The fraudulent call center industry in Ukraine may generate up to $1 billion per month, according to a study

The fraudulent call center industry in Ukraine can generate up to $1 billion per month, and the number of people employed in it is estimated at approximately 60,000 — about two-thirds of the country’s banking sector. At the same time, only 10–15% of the victims of such centers are Russians. The rest are residents of Ukraine and European countries.

This is according to an April report by the Geneva-based organization Global Initiative Against Transnational Organized Crime (GI-TOC), which studies transnational organized crime.

The report is based on interviews with four former call center employees, a member of parliament, a representative of the Ukrainian Interbank Association EMA, as well as conversations with law enforcement officers, journalists, activists, and analysis of open sources.

The authors describe fraudulent call centers as one of the most profitable forms of organized crime in Ukraine. According to some estimates, this business already generates more income than drug trafficking.

In mid-2023, there were between 1,000 and 2,000 such centers in the country, although police raids may have reduced their number by about a third.

Researchers currently assume that around one thousand such “offices” are operating in Ukraine. An average center can generate about $1 million per month, while a large one can bring in up to $3 million. Thus, the potential total turnover of the industry could reach $1 billion per month.

Before the full-scale war, the main centers of this industry were Kyiv and Dnipro. By the end of 2024, according to data cited by the authors, around 30,000 people could have been working in Dnipro alone.

After the war began, criminal networks started moving more actively from the eastern regions to Odesa, Zhytomyr, Vinnytsia, Lviv, and Zakarpattia regions. Reports of such centers have come from all regions of Ukraine, including occupied territories. In Kyiv, Dnipro, Odesa, and Lviv, individual sites can simultaneously accommodate 250–300 employees.

The authors highlight the paradoxical openness of this business. Call centers typically rent premises in ordinary office and business complexes in city centers. During one investigation, six suspected fraudulent centers were found within a one-kilometer radius in Kyiv’s Solomianskyi district.

GI-TOC staff were able to locate one of the Kyiv centers by studying videos its employees posted on TikTok. Using the café sign, a car, the location of neighboring buildings, and rental advertisements, the researchers identified an office with about 60 workstations. Its rent cost around $12,000 per month.

The premises are well protected. They are equipped with cameras, access control systems, and electronic keys; security is hired; and polygraphs may be used to detect law enforcement officers, journalists, and potential informants.

Employees’ phones are sometimes taken at the entrance, their actions on computers are constantly monitored. Passwords can consist of 20–30 characters, disks are encrypted, and access to internal programs is allowed only from specific IP addresses.

New employees are openly recruited via TikTok, Telegram, OLX, Work.ua, and Robota.ua. Job postings offer positions as “customer service managers,” “retention managers,” and sometimes even “baristas” or “barbers.” Signs of a fraudulent office may include high salaries without experience, weekly payments, communication after the first contact exclusively via Telegram, and housing provided for out-of-town employees.

Young people are recruited particularly actively. The preferred age of candidates is 15 to 28. According to participants in the parliamentary investigation, a significant portion of ordinary operators may be teenagers aged 14–20.

One GI-TOC interviewee said he was offered such a job at the age of 15. Older acquaintances showed him money and convinced him he could also get rich quickly. The next day, they brought five teenagers to the call center at once. Some candidates understand what they will be doing, while others are lured under the guise of legitimate work. One employee was told she would be trading cryptocurrency. Only after gaining access to the system and seeing that the Badoo dating site was used to find victims did she realize she had ended up in a fraudulent center.

Another teenager was invited to “deliver flyers.” At the interview, he was asked to call people in other countries.

Promised salaries often do not match reality. One employee was paid about $200 instead of the stated $800–1,000, with the rest supposedly to be earned from commissions on “sales.” Another was promised 1,500–2,000 hryvnias per day but was actually paid 300 hryvnias.

At the same time, some scammers can indeed earn large sums. The authors were told about an operator who received 100,000 hryvnias in a day and an employee who earned 300,000 hryvnias in a week. However, a former center employee described such cases as exceptions.

The work is built on a strict hierarchy. So-called “cold callers” first phone hundreds of potential victims. If someone shows interest, the call is transferred to a more experienced “closer,” who must convince the person to transfer money, install remote access software, or provide banking details.

Center administrators maintain contact with the owners, whom ordinary employees usually never see. This structure allows owners to stay in the background, so even the liquidation of a single office does not cause serious damage to the entire network.

According to the study, the majority of centers are controlled by just three large networks. Their owners have stakes in several “offices” in different cities and even outside Ukraine. The authors link two of the three largest networks to representatives of traditional organized crime — Dnipro-based groups and the “Khimprom” organization, which previously specialized in the production of synthetic drugs.

A small Ukrainian office with 25–30 employees working against Russia was supposed to generate at least half a million rubles per day. One operator called 200–300 people, about a third of whom engaged in conversation, and around seven were successfully convinced to transfer money.

Some centers make up to five thousand calls per day. Only about 0.1% of potential victims stay on the line for more than ten minutes, but these conversations most often end with financial losses.

Employees may work 12-hour shifts six or seven days a week. Day and night shifts are organized to cover different time zones. The offices have a system of fines for lateness, long breaks, and even incorrect pronunciation of words. Employees are constantly monitored, and targets are regularly increased.

Leaving the job is sometimes harder than getting hired. Ordinary operators may be allowed to leave relatively freely, but successful “closers” who bring in large sums are kept through threats, blackmail, and violence. One former employee said people who tried to switch to a competing network could be beaten or taken to the forest.

“If a good employee leaves without permission, they can be found and punished. They were beaten with wire until they bled, and others were shown the photos,” a former HR employee recounted.

Working in such centers changes people. They become more cruel, greedy, and indifferent to others’ problems, while constant lying turns into a habit. One former employee described working in a call center as moral and psychological degradation. Even when the victims were Russians, she could not justify deceiving an elderly woman who had been saving money for her own funeral.

One of the reasons for the industry’s resilience, according to the authors, is protection from the police and prosecutors. According to the study’s sources, centers can pay from $10,000 to $15,000 per month for “cover.”

Former employees described police raids after which an office would close for only one day.

“The police shut down the call center and kicked everyone out. The employees got a day off, and the next day everything returned to normal,” one of them said.

A member of parliament who participated in the parliamentary investigation claimed that before the commission’s visit, local centers would stop work for two or three days. According to him, leaks could have come from law enforcement.

The report distinguishes between “gray” and “black” centers. The former lack official protection but follow an informal rule and operate only against Russia. The latter pay for protection and scam people regardless of their citizenship.

According to the MP, there was an unofficial agreement with two law enforcement agencies under which the centers they controlled were supposed to operate against Russia but not against Ukraine and countries friendly to Kyiv. At the same time, the report’s authors note that in 2022–2023, Russia accounted for no more than 10–15% of fraudulent calls, while most victims were in Ukraine or EU countries.

Scammers have used the war to create new schemes. They offered nonexistent aid from international organizations, collected funds for fictitious charitable projects, sold military equipment and medicines, and promised to evacuate people from dangerous areas.

Relatives of prisoners of war and missing persons were asked for money in exchange for release or information. Fake fundraising campaigns for military equipment purchases were also created. Elderly people were called on behalf of law enforcement, accused of treason, and told to pay to “resolve the situation.”

Ukrainian refugees, including those abroad, were also scammed. The authors found job advertisements in Russian and Ukrainian for positions in other European countries. This may indicate that some centers are being relocated outside Ukraine.

Victims of Ukraine-linked call centers have been recorded in at least 29 countries. English-speaking markets are considered the most profitable. Therefore, some centers hire foreign language teachers and create separate units for different countries. Scammers use fake investment platforms, romantic dating schemes, and calls impersonating banks, police, and government agencies.

Victims are persuaded to install AnyDesk or TeamViewer, download a fake banking app, hand over control of their phone number, or transfer funds to a specified account themselves.

Artificial intelligence is already widely used, enabling voice cloning, deepfakes, automatic translation of conversations, and bypassing identity verification procedures. Special programs can generate forged bank letters with the victim’s real data, stamps, and signatures in seconds.

To find suitable targets, databases of people interested in loans, investments, gambling, and cryptocurrency are purchased. Thanks to data leaks, scammers obtain information about bank cards, passwords, relatives, and contacts of potential victims. This allows operators to demonstrate knowledge of personal details during calls and quickly gain the person’s trust.

At the same time, a “crime-as-a-service” model is developing. A ready-made call center can be assembled from software, instructions, conversation scripts, databases, and money-laundering services sold online. According to the authors, soon launching one’s own fraudulent scheme will require only a few thousand dollars, and a significant portion of conversations could be handled by bots.

In the authors’ view, large offices may become less visible in the future. In Odesa, according to GI-TOC sources, many operators already work from home, using Starlink among other tools, and gather only for training and meetings.