European police bust Ukraine-based call center network behind $11 million in scams

Law enforcement agencies from several European countries have dismantled a network of fraudulent call centers operating across Ukraine that defrauded hundreds of victims of more than $11.7 million, police said.

According to Eurojust, the EU agency for judicial cooperation, the criminal organization ran professional call centers in Kyiv, Dnipro and Ivano-Frankivsk.

The group recruited employees from the Czech Republic, Latvia, Lithuania and other European countries, bringing them to Ukraine to work in the call centers. About 100 people are believed to have been involved in the operation.

Czech police said it has become more common to move such call centers closer to the front line in an apparent attempt to deter law enforcement operations amid Ukraine’s war with Russia.

Callers were paid commissions of up to 7 percent of the money they extorted from victims, with promises of cash bonuses, cars or even apartments in Kyiv for top performers — incentives investigators say were never actually paid out.

The suspected criminals posed as police officers or bank employees and tricked victims into believing their bank accounts had been hacked. They then persuaded victims to transfer large sums to “safe” accounts controlled by the network or to install remote-access software that allowed the criminals to take over their banking apps.

Authorities estimate that more than 400 known victims lost at least $11.7 million, though they believe the real figure is significantly higher.

Earlier in December, police carried out dozens of coordinated searches across the three Ukrainian cities, seizing forged IDs, laptops, phones, hard drives, weapons, ammunition, vehicles and cash. A polygraph machine was also found. Twelve suspects were arrested during the raids, while a total of 45 individuals have been identified as suspects across all participating countries.

In a separate operation this week, Czech authorities and Ukraine’s security service (SBU) dismantled another major fraud ring in Kyiv that targeted victims with fake investment schemes. Police said the call center created fake investment websites designed to mimic legitimate platforms and promoted them using fabricated reviews and advertisements.

The group, led by a 31-year-old man from Ukraine’s Donetsk region, allegedly lured victims into depositing funds that were then diverted to the criminals. The scheme is believed to have caused nearly $2 million in losses to at least 138 known victims, though authorities expect the number of victims to rise into the thousands.

Get more insights with the

Recorded Future

Intelligence Cloud.

Learn more.

No previous article

No new articles

Daryna Antoniuk

Daryna Antoniuk

is a reporter for Recorded Future News based in Ukraine. She writes about cybersecurity startups, cyberattacks in Eastern Europe and the state of the cyberwar between Ukraine and Russia. She previously was a tech reporter for Forbes Ukraine. Her work has also been published at Sifted, The Kyiv Independent and The Kyiv Post.

 

Total
0
Shares
Previous Post

APT28 Targets Ukrainian UKR-net Users in Long-Running Credential Phishing Campaign

Next Post

Kimwolf Botnet Hijacks 1.8 Million Android TVs, Launches Large-Scale DDoS Attacks

Related Posts

Ukraine Warns of CABINETRAT Backdoor + XLL Add-ins Spread via Signal ZIPs

The Computer Emergency Response Team of Ukraine (CERT-UA) has warned of new targeted cyber attacks in the country using a backdoor called CABINETRAT. The activity, observed in September 2025, has been attributed to a threat cluster it tracks as UAC-0245. The agency said it spotted the attack following the discovery of software tools taking the form of XLL files, which refer to Microsoft Excel
Read More

New SAP NetWeaver Bug Lets Attackers Take Over Servers Without Login

SAP has rolled out security fixes for 13 new security issues, including additional hardening for a maximum-severity bug in SAP NetWeaver AS Java that could result in arbitrary command execution. The vulnerability, tracked as CVE-2025-42944, carries a CVSS score of 10.0. It has been described as a case of insecure deserialization. "Due to a deserialization vulnerability in SAP NetWeaver, an
Read More