A new fraudulent scheme is spreading in the WhatsApp messenger. Users receive a message about the alleged lack of only a few signatures to award the title of Hero of Ukraine to an unnamed relative of the sender. At the end, a link to a fake page of “Electronic petitions” is added with a request to sign the corresponding petition.

The Center for Countering Disinformation at the National Security and Defense  Council writes that in fact, the link with the petition requires an additional WhatsApp login. If a person logs in again, the fraudsters get access to his personal WhatsApp profile.

The purpose of this scheme is to gain access to user profiles in order to then use them in their own interests. Therefore, if you receive such a message, the Center urges you to block the number from which it was sent, and in no case to follow unknown links. If you have become a victim of fraudsters, contact the cyber police or other competent authorities.

The Center for Strategic Communications and Information Security reports a new tactic for cybercriminals. Attackers specifically accompany the dangerous file with text containing general phrases that may seem familiar to business correspondence:

“Hello, I am sending documents at your request. Please provide the incoming correspondence registration number.

Sincerely,

Mobilization department.”

The names from which the letters come are ostentatiously invented, for example, Konotopenko Radyvoi Ratyborovych. The signature “mobilization department” can confuse and force one to click on the file.

Here are tips from the Center on how to protect yourself from cybercriminals:

- under no circumstances open files received from unknown addresses;

- install an antivirus and keep it activated;

- make backup copies of important documents and files to restore them in case of loss.

This was recorded by specialists from the Center for Strategic Communications and Security. They explained that unknown persons are sending phishing emails allegedly on behalf of the SBU - after all, in such messages users are asked to download malware with dangerous content. For example, Russian intelligence services can use this to collect private information about Ukrainian users.

The SBU department urged not to click on links or download anything when receiving such emails. If such a situation occurs, you should report it by phone: 0 800 501 482 or send an appeal by email: callcenter@ssu.gov.ua .

This was recorded by the fact-checker of the Brekhunets (Liar) project. They explain that Ukrainians began to receive messages seemingly from Ukrposhta that their parcel was “detained because it does not have a number”. In order for it to be sent, one needs to update their address by clicking on the link.

The Ukrposhta main office previously warned that messages with similar content could be sent on their behalf. Ukrposhta specialists are convinced that in this way scammers are ready to obtain users’ personal data in order to take possession including, for example, of their funds. Therefore, one should not click on unclear links.

The name of such a chat is President’s Messenger. The leaflets themselves are distributed on behalf of the chairman of the Zaporizhzhia regional council, Olena Zhuk. They say that city residents can share all their problems and what worries them through a chatbot by clicking on the QR code on the leaflet, since “this is a quick way to draw attention to an existing problem”.

The Center for Strategic Communications and Information Security reported that the head of the local regional council, Olena Zhuk, called these leaflets fake, saying that she, her colleagues and the regional council have nothing to do with them, as well as with the President’s Messenger chat. In addition, Olena Zhuk asked citizens not to follow the QR code on the leaflets and not to transfer their personal data to unknown persons on the Internet. She also reminded residents of Zaporizhzhia about cybersecurity, urging them to observe the rules of digital hygiene.

Ukrainians began receiving notifications from foreign numbers on behalf of Ukraine's National Post that it could not deliver parcels due to an alleged lack of data on the delivery address. To enter one’s full address and receive “one’s” package, scammers encourage one to follow a link and fill out all the necessary data.

The Center for Countering Disinformation under the National Security and Defense Council urges people to never click on links of a dubious nature, since the goal of scammers is to obtain all the necessary information about users for further criminal actions. In addition, it is worth noting that not a single postal service in Ukraine sends messages to users from foreign numbers.

If you have become a victim of scammers and have lost access to your page on a social network, contact the cyber police or other competent authorities.

On December 12, 2023, Kyivstar subscribers began to complain about communication failures, while at the same time the company’s website was unavailable for reasons unknown at the time. It turned out that the company was subject to a hacker attack. The Security Service of Ukraine has opened criminal proceedings into a cyber attack against a mobile operator. According to one version, Russian special services may be behind this.

Meanwhile, VoxCheck analysts recorded fraudulent messages that the operator was charging each subscriber a compensation of 200 hryvnia to their mobile account.

Kyivstar specialists wrote on their Facebook page that scammers have become more active on various platforms and are spreading false information about compensation. Because the company has not announced any such initiatives. Experts emphasized that users should not distribute personal data that could end up among scammers.

According to such reports, the next evacuation from Zaporizhzhia to “Odesa, Poland and Germany” was supposed to take place on December 11, 2023. However, after processing this information, the Center for Countering Disinformation under the National Security and Defense Council found out that in fact no evacuation is planned. Such messages are part of the Russian IPSO. By resorting to such cynicism, propagandists pursue the goal of sowing panic among the population of Ukraine. If such a notification is received, the Center calls on citizens not to click on the links and block the number from which the SMS came. More enemy speculation on the topic of evacuation of Ukrainians can be found here.

The number of telegram channels and pages on social networks promising to help in the search for captured or missing Ukrainian military personnel has recently increased. It is indicated that to complete this task they contact relatives and friends with questions about personal data and other information. This information is subsequently used by propagandists.

Specialists from the “Beyond the News” project cited the answers of the Coordination Headquarters for the Treatment of Prisoners of War to the most common questions. In particular, one cannot share their phone number and other contacts, residential address, social media profiles, brigade number, unit location, as well as photographs, including images with comrades from the army, to strangers.

The dissemination of such information could lead to a deterioration in the situation of military personnel. If scammers can simply profit from someone else's misfortune, representatives of enemy intelligence services can manipulate or resort to blackmail.

The project specialists note that no one on social networks, such as Facebook or Telegram, will effectively search for your loved one. This work is performed professionally and free of charge only by specialists authorized by government agencies. A Road Map is available on the official website of the Prisoner of War Coordination Headquarters, which details what a family should do in cases where a family member is captured, missing, or killed.

Social media users spreading pro-Russian rhetoric are spreading an alleged news story about telephone scammers from Ukraine who, according to the article, are committing crimes against Israelis. In the news story they claim that since October 8, Israelis have been receiving calls from “banks” informing them that the bank office has allegedly been the victim of a Hamas attack, and they need to immediately provide card details to transfer money to a safe place. It is alleged that the police investigation showed that the money was transferred to Ukraine, where the criminals were operating. However, this is fake.

Specialists from the StopFake project drew attention to it. They claim that this information is false. The video distributed online imitates the design of videos from the Israeli publication The Times of Israel, but in fact no such material exists on the official website or social networks of this media company. Also, the video's inauthenticity is indicated by a difference in design, as The Times of Israel uses a different font and from time to time publishes a video without its logo or any inscriptions. The story itself is completely fictitious because none of the reputable publications, including local media in Israel, reported such cases of fraud on the part of Ukrainians.

By spreading such fakes, propagandists want to discredit Ukrainians abroad. They say they interfere in the affairs of others and make money from the misfortune of others. However, Detector Media also refuted other fakes and manipulations on the latest events in the Middle East.

This information was recorded by specialists of the Brekhunets (The Liar) project. In the message, they said that private entrepreneurs in Volyn receive phone calls on behalf of tax officials, demanding money. During a telephone conversation, the attackers claim that the head of the state tax inspectorate of the local department of the State Tax Service in the Volyn region, Serhii Samchuk, is talking to private entrepreneurs.

However, this is a lie. Actually, Serhii Samchuk denied information about telephone calls from the tax service. He also warned entrepreneurs against fraud and urged them to contact the police if anyone receives such calls.

Pro-Russian resources claim that allegedly “swindlers from Ukraine” blackmailed the family of German and Israeli citizen Shani Luk, who was kidnapped by Hamas militants. After it became known about the girl’s kidnapping, the Ukrainians began calling her family on behalf of Hamas and demanding a ransom of 500 thousand euros. The police who investigated the case of the already deceased Shani Luk seemed to come to this conclusion. Propagandists referred to a screenshot of “news published by the German newspaper WDR”. It's fake.

The fact-checkers of the StopFake project began to analyze the information. After independently searching for this news on the website of the German publication WDR, they found out that such material was not published on this news resource. A Google search also did not yield any results about the alleged ransom demand from “Ukrainian scammers”. In addition, there was no mention of a police investigation into this case in reputable German or other media.

Russian propaganda, using the author's style of a German newspaper, tried to justify the actions of Hamas and denigrate Ukraine. The Kremlin is trying to demonize Ukraine in the eyes of ordinary Russian citizens in order to justify the war crimes of its army in Ukraine. Also, by spreading these types of fakes, propagandists hope to weaken international support for Ukraine so that it will not be able to finance defense needs. Previously, we denied information that allegedly former porn actress Mia Khalifa thanked Ukraine for helping Hamas.

A fake page of Commander-in-Chief Valerii Zaluzhnyi appeared on the Telegram channel. Zaluzhnyi himself reported this on his verified Telegram channel: “I received information that someone, using my name, is sending personal messages to certain famous people with requests and proposals of a discreditable and provocative nature”.

The case was studied by the fact-checkers of the Center for Strategic Communications. Valerii Zaluzhnyi also noted: “The Zaluzhniy_ua account on Telegram does not belong to me, like any other accounts under the name Valerii Zaluzhnyi. They are all fake”.

The official pages of the Commander-in-Chief of the Armed Forces of Ukraine are on Facebook and the social network X, formerly known as Twitter.

By spreading disinformation through the fake account of Valerii Zaluzhnyi, Russian propagandists are trying to discredit the Commander-in-Chief and sow panic and despondency among the Ukrainian people.

A phishing attack on group administrators has begun on the social network Facebook. They receive a message saying that, allegedly due to serious violations of community rules, their account will be blocked within 24 hours. To prevent the account from being blocked, they  need to follow the link in the message and appeal the decision.

The specialists from the Center for Countering Disinformation have investigated this scheme and urge people not to click on dubious links. In this way, scammers try to gain access to your Facebook account and information about bank cards and personal data.

Moreover, the Facebook administration does not send such messages. If someone has written something like this, send a complaint and block the author. If you have become a victim of scammers, contact the cyber police.

This was recorded by specialists from the Center for Strategic Communications and Security. They report that unknown people are calling entrepreneurs in the Cherkasy region, allegedly from the head of the Regional Military Administration, Ihor Taburets, who is “raising money” to help the military. Actually, the head of the regional military administration received this information about scammers from a local businessman.

During the telephone conversation, they offer to transfer funds to help the military to the appropriate bank account. But the head of the Regional Military Administration did not make calls and did not ask to transfer funds. Also in his address, he added real contacts of the leadership of the Cherkasy Regional Military Administration, so that residents of the region could check who is actually calling them on the phone.

Fake information about one-time payments to Ukrainians in the amount of 6,600 hryvnia is being spread on social networks. Allegedly, the Verkhovna Rada of Ukraine adopted Law No. 2708-267 “On the payment of monetary assistance to all citizens of Ukraine”.

The fact-checkers at the Center for Countering Disinformation drew attention to this. In fact, such a law on payments does not exist and the Verkhovna Rada has not adopted it. Behind this are scammers citing Law No. 2708 “On Labor”, which has similar figures. By clicking on the link in a distributed message, a person ends up on a dubious Telegram channel or unknown persons trying to ask for bank card details.

The National Police of Ukraine urges people not to click on suspicious links and not to provide any bank cards and account details to unknown persons.

This information was recorded by the fact-checker of the Brekhunets (Liar) project. They explain that Volyn entrepreneurs receive fraudulent letters and phone calls allegedly on behalf of the head of the Volyn Regional Military Administration, Yurii Pohuliaiko, with a request to transfer funds to the Armed Forces of Ukraine.

However, the Volyn Regional Military Administration denied this information. They emphasized that neither the head of it, nor other heads of the Volyn Regional State Administration departments make such telephone calls or send such letters.

This was recorded by the fact-checkers of the Beyond the News project. They say that fake fundraising ads are being created on Facebook, which are allegedly launched by Ukrainian commanders. Unknown individuals publish ads (in this case, an account with the nickname Nataliia Shumakova). They are accompanied by photographic evidence. And they are adding the “story” of the fighter, trying to play on the emotions of social network users.

The fact-checkers explained that in this way the scammers simply defrauded people of money by creating an emotional text about the Ukrainian military. After all, scammers play on feelings of compassion and guilt. Attackers often provide personal phones and bank cards in such cases. However, the absence of references to official representatives of volunteer communities may hint at the falsity of such an announcement.

This was recorded by the fact-checkers of the “Brekhunets” (Liar) project. They say that unknown persons are allegedly calling on behalf of the chairman of the Volyn Regional Military Administration, Yurii Pohuliaiko, and sending a fake letter to Viber with a request to send funds. The report says that the funds will allegedly be directed to equipment for the Ukrainian army.

The Volyn Regional Military Administration noted that they did not send such letters and did not make phone calls. Karina Marynevych, the head of the information policy department of the Volyn Regional Military Administration, assured that such fraudulent schemes do not appear for the first time, and they know how to deal with it. It also conveyed this information to the head of the Volyn RMA, and he will soon come out with a statement about the fake on his pages of social networks.

A subscriber to the NotaYenota project shared her own exposure of a fraudulent scheme aimed at missing and uncommunicative relatives of the Ukrainian military. The scheme is implemented in chats to search for relatives.

In particular, a person represented by the military is attached to them. She or he can give a name or numbers to a brigade on the basis that no one will check this information. According to legend, this man or woman came to a psycho-neurological dispensary in a certain Ukrainian city (different cities are called) and there they allegedly found a department with shell-shocked Ukrainian soldiers who were being held against their will without access to contact with their relatives. Like, he or she visits these chambers and gives bribes for their dismissal. This is preparing the ground for the fact that people in the chat will have to pay the “military” for the release of relatives.

Further, this person sends the names of the military, whom they allegedly found. People call this person, send photos of their relatives, hoping that they are off the list. In personal conversations, this person does not allow the interlocutor to speak and assures that he or she spoke with the soldiers and that they are in a terrible state. Allegedly, the doctors do not want to tell anything and demand a bribe because of the “order from above”. At the end of the first day, the military man assures that he will not leave this business, because he also has a mother and he does not want her to look for him the same way. After that, he sends a photo of the warriors in the ward. As it turned out, this is a photo taken many years ago in Pskov (Russia).

Further, the military sends new names and states that the chief doctor allegedly called the military prosecutor's office against him, but he will not leave this case unfinished. He subsequently sends a “legend” voicemail that has prison slang in the background. In addition, there are several “accomplices” in the chat who send messages of gratitude to the “military” for “saving” their relatives. And chat participants who have doubts and questions about its activities are encouraged to be removed from the chat.

This is a scam that plays on people's emotions. There is a Russian trace in it and coincidences with the messages of Russian propaganda. It was propagandists who repeatedly tried to discredit the Ukrainian military, deliberately exaggerating the scale of the problem and manipulating their mental state. Like, the authorities are silent about everything, and Ukraine leaves its military to the mercy of fate. Media Detector has already written about Russian fakes about the mental health of the Ukrainian military.

In social networks, in particular in the Ukrainian segment of Facebook, information was disseminated that the EU government is introducing a project for the issuance of financial assistance to people of retirement and pre-retirement age. Like, people can get up to 200 euros per day by participating in this program. The authors also claim that the funds are provided by the Provision Fund. Then the message asks to follow the link for the registration.

The fact-checkers of the VoxCheck project worked on the case and found out that the program for paying 200 euros per day does not exist at all. The Provision Fund itself exists in the USA. The purpose of the fund is to create additional funding for residents of Sheridan County, Wyoming, in areas that do not have sufficient funding from the government. That is, this fund has nothing to do with the EU. In fact, group admins use the financial assistant thesis as a bait to increase the reach and membership of the channel. As fact-checkers explained, the group can later change its subject and spread fake information, and due to the large number of subscribers, potential readers will get the impression that this resource can be trusted. However, this is not true.

The Center for Strategic Communications and Information Security reports that Kherson residents are receiving calls allegedly on behalf of the International Organization for Migration. The attackers are asking to name the code received in an SMS message supposedly from an international organization, the local regional state administration noted.

According to experts, the International Organization for Migration does not make phone calls. These are scammers trying to withdraw funds from bank cards and steal personal data. At the same time, one should not answer such calls.

According to the State Service for Special Communications, Russian hackers distribute malicious files through free access to torrent trackers. In particular, if such files are installed on a computer, hackers gain access to the contents of the computer and remain invisible for a long time.

The department reports that hackers use Trojans to copy passwords from different services and find out any information. They trojanize ISOs and installation files and host them for free.

According to the State Service for Special Communications, in many post-Soviet countries, system administrators use unlicensed software distributed via torrent trackers in institutions and companies of various forms of ownership. Thus, they provide Russian intelligence services with access to the contents of working machines.

The State Service for Special Communications says that ordinary Ukrainians who install unlicensed software from unofficial sources and torrents can also become victims of hackers.

According to the Center for Strategic Communications, fake information is being disseminated online, allegedly on behalf of the Red Cross. Allegedly, people can receive payments from the organization to a bank card. The information is spread from the fake website of the Red Cross.

“The fake website of the International Red Cross was created by scammers to steal money from Ukrainians and their personal data. The Red Cross of Ukraine has nothing to do with this site, does not pay such payment, and, moreover, never charges for legal services”, the organization said.

They add: all relevant programs, including those regarding financial support, are published exclusively on the official website.

There are reports on the network that Nova Poshta has launched a drawing where it offers to take a survey and win 6,000 hryvnias “as a gift for Women's Day”.

VoxCheck fact-checkers checked the messages and found out that the company never hosts such events. The official website and Facebook page of “Nova Poshta” denied the message about the drawing.

The site referred to by the fraudsters does not belong to the Nova Poshta company. To convince users to take part in the draw, theн added “joyful” comments from those who had already allegedly won money. Nevertheless, these users resemble bots, because they have uncharacteristic names for Ukraine or significant grammatical errors can be noticed in the comments.

To “win a gift”, users must answer a few questions. These questions are also misspelled. After that, the user has the opportunity to win a cash gift from 3 attempts. The fact-checkers managed to “win” the money on the first try. To “receive a gift”, one needs to share the information about the draw in 5 groups or with 20 friends and complete the registration. After that, the site prompts you to enter the code and wait for the administrator to consider the application. However, when you try to enter the code, a third-party site opens, access to which is restricted.

Detector Media has repeatedly talked about such schemes, when users were offered to “win”: five thousand hryvnias of assistance from Ukrposhta and Nova Poshta, five thousand hryvnias of assistance from PrivatBank, six thousand hryvnias of “New Year's” assistance and so on.