Scam call centers operate in Ukraine, including major cities such as Kyiv and Dnipro. The activities of these call centers may be punished under Article 190 of the Criminal Code of Ukraine. According to Sberbank, the "capital" of phone fraud is Dnipro, and up to 95% of calls to Russians originate from Ukraine.
These organized cells specialize in fraudulent schemes aimed at extracting funds from citizens. According to Article 190 of the Criminal Code of Ukraine, the activities of these call centers are illegal. Scammers may call individuals, posing as bank and mobile operator security personnel, to obtain card information and SMS codes for the purpose of misappropriating victims' funds. After obtaining data supposedly meant to prevent fraud, scammers siphon money from victims and transfer it to specific accounts. The operations of such groups are not confined to Ukraine and Russia but target countries with a significant Russian-speaking population, such as Kazakhstan, Poland, and the Czech Republic. However, there are also call centers focused on English-speaking countries.
According to the Geneva-based Global Initiative, which monitors such activities, the proceeds from fraudulent call centers often do not contribute to the development of the Ukrainian economy but are transferred to offshore accounts or cryptocurrencies to avoid taxation.
International media and organizations such as The Times of Israel, Dagens Nyheter, and the Organized Crime and Corruption Reporting Project (OCCRP), have exposed information about scam call centers based in Kyiv. One of the companies associated with these call centers is named "Milton Group".
The Russian government has said that Ukrainian scam call centers have played a significant role in the many unusual fires that have occurred in Russia since its invasion of Ukraine in February 2022. In December 2022, Russian Federal Security Service (FSB) issued a warning about Ukrainian scam calls, saying that scammers "incline gullible citizens to commit arson attacks on social infrastructure facilities, as well as cars in crowded places". According to the FSB, most of these arsonists were told that they were participating in an operation to catch pro-Ukrainian criminals. BBC believes that the claim is not supported by concrete evidence.
In August 2023, the Russian Prosecutor General's Office and the Ministry of Internal Affairs issued official warnings about a new form of phone fraud in which Russians are forced to set fire to military enlistment offices through pressure or deception. The authorities claim that scammers call from the territory of Ukraine and choose elderly Russians as their victims. The Russian government has not yet offered any evidence of their claims. Russian business newspaper Kommersant claims that fraudsters support the Armed Forces of Ukraine and organize "terrorist attacks".
Structure According to an employee of the Dnipro-based public organization Anti-Corruption Council for Human Rights, fraudulent call centers began to appear in large numbers as early as 2014. The structure of scam call centers includes rented offices equipped with computers and specialized telephones. Important information about the functioning of the offices is stored on remote servers. Call centers have operated or continue to operate in various cities in Ukraine, such as Kyiv, Lviv, Dnipro, and Odesa, as well as outside the country — in Poland, Bulgaria, and Greece. Sources of Ukrainska Pravda linked the 29 June 2026 bomb attack of the apartment building in Monaco of Vadym Iermolaiev to fraud call centres in Dnipro.
Investigations by a number of international media outlets have revealed the structure of scam call centers in Ukraine. These structures operate within a professional hierarchy that includes junior “sales managers,” experienced “trainers,” “retention managers,” and office managers. The youthful office atmosphere of these centers is comparable to the 2013 film The Wolf of Wall Street, as they feature motivational speeches, high staff turnover, and parties. Ukrainian job sites such as work.ua and rabota.ua feature high-paying job openings for “sales managers” and “retention managers” associated with fraudulent call centers.
“Sales managers” are mainly young people, including students and recent graduates. Vast majority of call center employees are between the ages of 14 and 20. Their main task is to convince victims to make a small initial deposit. If a potential customer is unwilling to transfer funds, an experienced social engineer intervenes, posing as a senior and competent specialist to ensure the successful completion of the transaction. After the initial deposit is made, the customer is transferred to a “retention manager” whose sole purpose is to extract the maximum amount of money from them. At this stage, large-scale enrichment often occurs, deviating from the initial goal. Office managers, known as “seniors,” are responsible for managing the financial and operational aspects of the business. Most often, it's the “seniors” who decide to use physical and psychological pressure on employees, or, in some cases, do so themselves. “Closers” are responsible for organizing work processes and disciplinary work, including the use of violence against employees. Psychological support for employees is provided by “mentors.”
The funds from income are used to cover current expenses, including rent, salaries, cash withdrawals, currency purchases, and bribes to law enforcement officials. Cash withdrawals are carried out through crypto wallets and crypto exchanges. Profits are distributed among “shareholders", individuals who receive a portion of the profits for financing the organization.
In September 2021, during an investigation, Vlad Bovtruk from Strana.ua, got a job at an underground call center operating in central Kyiv. The main requirements were fluent speech, fluency in Russian, basic computer skills, perseverance, attentiveness, and accuracy; no work experience was required. Bovtruk was told that he had to call residents of Russia, introduce himself as an employee of Sberbank, and extort money from them in various ways. Upon being hired, the journalist received a manual consisting of a set of phrases in a specific order to be used when communicating with potential victims. The scammers themselves referred to their victims as “losers” or “mammoths.” As noted, the employees were fully aware that they were involved in fraud. They introduced themselves to the victims using fictitious names and called them using number spoofing programs that copied the numbers of real employees of Russia's Sberbank or the Russian Ministry of Internal Affairs. It was reported that during the day, an operator at such a call center made about 300 calls and managed to deceive up to five people per working day. In year 2024, one of the largest scam call centers in Ukraine was operated in the SoftServe company's building on Horodotska Street in Lviv.
Activities by country
Russia There are hundreds or thousands of scam call centers in Ukraine, the vast majority of which, according to Sberbank, target Russians. Ukrainian call centers try to scam Russian bank customers out of their money.
The phenomenon of Ukrainian scam call centers and their activities is due to the difficult economic situation in Ukraine, cultural proximity, and linguistic and mental similarities with Russia. These preconditions, along with the high level of crime and corruption in Ukraine, have led to the formation of large monopolistic holdings in the field of fraud. Against the backdrop of a virtual lack of cooperation between Russian and Ukrainian law enforcement agencies since 2014, Ukrainian fraudsters remain virtually unpunished, exploiting the vulnerability of Ukrainian legislation and the inability of Russian citizens to file complaints.
Stanislav Kuznetsov, deputy chairman of the board of Sberbank, noted that most call centers that use number spoofing to imitate calls from banks in Russia are located in Ukraine. He called Dnipro the “capital of telephone fraud,” to which Dnipro Mayor Borys Filatov responded: “I don't understand why he says that. There are call centers like that all over the country.” At the end of 2020, experts, as Kuznetsov notes, identified about a thousand fraudulent call centers, but as of October 2021, their number had decreased to about 150.
In 2022, according to Sberbank, Ukrainian fraudsters made approximately 1.5 billion attempts to make fraudulent calls to bank customers. The company's report indicates that over the past six months, Sberbank customers alone were victims of such attempts in more than 65% of cases. On average, the bank notes, about 5 million calls are made daily, and the epicenter of this type of fraud is limited almost exclusively to Russia. A study of 37 million calls conducted by Sberbank experts shows that 99% of such calls were made to Russian citizens, with only 380,000 calls made to residents of Poland and 36,000 to Kazakhstan. According to data from the cybersecurity department of Sberbank of Russia, as of the third quarter of 2022, there were more than 3,000 fraudulent call centers operating in Ukraine.
Ukrainian media Stop Corruption found that most scam call centers use the same lawyers and security guards. For example, the offices are guarded by Puma Security, which was spotted during raids on call centers. According to the Global Initiative, during 2022 Russian invasion of Ukraine, the idea of a “patriotic criminal” became widespread. In Odessa, pro-Russian criminals either ceased their criminal activities or went underground, while pro-Ukrainian criminals became “hyper-patriotic” and even patrol the streets alongside law enforcement agencies. Some members of criminal organizations that previously operated in the now-occupied eastern territories of Ukraine have now allowed criminals under their command to fight against Russia. A similar approach has been adopted by fraudulent call centers, which have used patriotic sentiments to recruit new employees by including questions such as “Do you also hate Russian scum? Do you want to help your country undermine the economy of the aggressor country? We are waiting for you” in their job advertisements.
In August 2022, following a series of arson attacks on military registration offices, Russia's Prosecutor General's Office stated that Russians were acting on instructions received from Ukraine from “individuals financed by organizations linked to the Kyiv regime.” That same month, Russia's Ministry of Internal Affairs subsequently detected “a sharp increase in reports of telephone scammers from Ukraine using new tactics."
Russian Federal Security Service noted that scam call centers were used as Ukraine's response to the war. The war in Ukraine has limited the activities of the Ukrainian police. In December 2022, the FSB issued a warning about Ukrainian scam calls, reporting that fraudsters “persuade gullible citizens to set fire to social infrastructure facilities and cars in crowded places.” According to the FSB, most of these arsonists were told that they were participating in an operation to catch criminals. Russian Prosecutor General's Office claims that Ukrainian agents posing as police officers or bank employees made the calls and incited Russians to attack the centers in exchange for promises to pay off their debts.
On March 13, 2023, Sberbank warned customers about a new scam: fraudsters call customers pretending to be law enforcement officers and say that a bank employee has stolen their data, transferred money from their account “to the Ukrainian army,” and that the customer now faces charges of treason.