Ukraine's 94-call-center sweep shows bank fraud runs on a shared supply chain

Ukraine's National Police, working with the Security Service of Ukraine and the Office of the Prosecutor General, disrupted 94 fraudulent call centers in a nationwide operation and seized 3,336 pieces of computer equipment, 1,346 phones, more than 5,200 SIM cards, 90 bank cards, access to 20 crypto wallets and 22 cars ^[1][2]. The detail that should change how defenders think about this is not the hardware pile but what was running on it: ready-made conversation scripts, databases of potential victims, special software, and tools for hiding and withdrawing funds ^[3].

The arithmetic describes offices, not opportunists. Across 94 sites, 3,336 machines works out to roughly 35 units per center ^[4]. SC Media, citing Bleeping Computer, put the workstation count at 1,794, or about 19 seats per site ^[5][6]. The 5,200-plus SIM cards amount to about 1.6 SIMs per seized computer, consistent with rotating caller ID rather than a fixed phone bank ^[7]. Police described premises equipped for the "systematic fraud of people," staffed by administrators, operators and other scheme participants ^[8][3].

The product lines were segmented. Some operators impersonated bank staff, warning of suspicious transactions or account problems to extract card data and verification codes or to push transfers ^[9]. Others posed as investment brokers steering victims to fake investment and crypto platforms ^[10]. According to police, some crews also impersonated law enforcement, threatened to block accounts unless payments were made, talked victims into applying for loans, and got them to install remote access tools ^[11]. One strand sold dietary supplements marketed as treatments for illnesses despite having, in the police account, no therapeutic properties in their chemical composition ^[12].

The supply-chain claim comes from police directly: some groups collected personal information on prospective victims and shared or sold those records to other operations ^[13]. The recovery scam is the tell. Police said some victims were promised help getting back money they had already lost to scammers ^[14], and that pitch only works against a list of people already known to have been defrauded. A victim database, once built, is inventory that outlives the crew that made it.

The cash-out layer was equally organised. Investigators flagged 67 further financial instruments, including 40 bank accounts or cards, 12 crypto wallets and 15 suspected money mules ^[15]. Ukrainian police are working with German authorities on one group that defrauded EU citizens through fake brokerage platforms, routing funds through crypto exchanges before landing them in accounts the group controlled ^[16]. Seizures included about 2 million US dollars, 64,000 euros, hryvnia cash, a kilogram of bank gold in bars and jewelry ^[17].

Set that against the enforcement figures. Authorities checked 867 addresses and conducted more than 400 searches, put at 411 by SC Media ^[18][19], and notified 26 people they were suspects, or roughly one suspect for every 3.6 centers taken down ^[20][21]. The cited fraud and money laundering offenses carry up to 12 years and property confiscation ^[22].

What to watch: whether the forensic examination of the seized material, which police say is aimed at identifying victims and tracing transactions ^[23][24], produces notifications to the named people in those databases and to their banks, or stays inside the case file. Watch the 15 suspected mules for whether they lead upstream to the list brokers rather than ending as separate small prosecutions. And watch the German case, which is the test of whether cross-border cooperation reaches the payout accounts and not just the phone rooms ^[16].