“The problem comes down to the desire of operators not to lose revenue”

How telephone fraud works and what are the difficulties in combating it, the head of the investigation department T.Hunter told Kommersant Igor Bederov.

— Despite the fight of regulators against the illegal trade of SIM cards, fraudsters continue to use them. How do they get SIM cards?

— First of all, through resellers – organizations or individuals who buy SIM cards and resell them. Roskomnadzor requirements regarding card registration for a new subscriber do not apply to them. There can be tens of thousands of cards in one batch. Or SIM cards can be purchased for a fake legal entity and activated before registering with State Services – the lifespan of SIM cards for fraud is very short. The problem, in my opinion, comes down to the desire of operators not to lose revenue and to sell as many products as possible. At the same time, the state, represented by Roskomnadzor and other bodies, does not have the levers to detect and prevent such violations.

— What can the Ministry of Internal Affairs do against scammers?

— The Ministry of Internal Affairs has a Department for Combating Cybercrime (UCC), created several years ago. However, it deals specifically with crimes. Accordingly, this is already the sale of SIM cards, which led, for example, to the theft of money from the victim’s accounts. The Ministry of Internal Affairs is not fighting the root cause of fraud.

— Does it make sense for a person attacked by scammers to contact the Ministry of Internal Affairs? Is there a chance that it will be possible to obtain compensation for the stolen funds?

— The return of funds to the victim most likely depends on the bank that allowed the transaction. It is difficult to prove that funds were stolen and the user was deceived. Banks often respond to such requests that the client himself provided personal and banking information, and the credit institution only completed the transaction requested and confirmed by the user.

— Is it now possible to track where SIM cards are physically activated and where calls come from?

— The logistics of SIM cards is monitored by telecom operators themselves, since after activation they charge for services. And, for example, they, of course, see the roaming of a subscriber, even with an unconfirmed identity. Virtual numbers are also used, including for IP telephony – Internet traffic is also monitored, and the operator receives money for its use, just like for cellular services. True, now fraudulent traffic accounts for only 6–7% of all IP telephony.

The problem is often the substitution of numbers, including through foreign services that have no restrictions on the use of Russian bank numbers. When the national Internet service provider (“Rostelecom”— “Kommersant”) sees Internet traffic entering the Russian Federation with a spoofed telephone number, it transmits it to the gateway of the telecom operator in whose pool the number belongs. If the operator receives information that the traffic is malicious, it will be able to collect a pool of services from providers in other countries who use it most often to make calls.

— Do fraudulent calls come mainly from abroad?

– Not necessary. After the start of the SVO, fraudsters from abroad were unable to carry out transactions for some time due to the disconnection of Russian banks from international payment systems. As a result, attackers began to use infrastructure in the Russian Federation more often. For example, acquiring services through which money is withdrawn and then transferred to services such as WebMoney, and then to cryptocurrency wallets (Monero, etc.).

This is also the infrastructure of hosting providers who have cheap traffic packages, but they are more interesting to scammers who distribute phishing sites. Telephone scammers more often use SIM boxes (devices for aggregating SIM cards), which are also located in Russia; their accumulation can be detected through in-depth analysis through SORM (systems of operational investigative measures).

— What are the prospects for telephone fraud?

— The efficiency of scammers’ calls decreases and the “average bill” becomes smaller. But the schemes are also developing, and I think we should expect an increase in losses in the near future. Thus, cases of two-way fraud are growing: when an attacker communicates with a victim from one number, and from another, as if on behalf of the victim, with his colleague. For example, with the head of a company.

Interviewed by Tatyana Isakova