Russians were warned about a new fraud scheme on the eve of the New Year

Individuals must pay taxes by December 1, 2025. Using this, attackers can actively create bots, channels and other platforms disguised as resources of tax authorities. This was stated by the head of BI in an interview with Izvestia on November 27.ZONE Digital Risk Protection Dmitry Kiryushkin.

Most likely, according to him, scammers will distribute malicious content on Telegram in order to steal the victims' account and funds. Attackers seek to use topics relevant to users in order to increase the chances of successful deception. So, due to the approaching deadline for paying taxes for individuals, they will imitate the resources of tax authorities.

"We record the creation of accounts, chats and channels in Telegram, one way or another related to tax issues. Most of them disguise themselves as official resources of the tax authorities: news channels or feedback bots. To protect themselves, users are advised to verify the authenticity of the resource on the official websites of the tax authorities," the expert warned.

Putting it on speaker: calls to scammers from victims have become the most popular scheme

How to recognize such a deception and not dial the criminal's number yourself

The fact that the attackers in this case choose Telegram as their main platform confirms a previously identified trend: criminals are less likely to create phishing sites, especially in Russian domain zones, and increasingly prefer to interact with users on social networks and messengers.

"At the end of the year, fraudsters often use the scenario "you have unpaid taxes", "error with the declaration", "charging a fine for non-payment of taxes" and other tax-related topics. Cybercriminals create a stressful situation by intimidating the victim with fines and limiting the time to make a decision," Kiryushkin explained.

According to him, as a rule, attackers try to get an SMS code from the second protection factor. Therefore, you should be critical of all suspicious calls and messages. If there is the slightest doubt, we recommend that you stop communicating, do not follow the links and visit the official resource yourself.

The specialist suggested that the attackers could develop new scenarios. For example, to offer assistance in obtaining a tax deduction and other services. Such ads can be placed on online bulletin boards and other platforms with ads. You should use only official services and trusted resources.

BI.ZONE DRP experts recorded a similar scheme with ads in September, when the attackers offered to issue a CTP policy. Then they found over 5,000 ads on digital boards, of which at least 9% were allegedly fraudulent.

Earlier, on November 24, it was reported that attackers began to attack Russian citizens more often against the background of massive failures of large Internet services. For example, in the first ten months of 2025, fraud activity increased by about 27% compared to the same period last year.

All important news is on the Izvestia channel in the MAX messenger.