A group of imposters operating out of a Ukrainian call center defrauded thousands of victims while pretending to be IT security employees at their banks.
They contacted the victims, claimed that their bank accounts had been accessed by attackers, and requested financial information claiming it was needed to prevent fraud but, instead, emptied their bank accounts.
The scheme was uncovered by the Cyber Police Department, the Main Investigative Department of the National Police, the Prosecutor General’s Office, and law enforcement officers in Kazakhstan.
Investigators found that 37 operators working out of a call center established by three Dnipro residents called Kazakhstan citizens while pretending to be IT security employees at their banks.
They informed citizens of suspicious transactions and reassured them that threat actors had accessed their accounts, persuading them to provide financial information under the guise of reverting the transactions.
After obtaining this information, the perpetrators transferred the victims’ money to accounts under their control, issued quick loans, and sent the loan amounts to their accounts.
The scammers used offshore bank accounts and cryptocurrency wallets to collect the money resulting from their scheme and, according to the investigators’ estimations, defrauded approximately 18,000 citizens of the Republic of Kazakhstan of a yet unknown amount of money.
[embedded content]
Databases of personal info found during police raid
Law enforcement officers have also searched the call center and the suspects’ residences, seizing 45 pieces of computer equipment, mobile phones, SIM cards, and draft records.
Upon inspection, the Ukrainian cyber police also discovered databases containing the personal information of citizens of the Republic of Kazakhstan that the fraudsters used to embezzle money from their accounts.
“The organizers encouraged the operators and paid interest on the amount they managed to obtain through criminal means,” the Cyber Police Department of the National Police said.
While the Ukrainian police said that the investigation is still ongoing, a criminal case has been opened under Article 190, Part 3 (Fraud) of the Criminal Code of Ukraine, carrying a maximum sentence of eight years in prison.
In August, the National Police of Ukraine (NPU) took down a network of call centers used by cybercriminals to target victims of cryptocurrency scams under the guise of helping them recover stolen funds.
One year ago, Ukrainian law enforcement arrested 51 suspects believed to have sold personal data belonging to more than 300 million people worldwide, including Ukraine, the U.S., and Europe, on hacking forums.
