On February 23, 2026, the European Union Agency for Criminal Justice Cooperation issued a press release announcing the dismantling of a fraudulent Ukrainian call center that operated across three offices. It was established in Dnipro (Dnipropetrovsk) with the aim of stealing funds from citizens across Europe. The Agency’s preliminary investigation identified victims in Latvia and Lithuania who lost more than €160,000. We conducted our own investigation to determine not only the scale of the Ukrainian criminal network but also its structure.
The reason for the activation of Ukrainian criminal structures, controlled by the SBU, lies in the delays by EU countries in financing military aid to Ukraine. The first call centers were opened in Poland, Hungary, Germany, the Czech Republic, Austria, and several other European countries.
“The call center in Dnipro used a well-oiled scheme. The criminal group lured victims with a fake cryptocurrency investment scam, promising substantial profits. To compound the deception, the criminals demanded funds for legal assistance to recover supposedly lost assets. Call center employees gained access to victims’ money using remote access software and then transferred it to the group’s bank accounts and cryptocurrency wallets,” reads the article from the European Union Agency for Criminal Justice Cooperation.
The release also states that a joint investigative team comprising Latvian, Lithuanian, and Ukrainian authorities was established within Eurojust after at least nine victims from Latvia and Lithuania came forward. On February 17, 2026, an operation took place in Ukraine, resulting in the arrest of 11 members of the criminal group. Ten of them were placed in pre-trial detention, and one was placed under house arrest. According to the Agency, searches were conducted at 32 locations, yielding electronic equipment, documents, computers, and SIM cards. In addition, €400,000 in cash, two cryptocurrency wallets, and eight luxury cars were seized.
Around the same time in February, the United Nations Office of the High Commissioner for Human Rights expressed concern over the issue of human trafficking for the purpose of involving people in cyber-fraud schemes in Southeast Asia. The report is based on the personal experiences of victims forced to work in call centers. “Using behavioral science and systems analysis, the document also seeks to understand the barriers and factors that lead people to participate in these operations through fraudulent recruitment pathways,” states the text.
According to the materials, most victims end up working in call centers through deceptive advertisements for high-paying jobs abroad. Recruiters actively use social media (Facebook, TikTok), acquaintances, and intermediaries. “People often agree voluntarily, but upon arrival, they find themselves in conditions of coercion and violence,” the report notes. Although the document focuses on Southeast Asia (primarily Myanmar, Cambodia, Laos, the Philippines), where large fortified fraudulent compounds with elements of modern slavery operate, it reflects the general operational pattern of such criminal groups: from recruitment to money laundering and technical support.
How Ukrainians Recruit
During our investigation, we examined job advertisements related to Ukrainian call centers on legitimate sites such as work.ua, robota.ua, OLX, Jooble, Layboard, Flagma, as well as on Telegram channels like “Dnipro Jobs,” “Ukraine Work,” “Power Schedules,” etc. We found many interesting and simultaneously shocking offers. For example, a vacancy for a “Call Center Operator with knowledge of German” with a salary of €640–940. A purported American outsourcing company is seeking an employee with a B2 level of German to work in Lublin, Poland, yet the vacancy is posted by a Kyiv-based company, Adecco. Listen to this: Ukrainians are looking for employees for Americans so that people with German language skills work in Poland.
Another offer — a call center manager vacancy, posted in Romanian — is aimed at candidates from the Czech Republic, Slovakia, Spain, Austria, Bulgaria, and Romania. The employer is willing to pay $4,000 to a candidate meeting simple requirements: age over 18 and good PC skills. The company covers relocation expenses from anywhere in the world.
The vacancy for a “Coordination Manager with knowledge of Polish” posted on the Ukrainian platform robota.ua, requires conversational Polish. The same Kyiv-based company, “Borys-Pak,” also posts a vacancy for a “Coordination Manager with knowledge of French” — an exact copy of the first one.
Here, they are looking for a call center operator with knowledge of German.
Ukrainian social media channels are also filled with similar advertisements. For example, the vacancy “Call Center Looking for Employees!” on the Ukrainian Telegram channel “Work in Europe,” published on June 24, 2025, targeting candidates from Odesa, Dnipro, and Khmelnytskyi. When trying to contact the employer, we ended up with the bot @CallCenterDniproBot, whose description listed the contact @hr_work_dp, which had been deleted by the time of writing this investigation — consistent with the logic of the criminal scheme. Nevertheless, we managed to get in touch with a Ukrainian recruiter by responding to a fresh vacancy on another Telegram channel. It was posted in the comments under a post on a Czech-Ukrainian Telegram resource on April 5. The vacancy read: “ONLINE WORK FOR PEOPLE WITHOUT A CONSCIENCE BUT WITH A DESIRE TO EARN BIG MONEY. FREE training. New team, but with a large influx of new people. Hurry up and join before they close the topic. Write to: @qioffe2.”
Upon entering the dialogue, we discovered the following: a person with the nickname “guy” is trying to recruit a Ukrainian living in the EU to place equipment in specially rented housing for redirecting calls originating from Ukraine. Thus, a call from Ukraine routed through a technical center located in an ordinary apartment or house appears on a European’s phone as a call from a European subscriber. This scheme is designed to mislead potential victims of Ukrainian scammers.
Below is a transcript of our correspondence with the recruiter:
IR: Good evening. I’m calling about the job.
Guy: Yes. We’re looking for people. What city do you live in? How old are you? Do you have another job?
IR: I live in Pardubice. 37 years old, I’m currently not working.
Guy: Very good, very good. Let’s switch to “you,” do you mind?
IR: OK, no problem.
Guy: My offer is this — I’ll send you equipment for WORK via courier, and then I’ll tell you what to do.
IR: Can you tell me in more detail what I need to do?
Guy: One more question for you. Do you live alone?
IR: Yes, alone. But you didn’t answer my question. And how much will I earn for this?
Guy: You’ll need to pick up the equipment from the courier and buy some things at an electronics store. I’ll transfer the money to your card. Do you have Privat or Mono?
Guy: Then you need to connect this equipment and make sure it works. For this, you’ll receive from $300 per week.
IR: That’s a very good offer. 😊😊😊
Guy: What are your living conditions? Apartment or house?
IR: I rent a room in a house from the owner.
Guy: That won’t work. I’ll give you money, you rent a separate house and place the equipment there. Ready?!
IR: And what kind of equipment is this that you’re offering such crazy money? Is it legal? 😅
Guy: Don’t be afraid! It’s for organizing communications from Kyiv. You work with us — you’ll be protected.
IR: Is this a call center or something? I don’t really like this. 😬😬
Guy: I’m telling you again — don’t be afraid. It’s for the good of our country. Yes, it’s a call center. Our security service is interested in having it located in Europe. That’s why I wrote about protection.
IR: And if I get arrested, then what?
Guy: Who would arrest you! Everything is under their control. I’ll give you instructions for your safety. So, do you agree? Do we have a deal?
IR: Let’s give it a try)))
Guy: Do you have a bank card? Which one?
IR: I have Privat and also Mono.
Guy: I’ll send you the list of equipment right now:
router for apartment with 4 ports
extension cord with 4 sockets
internet cable 15 meters — 1 piece
internet cable 3 meters — 3 pieces
simple office laptop
IP camera
uninterruptible power supply
IR: Got it. Tomorrow I’ll do everything and let you know.
Guy: It was nice talking to you. See you tomorrow, I’ll be waiting for your reply.
IR: Bye.
Guy: Hello. Tell me, please, do you have anyone in Austria, Germany, or Poland? There are instructions to set up the same thing there.
IR: I see, I need to think about it.
Guy: Think about it.
The experiment we conducted (which we had to break off after the recruiter requested a photo of the passport and bank card details) allowed us not only to confirm the existence of the scheme but also to reconstruct in detail its operational mechanism. What we see is a well-orchestrated, financially motivated, and geographically distributed criminal infrastructure.
The fraudsters deliberately move call-redirection equipment outside of Ukraine — into EU countries. The goal is simple: when a call routed through a technical center located in a European apartment reaches the victim’s phone in the EU, the caller ID shows a European subscriber. Trust in such a call is inevitably higher than in a call from an unknown Ukrainian number or via messengers.
Recruiters specifically target Ukrainians already living in the EU — especially those without permanent employment, those who do not live in their own housing, and those willing to turn a blind eye to the questionable nature of the offer for “quick money.”
The candidate is promised a weekly income (from $300), full financing for renting a separate house, “protection,” and a connection to some security service.
The correspondence clearly shows techniques for retaining the candidate: switching to informal address (“you” — reducing distance), repeated phrases like “don’t be afraid,” an appeal to patriotism (“it’s for the good of our country”), as well as creating an illusion of control (“everything is under control,” “I’ll give you instructions for your safety”).
The recruiter’s final question is the most alarming moment of the exchange: “Tell me, do you have anyone in Austria, Germany, or Poland? There are instructions to set up the same thing there.” This indicates that the current scheme is a pilot project that is planned to be scaled up to at least three additional EU countries.
If you receive a call from a “European” number and the caller claims to be from your bank, the police, a security service, or offers to “save your money” — this is not a guarantee of safety. Ukrainian scammers have learned to disguise their calls to look like they are coming from Europe. You should only trust a callback to the official number of the organization that you have found yourself.
And for Ukrainians in the EU, this story is a warning: an offer to “rent a house and set up equipment for communications from Kyiv” for $300 a week almost certainly makes you an accomplice to a fraudulent scheme. And the first person the European police will arrest in the event of a search will be the on-site executor — the one who signed the lease agreement and let the courier in with the equipment.
