The expert called the signs of a fraudulent scheme with "Public services"

Fraudsters are increasingly calling Russians on behalf of polyclinics and government agencies, urging them to urgently update Gosuslugi or EMIAS. Installing the sent file may give the malware access to SMS messages, notifications, and other sensitive phone functions. On October 7, information security expert Kontur told Izvestia about how to recognize the scheme and protect yourself.Aegis and Staffcop by Yuri Drachenin.

According to Drachenin, the scheme is not new — only the legend is changing. Previously, they allegedly called from the bank, then on behalf of telecom operators, law enforcement agencies, and the Social Fund. Now one of the legends is the need to update Gosuslugi or EMIAS, confirm the attachment to the clinic or make an appointment.

"If you get a call and they offer to install or update something on your phone, you don't need to do that. Gosuslugi, EMIAS and other normal applications are not updated through a file that a person sent in a messenger after a phone conversation," the expert emphasized.

The update must take place through the official app or the app store. An attacker can introduce himself as an employee of the clinic and send a link or an installation file. The danger depends on what's inside and what permissions the user gives. A malware can request access to SMS messages, notifications, contacts, files, and a microphone. This will allow you to intercept confirmation codes, read notifications, collect data, or manage actions on the device.

The scenario itself should alert you: an unexpected call, they rush you, they say that something will stop working. It is especially dangerous if the phone asks to allow installation from an unknown source. The file name does not guarantee anything — the malware can be called "Gosuslugi" or "EMIAS".

Drachenin also noted that a beautiful number or a signature on the call does not confirm that the organization is calling. Scammers are increasingly trying to make the person call themselves. I receive a message allegedly from a government agency asking me to call back urgently, for example, to cancel a digital power of attorney.

To cut off the account: benefits and maternity capital have become more often used in fraudulent schemes

What methods of deception are used most often and how not to become a victim

"It's not just incoming calls that need to be rechecked. If you have been sent the number of a clinic, bank, or tax office, you do not need to call it. It is better to find the official number of the organization yourself and contact her using it," the expert advises.

SMS codes cannot be dictated or forwarded to anyone. It makes sense to enter any confirmation code only when you have started the operation yourself. It can confirm a phone number change or access restoration, not just a payment.

If it was not possible to avoid the installation, you need to act quickly. Simply deleting a file may not be enough. It is better to disconnect the phone from the network, check the installed applications and the granted permissions. Passwords from "Public Services", banks and other services should be changed from another, obviously secure device. Check the active sessions there and end the unfamiliar ones. If a text message code is transmitted, immediately restore control over your account and contact support. If bank data is affected, contact the bank.

In addition to emergency measures, there are also preventive tools that solve various tasks. Self—locking on loans is a working mechanism: it is recorded in the credit history, and the lender is obliged to check it. But it does not apply to mortgages, some car loans, and educational loans.

A trusted contact protects when restoring access to "Public Services": the request must be confirmed by a pre-selected person. The "red button" is an emergency mechanism for quickly transmitting a signal to the participants of the anti-fraud system. It's a reasonable approach, but it's too early to evaluate its effectiveness.

Finally, it's worth strengthening account protection in advance. The expert advises using different passwords, enabling two-factor authentication, checking active sessions, and updating the system only with standard tools. To protect the SIM card separately: set a PIN code and enable reissue restrictions if the operator provides such an opportunity.

On October 6, cybersecurity expert Semyon Tyutyuyev reported that fraudsters were offering Russians to receive a foreign inheritance in cryptocurrency, citing the impossibility of a bank transfer due to sanctions, after which they demanded to pay commissions and other expenses. It was clarified that scammers convince potential victims that cryptocurrency is the only way to receive the inheritance allegedly owed to them.