A fraudulent call centre operating in Stryi has been shut down. Its members used fake online relationships to obtain remote access to the online banking of citizens of Ukraine, European Union countries, including Poland and Germany, as well as Georgia. This was reported under the procedural guidance of the Lviv Regional Prosecutor’s Office.
According to the investigation, two 23-year-old residents of Stryi, with the involvement of a 21-year-old acquaintance, set up so-called fraudulent call centres. The perpetrators posed as women and struck up conversations with men on dedicated services and in messaging apps, using fake female accounts.
During conversations, the “employees” gained the victims’ trust and, under the guise of sending photographs, forwarded disguised malicious files. When the interlocutors said the “photos” would not open, they were persuaded to enable screen sharing on their mobile phones and perform certain settings. At that point, the device unlock passwords and access details for banking apps were captured. Once they had remote access, the perpetrators transferred money from the victims’ cards to accounts under their control.
To run the scheme, the perpetrators rented two flats in Stryi, which they equipped with computer hardware, electronic communication tools and workstations for the “employees”. In addition to the physical offices, there was an online management system: in a closed Telegram group they distributed work schedules, provided detailed instructions on fraud techniques and kept records of the stolen funds. The executors were supplied with malicious software for remote access to devices and online banking systems, as well as a neural network that altered a male voice to a female one in real time.
The stolen funds were shared according to a set scheme: the direct perpetrators received 15% as their “salary”, while the remaining 85% went to the organisers and was used to further maintain the phishing network. Preliminary data indicate that at least 50 Ukrainian citizens and 30 foreign nationals have fallen victim to the group.
As part of the criminal proceedings, nine searches were carried out at the places of residence and registration of individuals who may have been involved in the unlawful activities, as well as at a crypto exchange used by those involved in the case. Computer equipment, storage devices, mobile phones, bank cards, draft records and cash in various currencies totalling around UAH 2 million were seized.
Under the procedural guidance of the Lviv Regional Prosecutor’s Office, three residents of Stryi have been notified of suspicion, depending on their role in the criminal offence, under Articles 190, 225-4 and 361 of the Criminal Code of Ukraine – fraud, creation and leadership of an electronic-communication fraudulent organised group or participation in it, as well as unauthorised interference with the operation of information (automated) systems that led to an information leak.
“The suspects used a whole range of technologies – from voice spoofing using neural networks to malicious software disguised as ordinary photographs. To avoid taking the bait of fraudsters, follow the basic rules of digital hygiene: do not click on suspicious links sent by new online acquaintances, do not download files with the .apk extension and never share your smartphone screen with strangers. If you notice suspicious activity or lose access to online banking, block your cards immediately and contact the police,” said Maksym Dzikovskyi, prosecutor of the department for supervision over compliance with the law by the National Police of Ukraine at the Lviv Regional Prosecutor’s Office.
Investigative actions are ongoing to identify other individuals who may be involved in the unlawful activity, as well as additional victims. The pre-trial investigation is being conducted by the Main Department of the National Police in Lviv Region, with operational support provided by the Cybercrime Counteraction Department in Lviv Region and the Security Service of Ukraine in Lviv Region.
Pursuant to Article 62 of the Constitution of Ukraine, a person is presumed innocent of committing a crime and may not be subjected to criminal punishment until their guilt has been proved in the manner prescribed by law and established by a guilty verdict of a court.