A promised 6,500-hryvnia aid payment became a route into victims’ bank accounts, according to Ukrainian cyberpolice. Their October 27 report describes 39 people losing nearly UAH 1 million and says an indictment against two participants was sent to court on October 23. The case turns on a dangerous reversal: people trying to receive money were asked for secrets that could authorize someone else to take it.[1]
From a social-media offer to a counterfeit government page
Investigators describe Facebook, Telegram and purpose-built bots directing people toward imitation government websites. The forms collected card details, CVV2/CVC2 security codes and one-time passwords; police allege those details enabled unauthorized online-banking access and transactions.[1]
The handoff matters more than the platform carrying the link. A message can talk about public assistance while the destination behaves like a payment or account-access form. The amount on the invitation describes the promised benefit; it does not set a ceiling on what the requested credentials could expose.
The bank code was the critical change of purpose
A card number identifies a payment instrument. Its security code and a bank-issued one-time password serve a different purpose: they can participate in authorizing a payment or access. Supplying those secrets to an aid-themed page turns the visitor’s expectation of an incoming transfer into an opportunity for an outgoing transaction.
This is our interpretation of the disclosed collection sequence, not a reconstruction of the exact banking screens. Police have not published the phishing domains, the complete forms or which authorization each intercepted code approved. The report does not establish a breach of a bank’s systems. An indictment is an accusation, not a conviction.
A separate Cyberpolice warning about fake aid pages explains the wider impersonation pattern: official-looking design can lead to a counterfeit banking login. Its advice is to verify assistance through official sources and keep banking passwords, PINs and card security codes out of the application process.[2]
The pretext differs from the Free Mobile fake-bill case, but the decision is similar: assess the information being requested independently of the small payment or attractive payout written above it. A Telegram voting lure shows another version of that switch, where a harmless-looking task becomes an account-access request.
If the page already received your details
Merely receiving the message is different from entering card data or a code. Close the offer and verify any claimed benefit through an independently opened official service. A check with Gridinsoft Website Reputation Checker can provide another warning signal, but a missing warning does not authenticate the page.
If you entered card details, block the card through your bank’s usual app or official phone line; National Police explicitly recommends that response for a suspicious form. Report unauthorized transfers to the bank and police.[3] Tell the bank if you also supplied a password or one-time code, so it can assess online-banking access as well as the card. Preserve the link, messages and transaction records without continuing the conversation through the bot.
The useful boundary is the request for authority over an account. An aid offer does not become trustworthy because its form looks official, and a one-time bank code is not simply another item of application paperwork.
References
- Cyberpolice of Ukraine / Dnipropetrovsk regional police. “Investigators send an organized internet-fraud group indictment to court.” October 27, 2026; accessed October 28, 2026. Official case report.
- Cyberpolice of Ukraine. “Fake payments from international funds: how scammers obtain banking details.” January 30, 2026; accessed October 28, 2026. Official aid-phishing warning.
- National Police of Ukraine. “Common types of fraud,” phishing section; accessed October 28, 2026. Card-exposure response guidance.
