Russia

Scammers reach people by phone and through fake websites, and they usually start by persuading the person to act. The Bank of Russia describes one common route in 2025. A caller claims to be from a delivery service, a flower shop, a cafe or a restaurant, and says there is an order or a gift that needs a code from a text message to confirm it. Once the code is given, the call is ended by a recorded voice that says it was a scam. A text message then follows, claiming that a loan has been taken out in the victim's name or that the victim's account on Gosuslugi, the state services portal, has been hacked, and giving a number to ring. The person who rings is then persuaded, under the pretence of saving their money, to move their savings to the scammers' accounts or to hand the cash over.

Other people are sent a phishing link or malicious software, and the criminals gain remote access to their online banking. In some schemes card details are passed on through special software, in a method the Bank of Russia calls NFC Gate. The largest thefts from individuals combine these tricks with social engineering, which means persuading people to act against their own interests, and with fake versions of the websites of companies, federal bodies and state services.

Victims lost money from bank accounts, payment cards and electronic wallets. The Bank of Russia counts operations made without the customer's consent, which it describes as unauthorised operations. In 2025 their value rose 6.4% and their number rose 31.2%, so the average amount per operation fell. For individuals the average was 18,000 roubles, down from 22,400 roubles in 2024. For businesses the average was 373,200 roubles, down from 467,700 roubles.

Losses from accounts were the largest, at 10,628.41 million roubles for individuals, while card operations were the most frequent, at 980,460 in 2025. The Bank of Russia says the fall in the average followed its systematic work to improve the anti-fraud systems of banks. From 1 September 2025 banks must run anti-fraud checks on consumer loans and on cash taken from ATMs, which the Bank of Russia says reduces the total of the largest thefts.

The Bank of Russia reports operations by channel: card, account, the Faster Payments System (SBP), electronic wallet and operations without opening an account. It says criminals combined these channels, which increased operations for individuals. Unauthorised operations made up 0.00071% of the value of all transfers in 2025, up from 0.00066% in 2024.

Banks returned 5.9% of the money taken in unauthorised transfers in 2025, which was 1,731.3 million roubles, against 9.9% (2,713.58 million roubles) in 2024. The share fell even as the value of those operations rose 6.4%. The largest part of the money returned in 2025, 700.41 million roubles, came from account operations.

Under Article 8, part 3.13 of Federal Law 161-FZ on the national payment system, a bank that fails to run proper anti-fraud checks on a transfer to details in the Bank of Russia's database of fraudulent operations is financially liable to its individual customer. That route returned 3.16 million roubles in 2025, against 1.23 million roubles in 2024. The Bank of Russia says the small sum reflects banks meeting the required anti-fraud rules. A borrower who was tricked into taking a loan is released from repaying it, and from the interest, until a court verdict takes effect, if the lender broke the anti-fraud rules and a criminal case has been opened over the theft of the loan money.

Banks have reported to the Bank of Russia since 2023 the value of the thefts they prevented. In 2025 that was 13,895.4 billion roubles, and 134.16 million fraudulent operations did not go through, against 72.17 million in 2024.

Victims report to the police and to their bank. The Ministry of Internal Affairs, which includes the police, counted 534,500 victims of cybercrime in 2025, down 5.5%. From 1 October 2025 the mobile apps of the large banks must include a service for victims. It lets a customer register an unauthorised operation in the app and receive an electronic certificate of it for the police. The Bank of Russia says this service has proved popular with victims who lost small sums and who had not previously gone to their bank or the police, and that it changed the recorded count of operations.

Banks also send the Bank of Russia details of fraudulent operations, which feed the database that banks use in their anti-fraud checks. Criminal phone numbers are passed on to telephone operators. In 2025 the Bank of Russia sent operators 69,091 numbers that criminals had used to steal money from people. It also sent registrars details of 1,002 internet addresses in the .ru, .рф and .su zones so they could be taken down, and registrars took on average from three hours to several days to remove them.

The Bank of Russia says the number of phishing sites has fallen for the last two years, although such attacks remain relevant. Since 2023 banks have also sent it the value of the thefts they prevented, so that figure comes from banks rather than the police.

The figure shown on this page is the 663,000 cybercrimes that the Ministry of Internal Affairs recorded in Russia in 2025, the latest full year. The total is wider than scams, because it also includes thefts and unlawful access to computer information. Of the 663,000, the Ministry gives 344,000 fraud cases, down from 378,000 in 2024, 80,000 thefts, down from 105,000, and 58,000 cases of unlawful access to computer information, down from 104,000. The Ministry put the material damage it registered at 189.5 billion roubles in 2025, down from 205 billion roubles in 2024.

In January 2025 it recorded more than 9,000 cybercrimes a week, and by December fewer than 6,000 a week. The deputy minister said each new measure was followed by a sharp fall and then a partial rise, because criminals adapt. The Ministry also counted 534,500 victims, down 5.5%. That is a count of victims, not of cases. The total of 663,000 is down 12% from 775,000 in 2024.

The figures were given by the deputy minister of internal affairs, Andrei Khrapov, at the Cybersecurity in Finance forum, and were reported by Interfax on 18 February 2026. Asked by the governor of the Bank of Russia, Elvira Nabiullina, whether the Ministry felt cautious optimism about the fight against cyber fraud, he said that he supported it.

The largest group the Ministry names is fraud, with 344,000 cases of the 663,000 cybercrimes in 2025. Thefts came to 80,000 cases and unlawful access to computer information to 58,000.

The Bank of Russia says the biggest thefts from individuals come from schemes that combine social engineering with phishing, where a person is persuaded to act by a call or a message and is sent to a copy of an official website of a company, a federal body or a state service. Card operations were the most frequent kind of unauthorised operation for individuals in 2025, at 980,460, while account operations had the largest value, at 10,628.41 million roubles. In 2025 criminals often persuaded people not only to make a payment but to follow a phishing link or install malicious software, which gave them remote access to online banking. Schemes that draw in people's money under the pretence of investing, often mentioning cryptocurrency, are becoming more widespread.

Of the internet resources the Bank of Russia acted on in 2025, 43% were phishing sites copying the names of well-known banks and investment companies, about 36% were businesses offering unlicensed securities trading or non-existent lenders, and 21% were financial pyramids, often disguised as online games. For businesses, the average unauthorised operation was 373,200 roubles in 2025, against 467,700 roubles in 2024.

The Bank of Russia works with banks, telephone operators and the Ministry of Digital Development, and it sets the rules that banks must follow. In a pilot in 2025 it worked with operators and banks to use criminal phone numbers in banks' anti-fraud checks, which let banks suspend suspicious operations worth more than 100 million roubles and mark the accounts that fraudsters might use to move stolen money. The rules now in force include mandatory anti-fraud checks before consumer loans and ATM cash, a cooling-off period for loans, and a rule that a bank must refuse to issue a card or online banking access to a person whose details are in the Bank of Russia's database. Such a person can take no more than 100,000 roubles a month from an ATM, and more only at a bank branch with identity papers. Federal Law 41-FZ of 1 April 2025 set up a state information system against these crimes.

The results so far are uneven. The police count fell 12%, and the deputy minister said each measure brought a sharp fall followed by a partial rise. Over the same year the number of unauthorised operations rose 31.2%, and the share of money returned to customers fell from 9.9% to 5.9%. The deputy minister said criminals move to areas that are not yet well regulated, such as SIM boxes, whose main SIM cards are machine-to-machine (M2M) cards, and whose sale and circulation he said are insufficiently regulated.