Ukrainian cyber police say a network of about 300 money mules supplied the accounts behind online scams—and that the suspected organizers found bank employees willing to help bypass card restrictions. The October 5 announcement describes a break in the defensive chain: suspicious accounts were being blocked, but some of those barriers were allegedly worked around or lifted.
Five people in the Vinnytsia region are suspected of organizing the network. Police put turnover on the seized cards above UAH 127 million, while the losses established from the suspects’ own alleged fraud total nearly UAH 2 million. These are different measurements; the larger figure is not a confirmed victim-loss total.
A small payment bought control of someone else’s account
According to the investigation, account holders accepted a small reward in exchange for full access to their bank cards, accounts or cryptocurrency wallets. The suspected organizers then charged other criminal groups a percentage to move proceeds from scams during 2024–2025.
The source scams included prepaid goods that never arrived, bogus financial-aid offers, bank impersonation calls and phishing sites. That puts the mule network downstream of the lure. One group can persuade a victim to pay; another supplies the account through which the money passes. The person named on that receiving account need not be the person who wrote the phishing message.
That distinction matters when an offer is presented as “renting” a spare card. The account remains attached to its holder while someone else controls its transactions. A small reward does not turn that arrangement into a normal payment-processing job.
Card blocks became an obstacle the network tried to remove
Police said banks’ safeguards and the cyber police Antifraud project blocked a substantial portion of the mule cards. Investigators allege the organizers then recruited bank employees who helped evade those blocks or remove restrictions.
The announcement does not name the banks, explain exactly how employees changed the restrictions, or establish that a bank’s entire security system was compromised. The evidenced issue is narrower: a control that detected suspicious activity allegedly met an insider willing to defeat it.
For a customer, an account remaining usable is therefore a poor reason to trust a stranger’s transfer instructions. The relevant questions are who controls the account, what the payment is for and whether the request has been verified independently. Our earlier Mykolaiv fake-bank-call investigation shows the other end of this chain: callers persuaded victims to send money to supposed “reserve accounts.” The police have not linked that case to this network.
What the searches established—and what remains open
More than 40 searches produced 255 bank cards, smartphones, SIM cards, cash and vehicles, police reported. One 25-year-old suspect is in custody; four others abroad were notified of suspicion in absentia. Possible connections to scam call centers remain under investigation. These are allegations and procedural developments, not convictions.
The physical cards are useful evidence of the account infrastructure. They do not by themselves show which transfer came from which victim or whether the money can be recovered. The police announcement gives no recovery promise.
If someone is paying to use your account
The Economic Security Bureau’s money-mule guidance identifies offers to hand over banking access, receive and forward transfers, or withdraw cash for strangers as warning signs. If you have already given someone that access, stop dealing with the organizer, contact your bank to block the card and online-banking access, report suspicious transactions and preserve the messages and payment records for law enforcement.
This case concerns control of accounts and transactions. A malware scan cannot revoke another person’s banking access or reverse a payment. The useful boundary to protect is the account itself: do not lend it to a stranger, and contact the bank through a channel you find independently.
References
- Cyber Police Department of Ukraine. “Police in Vinnytsia notified suspected money-mule organizers.” October 5, 2026, 13:10, displayed local time. Investigation announcement.
- Economic Security Bureau of Ukraine. “Drops or money mules.” Accessed October 5, 2026. Account-access and response guidance.
