Fraudsters before the autumn sales began to steal accounts more often

On the eve of the autumn sales of 11.11 and Black Friday, fraudsters in Russia switched from stealing bank card data to stealing user accounts in social networks and instant messengers. Sites that simulate such services account for up to 40% of all attacks, according to a press release from MegaFon, which received RBC.

According to the operator, the main autumn sales of its antifraud system traditionally recorded a surge of fraudulent activity. Attackers send through social networks, messengers and e-mail links to fake sites under the guise of offers for personal discounts, closed sales and gift certificates.

Fraudsters also use messages about a gifted subscription or requests to vote for a child. Links lead to fake login pages where users enter login details and may lose access to their accounts.

After hacking accounts, attackers send malicious links to familiar users on their behalf. MegaFon explained that the operator cannot warn about such messages using antifraud systems, since correspondence passes through the Internet, bypassing the mobile infrastructure.

In 2024, during the autumn sales, the number of attempts by subscribers to switch to phishing sites increased by almost a third relative to the annual average, while the traffic of marketplaces increased by only 13%. Then the fraudsters mainly created copies of online stores to steal payment data. In 2026, fake marketplaces dropped to fourth place among sites used by cybercriminals.

The Mail also recorded an increase in the number of blocked emails with spam and phishing. In early November, their number increased by 5% compared to the same period last year. Attackers began to use personalized offers more often, taking into account the interests of the recipients.

Director of the Department for prevention of fraud and loss of income “MegaFon” Sergey Khrenov warned that reports of discounts from friends may cause less suspicion. He recommended enabling two-factor authentication, not ignoring security warnings and checking suspicious offers on official store websites or by phone with the sender.

During the sales season, fraudsters use a personalized approach: they offer an additional discount on a popular product, send a unique promo code or report a problem with an order. Links lead to fake store sites, where users are asked to log into an account or enter bank card details. The information obtained can be used to steal accounts or money. To protect yourself, we recommend checking the sender’s address, as well as making orders only through official pages, said Dmitry Moryakov, head of the Mail Mail’s spam analysis group.

Earlier, MegaFon told RBC that in September the number of blocked suspicious calls decreased by 73% compared to the same period last year. The company attributed this to the strengthening of the fight against telephone fraud and noted that attackers began to use hacked accounts in messengers to call potential victims.