Fraudulent ways: operators have recorded a decline in fraudulent calls
Telephone fraud in Russia has declined for the first time in several years: operators record a multiple reduction in the number of dangerous calls. However, experts warn that the attackers are not retreating, but changing tactics. Mass phone calls are being replaced by malware, fake apps, and deception via social media. Where the activity of scammers is moving and why a decrease in the number of calls is not a reason to lose vigilance — in the Izvestia article.
Why Phone Fraud has gone down
In January–September 2026, the number of potentially dangerous calls from the largest operators decreased significantly, the companies told Izvestia. Beeline recorded 871 million such calls, almost three times less than in the same period of 2025. MTS Defender identified and blocked more than 2 billion fraudulent and spam calls (-27%). Megafon registered 253.4 million calls from intruders, compared to 581.9 million in 2025 and 1.2 billion in 2024.
Operators attribute the decrease to the effect of new laws and the improvement of AI-based protection systems. At the same time, scammers continue to change tactics: instead of mass calls, they increasingly send messages about allegedly hacked accounts and leave numbers for feedback. T2 notes that the number of blocked calls with number substitution remained approximately at the level of last year.
In previous years, Russians have received massive calls from phone scammers, including from Ukraine. The attackers used pretexts related to the start of the heating season, or introduced themselves as employees of "Gosuslug". This kind of deception in this country has been elevated to the rank of state policy as one of the lines of attack on Russia, President Vladimir Putin noted back in 2024. Stanislav Kuznetsov, Deputy Chairman of the Board of Sberbank, spoke about the critical situation in an interview with Izvestia the same year. According to him, about 350-400 fraudulent call centers are operating against Russians in Ukraine, citizens received 20 million calls per day, and the volume of stolen funds in 2023 amounted to 250 billion rubles.
In January, Izvestia revealed a network of companies that created a turnkey infrastructure for stealing money and recruiting terrorists. It was about the Ukrainian company GMA, which, according to the publication, supplied equipment and software to almost the entire network of fraudulent call centers in Russia.
In 2025-2026, the authorities adopted a set of legislative measures against telephone fraud. Among them is the introduction of anti—fraud systems at telecom operators and stricter control over the turnover of SIM cards. Now one person cannot apply for more than 20 SIM cards, and it is possible to conclude a mobile communication contract only in the personal presence of the subscriber. In addition, citizens had the opportunity to establish an official ban on incoming calls from abroad.
Scammers are switching to other deception schemes
According to experts interviewed by Izvestia, the reduction in the number of classic fraudulent calls is accompanied by the growth and evolution of other types of cybercrimes.
— Phone calls "from the bank's security service" have become less frequent: call labeling and anti-fraud systems of operators have made this channel less effective. As a result, the attackers redistribute efforts to those areas where control is weaker," said Sergey Karpenko, system architect at Smart Solutions Group.
For example, the creation and distribution of malicious software (VPO) has become one of the fastest growing areas for fraudsters. The dangerous trend has already been confirmed by statistics. As follows from the report of the Ministry of Internal Affairs, in January–August 2026, 3126 crimes were committed related to the creation, use and distribution of malware (art. 273 of the Criminal Code of the Russian Federation). This is 798.3% more than in the same period last year.
According to the Domain Patrol project, in January–September, competent organizations sent 13,542 appeals related to the spread of military education on the Runet. This is 89% more than in the same period of 2025, when 7,148 such messages were received, said the project manager of the RU/ Domain Coordination Center.Russian Federation Olga Baskakova.
During the year, the share of malware complaints in the total number of threat reports increased from 19.1% to 27.3%. Thus, the distribution of HPE accounts for almost every third appeal to the project.
According to Sergey Golovanov, Kaspersky Lab's chief expert, the company's malware sample collection increases by about 10% annually. In 2025 alone, its security solutions detected an average of about 500,000 new malicious files per day.
"Is that you in the video?"
An organization from any industry can become a victim of malware, said Roman Safiullin, head of information security at InfoWatch ARMA. According to him, attackers choose targets based on the ratio of costs and potential benefits: they seek to maximize profits with minimal effort. Both large enterprises with particularly valuable data and small businesses, which often lack the resources to provide reliable protection, are at risk.
— Mass VPOS are primarily aimed at credentials, passwords stored in browsers, session cookies, and payment information. It's easy to monetize such data yourself or resell it on the darkweb as an entry point for the next attack," the source explained.
According to Alexey Ivanov, Deputy Director of Innovation at IT Bastion, traditional phishing, social engineering, leakage of critical data and account theft are among the popular threats.
— And artificial intelligence has made scaling attacks cheaper. Behind high-profile stories about exploits (this is a piece of software code, a program, or a set of commands that exploit vulnerabilities in software to carry out attacks. — Izvestia) at the zero level, written by AI, there are still people who use new tools to develop higher education faster, - Alexey Ivanov noted.
In the malware segment, attacks through messengers and mobile applications are gaining popularity among scammers, added Sergey Karpenko from Smart Solutions Group of Companies.
— Unfortunately, users are used to installing apps not from stores, but from a link. This is due to the fact that some of the Russian services, including banking, disappeared from official stores some time ago. Installing the application "from the site" has stopped seeming like something suspicious, and it is being actively used," the expert pointed out.
Angara MTDR specialists regularly identify cases of the spread of VPO through messengers and social networks, said Nikita Leokumovich, head of the company's digital forensics and cyber intelligence department. He explained that, in addition to ready-made malware, fraudsters have access to AI tools that help them write code and create convincing messages. This lowers the entry threshold for novice criminals, and allows experienced groups to act faster.
— What does it look like in practice? A person receives a message that arouses curiosity or a sense of urgency, for example: "Is that you in the video?" But instead of a video, he is offered to install a smartphone app and grant dangerous permissions. An acquaintance whose account was hacked can write, which increases trust in him," the expert said.
He added that in this scheme, the smartphone becomes another point of access to the person and, through him, to the company.
Comprehensive approach to data protection
Experts agree that there are no prerequisites for reducing the number of cybercrimes on the Runet yet. According to Sergey Golovanov, people and organizations are increasingly dependent on computers, digital services and electronic systems. As a result, access to them is becoming more and more valuable for intruders.
"Risks can be reduced through an integrated approach: the development of security technologies, increasing the level of security of organizations, timely elimination of vulnerabilities, training of users and employees, as well as well—coordinated interaction of market players," the expert believes.
According to Nikita Leokumovich, cyber attacks are becoming more diverse, so protecting each channel individually is no longer enough. For example, companies have been filtering e-mail for a long time, but an employee's personal phone, which has a work messenger and corporate email installed, often remains out of sight of security services.
According to the expert, mobile devices should be considered as part of the corporate security perimeter: monitor installed applications using mobile device management systems (MDM), separate personal and work environments, and train employees to double-check urgent requests through another, previously known communication channel.
Переведено сервисом «Яндекс Переводчик»
