Ukraine says first case under new law targets Stryi fraud call center
Ukrainian cyber police and the SBU detained three men in Stryi, Lviv Oblast, on 14 October 2026 in what authorities describe as the country's first suspicion notice under a new Criminal Code article criminalizing fraudulent call centers. The suspects allegedly lured victims through dating sites, used voice-altering software to pose as women, and deployed hidden remote-access malware to bypass two-factor authentication and drain online banking accounts before laundering proceeds through cryptocurrency.
Key points
- Cyber police in Lviv Oblast and the SBU exposed an organized group running a fraudulent call center in the city of Stryi.
- Three men — two aged 23 and one aged 21, all from Stryi — were detained and served with suspicion notices.
- Suspects allegedly used fake female accounts on dating sites, voice-changing software, and photos containing hidden remote-access malware (RAT) to seize control of victims' devices.
- The RAT allowed perpetrators to bypass two-factor authentication on online banking and withdraw funds, which were laundered through cryptocurrency and an illegal currency exchange point.
- Police conducted 9 searches, seizing computer equipment, dozens of smartphones and SIM cards, a crypto wallet, draft records, over 1.2 million hryvnias in cash, and foreign currency worth more than 800,000 hryvnias.
- The case is qualified under the new Article 255-4 of Ukraine's Criminal Code, which took effect in September 2026 and carries a penalty of up to 15 years in prison.
- At least 50 Ukrainian citizens and 30 foreign nationals, including residents of Poland, the Czech Republic, Germany and Georgia, are reported to have been victimized.
- The SBU says it shut down 60 fraudulent call centers between July and September 2026.
Why it matters
The case is the first reported application of a Criminal Code article specifically criminalizing fraudulent call centers, which came into force in September 2026. It shows that Ukrainian authorities are now treating organized dating-site fraud with cross-border victims as a distinct crime rather than as ordinary fraud, and it sits within a wider reported SBU campaign that, between July and September 2026, shut down 60 such call centers.
What happened
On 14 October 2026, cyber police in Lviv Oblast, regional police investigators and officers of the regional SBU department, working with the Lviv Oblast prosecutor's office, exposed an organized group that had been running a fraudulent call center out of rented apartments in Stryi. The three detained organizers — two 23-year-old residents of Stryi and a 21-year-old acquaintance — allegedly searched for victims on dating online services, created fake female accounts, and used specialized software to change a male voice into a female voice in real time. After building trust with their interlocutors, the suspects sent photographs that secretly contained a remote-administration tool (RAT). Opening the file gave the perpetrators covert control of the victim's device and the ability to bypass two-factor authentication on online banking. If a victim reported that the photo would not open, they were persuaded to enable screen sharing and adjust phone settings, allowing passwords and other confidential data to be captured.
According to the investigation, 15% of the proceeds went to the direct perpetrators as a "salary" and the remaining 85% to the organizers, who converted the funds into cryptocurrency and cashed them out through an illegal currency exchange point. Police carried out 9 searches and seized computer equipment, bank cards, dozens of smartphones and SIM cards, a crypto wallet, draft records, more than 1.2 million hryvnias in cash, and foreign currency — US and Canadian dollars, euros, Czech korunas, Polish zlotys, Swiss francs and others — worth more than 800,000 hryvnias in equivalent. Three men were served with suspicion notices under Parts 1 and 2 of Article 255-4 (creation, leadership of or participation in an electronic-communication fraud organized group), Part 5 of Article 190 (fraud), and Part 5 of Article 361 (unauthorized interference with information and electronic-communication systems) of the Criminal Code of Ukraine. The articles carry a maximum penalty of 15 years in prison. Pre-trial investigation is ongoing, and additional legal qualification is possible. The suspects were reported caught "red-handed" in the call-center premises.
How Ukrainian sources describe it
Ukrainian-language outlets frame the operation as a milestone: the first time a suspicion notice for creating a fraudulent call center has been issued under a new Criminal Code article that came into force in September 2026. Domestic reporting highlights the joint work of the SBU, the National Police's cyber police division, regional police investigators and the Lviv Oblast prosecutor's office, and presents the case as a showcase of state capacity against a recognized cyber-fraud threat. Coverage foregrounds the modus operandi — fake female profiles, voice-altering software, RAT-hidden photos, screen-sharing tricks — and the scale of the assets seized.
Where reporting differs
Sources differ on the date President Volodymyr Zelensky signed the law introducing criminal liability for fraudulent call centers: one outlet (Громадське радіо) cites 16 September, while another (Радіо Свобода) cites 17 September.
Background
Article 255-4 of the Criminal Code of Ukraine, which entered into force in September 2026 after being signed by President Volodymyr Zelensky, introduced specific liability for the creation, leadership of and participation in fraudulent call centers. Earlier coverage of the wider phenomenon focused on dating-site scams that combined voice-altering software with remote-administration tools (RATs) to bypass two-factor authentication and drain online banking accounts. The Stryi case is the first reported application of the new article.