The Cyber Police of Ukraine have warned of a new fraud scheme in which perpetrators distribute malicious applications disguised as free offline navigation apps that can gain access to users’ personal data and banking services.
According to the Cyber Police, potential victims are offered a navigation app that supposedly works without an internet connection, contains no advertising and is available free of charge. Advertisements for such applications are distributed primarily through social media.
After clicking on an advertisement, users are redirected to a third-party website where they are offered a program to download, including through a Telegram bot. Instead of the advertised navigation app, a malicious file may be installed on the smartphone.
During installation, the program requests permission to download applications from unknown sources, as well as access to certain smartphone functions. After obtaining these permissions, perpetrators can track the device owner’s actions, intercept messages and notifications, and obtain confidential information.
The malicious program’s access to SMS messages and system notifications poses a particular threat. The information obtained may be used to intercept verification codes and access the user’s accounts and financial services.
The Cyber Police recommend installing mobile applications exclusively from the official Google Play and App Store marketplaces and not downloading APK files through Telegram bots, unknown websites or advertising links.
Users are also advised to carefully check the permissions requested by an application. In particular, a navigation program should not gain access to SMS messages, notifications or device management functions without an objective need.
If a suspicious application has already been installed, specialists recommend temporarily refraining from using banking and other critically important services on that smartphone, disconnecting the device from the internet and changing the passwords for primary accounts from another secure device.
The suspicious program should be removed, and the permissions granted to it should be checked. If the application cannot be removed or continues to run in the background, seeking technical assistance is recommended.
If banking details have been disclosed or unknown transactions appear, users must immediately contact their bank to block possible unauthorized access to their accounts. Cases of fraud can be reported to the Cyber Police through their official online form.
The Cyber Police also recommend checking information about current fraud schemes on the government platform StopFraud.
Source: Cyber Police of Ukraine
APPLICATION, BANK, CYBER POLICE, CYBERSECURITY, fraud, smartphone
Scammers in Ukraine use ads for passenger and freight transportation to obtain advance payments by creating fake pages for private carriers and logistics companies.
To build trust, the scammers use photos of real buses and trucks, logos of well-known companies, reviews from other people, and other copied materials. Potential customers are usually lured in by lower travel or delivery costs compared to market rates.
Once a customer contacts them, the scammers try to get the money as quickly as possible. In particular, they may claim that there are almost no seats left or that an advance payment must be made immediately to confirm the reservation.
When arranging freight transportation, scammers may demand full payment in advance via a credit card or to an individual’s bank account. After receiving the money, the fake carrier stops responding, and the ad or page is deleted. In some cases, after the first transfer, the customer is asked to make additional payments supposedly for insurance, documents, customs clearance, or other services.
Experts cite the following as signs of potential fraud: a significantly low price, a demand for an urgent prepayment, communication exclusively via messaging apps, recently created carrier pages, and a lack of operational history. The risk also increases if the carrier refuses to provide detailed information about the route, vehicle, and terms of transport, or demands new payments after an agreement has been reached.
Links for booking and payment pose a particular danger. They may lead to phishing sites that mimic the appearance of banking and payment services. Their purpose is to obtain bank card details and other payment information.
Users are advised to verify the company name and phone number through several independent sources before making a payment, review the carrier’s reviews and track record, and avoid sharing CVV codes, passwords, or one-time transaction confirmation codes.
If money has already been transferred to scammers, it is recommended to save the correspondence, screenshots of the ad, and payment confirmation. If you have disclosed your banking information, you should contact your bank as soon as possible. You can also report cases of fraud to the Cyber Police or by calling 102 or 112.
You can learn more about current fraud schemes and ways to protect yourself on the StopFraud platform.
At least 16 court rulings mentioning drop accounts or so-called “money mules” have been identified in Ukraine over the past nearly eight years, with drop accounts used in schemes related to drug trafficking in 81% of cases.
This is according to a study by OpenDataBot, published on October 2, 2026, based on data from the “Babusia” court registry search engine as of mid-September.
“Drops” are people who, in exchange for compensation, provide third parties with their bank cards, accounts, or access to online banking. Such accounts can be used to transfer, receive, and subsequently launder funds in various criminal schemes.
According to the study, in 13 of the 16 convictions identified—or 81%—drop accounts were part of schemes related to drug trafficking. Another three convictions—or 19%—involved online fraud.
At the same time, OpenDataBot emphasizes that the mere mention of a “drop account” in a court ruling does not necessarily mean that the bank account holder was convicted specifically for granting access to it. In some cases, drop accounts were merely one element of a larger criminal scheme, while the convicted individuals performed other roles.
Three such convictions have already been identified in 2026. The highest number occurred in 2020—eight. Two rulings were found for both 2019 and 2021, and one more for 2023. No convictions involving such schemes were found in the search engine for 2024 and 2025.
In 12 of the 16 convictions, or 75%, the primary punishment was imprisonment. Sentences ranged from two to ten years. At the same time, in eight cases, the convicted individuals were granted probation.
In four additional verdicts, the primary punishment was a fine. The specific amounts of the fines were specified in six court decisions and ranged from 98,600 UAH to 850,000 UAH.
Kyiv accounted for the largest number of verdicts mentioning “drops”—10 rulings, or 63% of the total. Two more verdicts were handed down in the Odesa region, and one each in the Dnipropetrovsk, Zakarpattia, Kyiv, and Mykolaiv regions.
In some cases, significant amounts of compensation were awarded to the victims. In one ruling, the court ordered 8.65 million UAH in compensation, of which 6.65 million UAH was for material damages and 2 million UAH was for emotional distress.
In two other cases, the defendants voluntarily compensated the victims a total of 42,100 UAH. In two additional rulings, the courts ordered the defendants to pay a total of 29,800 UAH in litigation costs.
Amid the spread of schemes involving the use of other people’s bank accounts, Ukraine is preparing to establish a separate criminal offense for “dropping.” On September 15, 2026, the Verkhovna Rada adopted as a basis Bill No. 16013 on the protection of citizens and their funds from illegal actions involving payment instruments and bank accounts. The bill is being prepared for its second reading.
Source: OpenDataBot – study “In 81% of convictions, ‘dopers’ were part of schemes related to drug trafficking” dated October 2, 2026.
Ukraine plans to introduce criminal liability for transferring or receiving bank cards, accounts, and access to them for subsequent use in fraudulent and other criminal schemes.
On September 15, 2026, the Verkhovna Rada adopted in principle Presidential Bill No. 16013, “On Amendments to the Criminal Code of Ukraine and the Criminal Procedure Code of Ukraine Regarding the Protection of Citizens and Their Funds from Illegal Actions Involving Payment Instruments and Bank Accounts.”
A total of 299 members of parliament voted in favor of the bill in its first reading. The bill was registered on September 2 and designated by the president as urgent. According to the Verkhovna Rada, it is currently being prepared for its second reading.
The legislative changes are aimed, in particular, at so-called “drops” or “money mules”—people who transfer bank cards, accounts, account details, or access to online banking to third parties to conduct financial transactions.
The urgency of the issue is confirmed by data from OpenDataBot, published on October 2. Using the “Babusia” court registry search engine, at least 16 convictions were found over the past nearly eight years involving schemes that used drop accounts.
In 81% of these cases, the “drops” were part of schemes related to drug trafficking, and in 19%, to online fraud.
In 75% of the verdicts found, the primary punishment was imprisonment. Sentences ranged from two to ten years, although in eight cases, the defendants were granted probation. In four other verdicts, the primary punishment was a fine.
The fines specified in the court rulings ranged from 98,600 UAH to 850,000 UAH. In one of the identified rulings, the court also ordered the defendant to pay the victim 8.65 million UAH in compensation for material and moral damages.
It is important to note that the presence of a “drop” in the case files does not yet mean that the account holder was convicted specifically for transferring their card or bank details. As OpenDataBot points out, in some of the analyzed verdicts, “drops” were one element of a broader criminal scheme, and the convicted individuals may have played other roles.
Draft Law No. 16013 aims to address precisely this legal loophole; it provides for separate liability for unauthorized transactions involving payment instruments and bank accounts.
However, as of October 2, the bill has not yet become law. It has only passed its first reading, so the final provisions and liability may change as the bill is prepared for its second reading.
Ukraine’s Cyber Police have warned citizens about a scam involving fake electricity bills, which may be sent via email or messaging apps purportedly on behalf of the Ministry of Energy or other government agencies.
According to the statement, scammers may inform recipients of alleged outstanding balances, send payment invoices, or demand immediate payment. To make their messages more convincing, they use official logos, the names of government agencies, and formatting that resembles genuine communications.
The main goal of the attackers is to trick users into clicking a link to a phishing website. There, they may be asked to enter their credit card information, username, password, SMS verification code, or other personal information. Malware may also be distributed under the guise of a bill or document. As a result, scammers can gain access to bank accounts, email, social media, and other accounts.
The Cyber Police emphasize that the Ministry of Energy of Ukraine does not send electricity bills to consumers and does not collect utility payments. Bills are issued directly by the electricity suppliers with whom consumers have signed contracts.
Signs of a fraudulent message may include a demand for immediate payment via a link provided, information about a non-existent debt, a sender’s email address that does not belong to an official institution, a request to enter bank details or a password, as well as unknown attached files.
Grammatical errors, unusual phrasing, and attempts to create a sense of urgency should also raise red flags.
It is recommended to verify information about electricity payments only through your provider’s official website or app. The cyber police advise against clicking on links in suspicious emails and against entering personal or banking information on websites linked to via email or messaging apps.
If a user has already clicked on a suspicious link, entered banking information, or lost funds, they should contact their bank as soon as possible to block their payment instruments. It is also important to save the correspondence, links, phone number, and other evidence to report the incident to law enforcement.
Additional information about current fraud schemes and ways to protect yourself can be found on the “Cyber Brama” portal at stopfraud.gov.ua.
Turkey has identified another 1,070 people who, according to the investigation, obtained Turkish citizenship through fake real estate transactions. This marks the second major wave of investigations into schemes involving the granting of citizenship through residential property investments.
Turkish Justice Minister Akın Gürlek announced the new operation on September 21. The investigation is being conducted by the Istanbul Chief Prosecutor’s Office in collaboration with police units responsible for combating illegal migration.
Investigators examined real estate transactions conducted through the companies Gül İnşaat, Beyaz İnşaat, and LİV İnşaat. The audit covered sales to 734 foreign nationals, with 274 transactions deemed fictitious or suspicious. The total value of the transactions exceeded 3.5 billion Turkish lira, or approximately $72 million.
According to the Turkish Ministry of the Interior, among the 1,070 people who obtained citizenship under these agreements, 263 were direct investors, while another 807 were their family members. Of these, 1,015 received citizenship at the same time as the initial decision, and another 55 children received it later. In addition, 11 individuals were identified whose citizenship application processes were still ongoing.
As part of the operation, judicial measures were applied to 2,011 real estate properties, one hotel, 86 vehicles, two yachts, and 42 bank accounts. State administrators were appointed to 30 companies. Legal proceedings have been initiated against 88 suspects, and dozens of people have been detained.
This is already the second wave of the investigation. The first major operation took place on August 4, 2026. At that time, the investigation established that another 687 people had obtained Turkish citizenship through artificially inflated appraisal reports and fictitious real estate sales. The prosecutor’s office has initiated proceedings to revoke their citizenship. In that case, authorities estimated the amount of investments that did not actually reach Turkey at approximately 2.5 billion lira.
Thus, the two most recent investigations in Istanbul alone involve at least 1,757 cases of citizenship acquisition linked to suspicious real estate transactions, when combining the 687 individuals from the first wave and the 1,070 from the second. However, these two figures pertain to specific criminal investigations and do not cover all reviews of investment-based citizenship in the country.
At the same time, the Turkish Ministry of the Interior has, for the first time, released broader statistics on the review of citizenship obtained through investment programs. According to the ministry, as of September 21, citizenship decisions had been revoked for 5,391 individuals, including investors and their family members. Additionally, citizenship was revoked after it had been granted for 743 individuals, specifically for reasons related to public order and national security. In total, this amounts to 6,134 individuals.
As of February 11, 2026, citizenship grants were separately revoked for 1,393 individuals associated with 458 investors whose documents certifying that their investments met the established requirements were annulled. Citizenship was also revoked from seven other individuals on grounds of national security and public order.
Turkish authorities have not published a breakdown of the 1,070 individuals implicated in the current investigation by their country of origin. No similar official breakdown was published regarding the 687 individuals identified in August either. Therefore, reports claiming a predominance of Russians, Iranians, citizens of Middle Eastern countries, or other nationalities in these specific cases are not currently supported by official documents.
The scheme being investigated by law enforcement agencies was based on fictitious or inflated real estate values and the simulation of required financial transactions. In some cases, real estate with a significantly lower actual value was valued much higher in the documents in order to formally meet the requirements of the citizenship-by-investment program.
Turkey allows foreign investors to apply for citizenship, specifically through the purchase of real estate valued at no less than $400,000. The property must meet established requirements, and the investment and flow of funds are subject to verification by government agencies.
