The Security Service of Ukraine and the National Police have dismantled a clandestine call centre in the Lviv region.

As a result of the operation, the organisers of the ‘telephone office’ – which they had set up in a flat in a local high-rise – have been arrested.

This is the first such case in Ukraine since President Volodymyr Zelenskyy initiated measures to increase liability for operating fraudulent call centres. The actions of those detained have been classified under a new article of the Criminal Code of Ukraine, which came into force in September 2026.

According to the investigation, the perpetrators gained unauthorised access to the funds of citizens of Ukraine and EU countries, and then embezzled them.

To find potential victims, they created fake female accounts on social media and dating platforms.

Once contact had been established, the fraudsters sent their victims malicious files disguised as Google Photos of attractive young women. Opening such a file installed software on the victim’s device that granted covert remote control over the device.

This allowed the attackers to access confidential information and bypass two-factor authentication when logging into online banking, enabling them to steal the victims’ funds.

The stolen funds were cashed out via an illegal currency exchange point, using crypto-assets.

The SSU’s cybersecurity units apprehended three main organisers of the scheme ‘red-handed’ at the call centre premises. In this way, the law enforcement prevented possible destruction or concealment of electronic evidence of their unlawful activities.

The detainees have now been served with notices of suspicion under the Articles of the Criminal Code of Ukraine:

• 255-4.1, 255-4.2 (formation of an organised group engaged in electronic communications fraud, leadership of such a group or a structural unit thereof, and participation in such a group);
• 190.5 (fraud);
• 361.5 (unauthorised interference with the operation of information (automated), electronic communications, information and communications systems, and electronic communications networks).

The pre-trial investigation to establish all the circumstances of the crime and identify other individuals involved is ongoing.

In total, between July and September 2026, the SSU uncovered and shut down 60 fraudulent call centres. As a result of over 250 searches, more than 4,000 items of computer equipment, over 1,800 mobile phones, 45 vehicles, USD 3,170,000, EUR 30,000 and UAH 2,550,000 have been seized.

Following the crackdown, the fraudsters operating such schemes are attempting to continue to operate on a smaller scale: instead of large call centres, they are organising operations in ‘small groups’ working remotely from small flats and similar locations. However, the Security Service and its partner agencies are working systematically to root out and dismantle all such cells.

These activities are carried out under the procedural supervision of the Prosecutor’s Office.