European police bust Ukraine-based call center network behind $11 million in scams

Law enforcement agencies from several European countries have dismantled a network of fraudulent call centers operating across Ukraine that defrauded hundreds of victims of more than $11.7 million, police said.

According to Eurojust, the EU agency for judicial cooperation, the criminal organization ran professional call centers in Kyiv, Dnipro and Ivano-Frankivsk.

The group recruited employees from the Czech Republic, Latvia, Lithuania and other European countries, bringing them to Ukraine to work in the call centers. About 100 people are believed to have been involved in the operation.

Czech police said it has become more common to move such call centers closer to the front line in an apparent attempt to deter law enforcement operations amid Ukraine’s war with Russia.

Callers were paid commissions of up to 7 percent of the money they extorted from victims, with promises of cash bonuses, cars or even apartments in Kyiv for top performers — incentives investigators say were never actually paid out.

The suspected criminals posed as police officers or bank employees and tricked victims into believing their bank accounts had been hacked. They then persuaded victims to transfer large sums to “safe” accounts controlled by the network or to install remote-access software that allowed the criminals to take over their banking apps.

Authorities estimate that more than 400 known victims lost at least $11.7 million, though they believe the real figure is significantly higher.

Earlier in December, police carried out dozens of coordinated searches across the three Ukrainian cities, seizing forged IDs, laptops, phones, hard drives, weapons, ammunition, vehicles and cash. A polygraph machine was also found. Twelve suspects were arrested during the raids, while a total of 45 individuals have been identified as suspects across all participating countries.

In a separate operation this week, Czech authorities and Ukraine’s security service (SBU) dismantled another major fraud ring in Kyiv that targeted victims with fake investment schemes. Police said the call center created fake investment websites designed to mimic legitimate platforms and promoted them using fabricated reviews and advertisements.

The group, led by a 31-year-old man from Ukraine’s Donetsk region, allegedly lured victims into depositing funds that were then diverted to the criminals. The scheme is believed to have caused nearly $2 million in losses to at least 138 known victims, though authorities expect the number of victims to rise into the thousands.

Get more insights with the

Recorded Future

Intelligence Cloud.

Learn more.

No previous article

No new articles

Daryna Antoniuk

Daryna Antoniuk

is a reporter for Recorded Future News based in Ukraine. She writes about cybersecurity startups, cyberattacks in Eastern Europe and the state of the cyberwar between Ukraine and Russia. She previously was a tech reporter for Forbes Ukraine. Her work has also been published at Sifted, The Kyiv Independent and The Kyiv Post.

 

Total
0
Shares
Previous Post

APT28 Targets Ukrainian UKR-net Users in Long-Running Credential Phishing Campaign

Next Post

Kimwolf Botnet Hijacks 1.8 Million Android TVs, Launches Large-Scale DDoS Attacks

Related Posts

MSS Claims NSA Used 42 Cyber Tools in Multi-Stage Attack on Beijing Time Systems

China on Sunday accused the U.S. National Security Agency (NSA) of carrying out a "premeditated" cyber attack targeting the National Time Service Center (NTSC), as it described the U.S. as a "hacker empire" and the "greatest source of chaos in cyberspace." The Ministry of State Security (MSS), in a WeChat post, said it uncovered "irrefutable evidence" of the agency's involvement in the intrusion
Read More

Experts Confirm JS#SMUGGLER Uses Compromised Sites to Deploy NetSupport RAT

Cybersecurity researchers are calling attention to a new campaign dubbed JS#SMUGGLER that has been observed leveraging compromised websites as a distribution vector for a remote access trojan named NetSupport RAT. The attack chain, analyzed by Securonix, involves three main moving parts: An obfuscated JavaScript loader injected into a website, an HTML Application (HTA) that runs encrypted
Read More