Ukrainian Vishing Ring stole 2 million euros from EU citizens

The law enforcement authorities of Latvia and Ukraine announced on Wednesday the dismantling of an organized criminal network that used vissing — a form of voice phishing, where callers impersonate trusted authorities over the phone — to deceive citizens across the European Union.

When a Latvian retiree answered a call that appeared to come from the State Police, the voice on the other end of the line knew her bank, her account, and exactly what to say to frighten her — because the people on the other end of the line had done this hundreds of times before.

See also: SLH hires women for Vishing attacks in IT Help Desk

The joint venture revealed the full mechanism of a modern social engineering scam that involved call center operators in Ukraine, money movers in Latvia and illegal crypto exchangers who laundered the proceeds through the streets of Riga. Vishing is a variant of phishing where attackers manipulate victims verbally instead of through malicious links or attachments.

The technique exploits trust in authority figures — police officers, bank employees — rather than technical vulnerabilities. The Cybercrime Unit of the Latvian State Police, which compiled 35 separate criminal cases involving fraud committed in 2023 and 2024, estimates that the network defrauded Latvian residents of about 2 million euros.

Researchers identified more than 170 money carriers — individuals used to receive and move stolen funds — of which 90 have been classified as suspects. Fifteen call center operators have been arrested, including participants who speak Latvian in the scheme.

The callers pretended to be officers of the Latvian State Police and bank employees, informing victims that fraudulent loans had been taken out in their names or that suspicious financial activity had been detected in their accounts.

See also: Hackers target Microsoft Entra accounts via device code phishing

They then invited victims to “help expose the scammers” — a social engineering technique that turns the victim into an active, cooperative role and suppresses skepticism. To facilitate this, the operators instructed victims to install AnyDesk — a remote desktop access tool — on their computers or mobile devices and log in to their online banking.

From the side of Ukraine, the Cyber Police Department of the National Police of Ukraine disclosed that two Ukrainian citizens — residents of Ivano-Frankivsk in the early 2020s — traveled to Latvia where they recruited local people to open bank accounts in European countries.

These account holders transferred control of their cards to the criminal group for a small fee, creating a drop account infrastructure through which the stolen funds were moved. Drop accounts are bank accounts that are controlled by third parties and are used for receiving and laundering illegal transfers, deliberately creating distance between the scammers and the money.

More than 20 victims in Latvia suffered confirmed financial losses exceeding €300,000 in relation to the part of the network that connects only to Ukraine.

See also: Phishing attack exploits PDFs and Dropbox to steal credentials

The Ukrainian researchers, together with the Cybercrime Department of Latvia, conducted investigations at the residences of suspects in Ivano-Frankivsk, seizing mobile phones and computer equipment as evidence. Europol liaison officers coordinated the exchange of information between the two countries throughout ’ the investigation. Beyond call center operators and money couriers, the researchers in Latvia identified illegal cryptocurrency exchangers — unlicensed operators in Riga who were converting stolen funds into digital assets, further removing the proceeds from their origin.