salary and a bonus depending on success in fraudulent transactions. They have educational programs, selection, training. And the process of organizing work itself is similar to some kind of IT company or work in sales.”

The transition to Max is a forced measure for such companies. After calls to Telegram and WhatsApp were blocked, scammers were faced with a choice: Max or cellular communications, explained Vestka’s interlocutors from such organizations. Some have switched to cellular communication, but it is less convenient to use. Scammers’ numbers are often displayed as “spam”, and it is more difficult to get through via cellular communication than in instant messenger, where it is immediately clear that the interlocutor is “online”.

In September 2025, journalists drew attention to the massive purchase of Max accounts on the darknet. There were also advertisements about renting accounts. The price of such a rental reached 250 dollars. “Most often, accounts are handed over by schoolchildren and students, for whom such a reward is significant. At the moment, such cases are isolated,” explained the press service of the Ministry of Internal Affairs.

The fraudster may not have to buy a ready-made account to get into Max, technical journalist Denis Alshanov is sure . You can buy a SIM card, use a lost or someone else’s passport, or even a fictitious number. All the schemes that were used in Telegram and WhatsApp also work in Max.

“[Max] is no better from this point of view than Telegram, and potentially even worse,” says IT expert Vladimir Lazarev, “because the Max messenger code itself probably contains a backdoor that is used to provide access to data and messages to intelligence services outside of an official request and outside of any mechanisms.”

Integration into Gosuslugi is often cited by officials as an argument that the messenger is becoming safer.

“Someone became a dropper, this is a criminal offense, and rented out his account in Max , ” State Duma deputy Sergei Boyarsky says in an interview with Fontanka, “But he will be found, most likely, because the account is linked to his “State Services.” And if you hand over your account to a banned WhatsApp or Telegram , then the law enforcement authorities will have no end.”

It was not difficult to figure out a drop, an intermediary in a fraudulent scheme, before, notes journalist Andrei Zakharov. Only it was not messengers that helped with this, but banks. Drops, themselves deceived by scammers, most often used their own accounts to transfer funds.

Max is safer because it transmits data to law enforcement officers, TASS explains in its material. This is the most common argument of government officials. At the same time, the expert with whom Novaya Gazeta spoke . Europe notes that centralized data storage always increases the risk of leakage.

We don't have complete data on Max scams, but even official figures show that the situation has not improved over the past six months

Stanislav Kuznetsov, a representative of the board of Sberbank, admitted at the end of November that despite all the measures taken, it was not possible to reverse the fraud statistics and predicted an increase in monetary losses from the actions of fraudsters by 15-20% by the end of the year. In January, the bank reported that over the previous year, cyber fraudsters stole 275-295 billion rubles from Russians. This coincides with the data that the bank published at the end of 2024 - then Russians lost 295 billion rubles.

The Central Bank last published statistics on the number of fraudulent transactions in the third quarter of 2025. Their number exceeded the average for the previous four quarters and amounted to 460 thousand fraudulent transactions. That is, despite the blocking of calls on Telegram and WhatsApp, in July, August and September, scammers deceived Russians more often than in previous months.

The number of cases of fraud using Max is not published in reports. It is difficult to calculate them from press releases - often they do not name a specific messenger or use the wording “new messenger” or “national messenger”. Anthropologist Alexandra Arkhipova drew attention to the wording in the city publication of Nizhny Novgorod . It said that the scammers called their victims in “one of the new instant messengers.” The Agency noticed several more similar formulations in regional news and press releases.

The press service of the Ministry of Internal Affairs, as a rule, talks about methods of fraud in Telegram and WhatsApp or describes only the schemes themselves, without mentioning the messenger. They try not to write about Max, even in posts where it is clearly implied. For example, in the description of a method for stealing a Telegram account through a phishing link under the pretext of moving a chat to Max.

For the first time, the press secretary of the Ministry of Internal Affairs, Irina Volk, reported on the arrest of a fraudster who used Max to defraud a Kursk resident of 444 thousand rubles in August 2025. The post ends with a call to follow “basic security rules,” despite the fact that “Max messenger provides an increased degree of protection against criminal attacks compared to foreign analogues.” Almost simultaneously , the press service of the Department of Internal Affairs of the Ministry of Internal Affairs admitted the presence of scammers in the messenger .

On February 26, the administration of the Kargasoksky district of the Tomsk region published a post on VKontakte about massive hacks in the Max messenger. The post said that residents of the area regularly receive messages from hacked accounts of friends and relatives. The post was noticed by TV2. News of Tomsk and Siberia,” but after a while the administration deleted it without explanation. After the publicity , the head of the Kamchatka Ministry of Emergency Situations, Sergei Lebedev, also deleted the post with screenshots of his conversation with the scammers at Max .

Fraud using Max “has become a fairly common phenomenon,” a representative of the Tyumen Region prosecutor’s office noted in a response to Interfax journalists. The publication initially published news with this quote, but then deleted the material.

Let's find out what's really going on

Make a payment in favor of the editorial office of Bumaga

What else to read:

• Postcards, recipes and the Kremlin. We spent a week using the Max messenger - and now we’re telling you what people read there and who got a million subscribers there
• In St. Petersburg, mobile Internet began to be turned off. Are drones really attacking the city more often now? And how do the authorities explain what is happening?

On the cover is a screenshot of a MAX advertisement. Source: "Sferum"