Ukrainian authorities have dismantled 94 fraudulent call centers following hundreds of searches across the country, uncovering large-scale operations that impersonated banks, brokers and law enforcement agencies to steal money or obtain access to victims’ financial accounts.
The coordinated operation involved the National Police of Ukraine, the Security Service of Ukraine and the Prosecutor General’s Office, with German authorities participating in an investigation involving victims elsewhere in Europe. Police conducted 411 searches and inspected infrastructure connected to suspected scam operations in multiple Ukrainian regions. Twenty-six people have so far been formally notified that they are suspects.
Behind what appeared to be ordinary offices, investigators found organized call center operations equipped with prepared conversation scripts, databases containing potential victims, specialized software and systems for concealing and transferring stolen funds. Police identified administrators, telephone operators and other participants carrying out different roles within the schemes.
The methods varied depending on the operation. Some callers pretended to represent banks and warned targets that suspicious activity had supposedly been detected on their accounts. Victims could be told that their accounts were at risk of being blocked, creating pressure to follow the caller’s instructions before they had time to verify whether the warning was genuine.
Other operations presented themselves as investment or cryptocurrency brokers. Targets were directed toward fraudulent trading platforms and persuaded to deposit money into investments that did not exist. Police found that some call centers specifically searched for people who had demonstrated a genuine interest in investing, collecting their contact information in databases that could then be used internally or sold to other scam operations.
The fraud sometimes went significantly further than requesting a direct payment. Victims were instructed to take out loans, disclose payment card information and confirmation codes, or install remote-access applications on their computers and smartphones. Giving scammers remote control of a device could provide another route to the victim’s financial accounts.
Authorities also uncovered recovery scams targeting people who had already lost money. Operators offered supposed assistance with recovering funds stolen in earlier fraud, only to exploit the victims again. Another identified operation involved selling dietary supplements as treatments for different illnesses even though police said the products’ chemical composition provided no therapeutic properties.
Some of the dismantled operations did not primarily target Ukrainians. In one investigation conducted with German police, authorities documented a network targeting European Union residents. Victims were persuaded to invest through fake brokerage services and install remote-access programs. Their money was subsequently transferred through cryptocurrency exchanges to accounts and digital wallets controlled by the perpetrators.
The physical scale of the call center network became clearer during the searches. Investigators discovered 1,794 fully equipped workstations and seized 3,336 pieces of computer equipment, 1,346 phones, more than 5,200 SIM cards and 90 bank cards. Police also recovered access tools associated with 20 cryptocurrency wallets and seized 22 vehicles.
Financial assets recovered during the operation included approximately $2 million in cash, €64,000, additional Ukrainian currency and one kilogram of bank gold in bars, along with jewelry. Separately, investigators identified 67 financial instruments allegedly connected with criminal activity, including bank cards or accounts, cryptocurrency wallets and people suspected of acting as money mules.
Depending on individual roles and circumstances, suspects are being investigated under provisions of Ukraine’s Criminal Code covering fraud and laundering criminal proceeds. The offenses cited by police can carry sentences of up to 12 years in prison together with confiscation of property.
The investigation has not ended with the raids. Police are examining the seized computers, phones, and financial transactions to identify additional victims and calculate the total losses. Investigators are also working to identify the organizers behind the operations, other participants in the networks, and people responsible for moving and laundering the proceeds.