The $2M Fraud That Passed Every Security Check

On October 7, 2026, Group-IB published an investigation into a fraud operation that turned legitimate government payment portals into a money-laundering machine. Between October 2025 and August 2026, its Fraud Protection team detected roughly 300 related incidents across several major retail banks. In a validated subset of 80 compromised cards spread across three government institutions, confirmed losses reached USD 2.01 million.

The detail that should make everyone pause: in every confirmed case examined, the fraudulent transactions passed valid 3D Secure authentication. The attackers were not breaking the security checks. They were passing them, because they had already taken over the victims' phone numbers and bank accounts and were approving the prompts themselves.

The operation ran in three layers.

First, phishing. Attackers bought verified Google Search ads with GCC geo-targeting and stood up more than 400 phishing resources across 10 disguise patterns, cloning government portals and insurance services. Victims surrendered personal data and card numbers, and, just as important, approved telecom prompts that authorized fraudulent eSIM swaps. The eSIM request was the real prize: it handed the attackers the victim's phone number.

Second, account takeover. With the hijacked eSIM intercepting one-time passcodes, and GPS spoofing masking their location, the attackers took over online banking accounts, raised transfer limits, and approved 3DS challenges inside the banking app. Group-IB's telemetry linked 90 percent of these takeovers to new iOS device fingerprints originating from a geohash cluster in Ramtha, Jordan.

Third, the cash-out. And this is the layer that runs on Telegram. In specialized Telegram channels, the operators recruited members of the public with offers to settle traffic fines, utility bills, and legal charges at discounts of 50 to 80 percent. The criminals paid the full bill on the official government portal using stolen card details, then collected clean discounted funds from the "customer" via cryptocurrency or bank transfer. Because the payment went directly to a trusted government entity on behalf of a real citizen, bank monitoring saw a routine payment and flagged nothing.

This is a Telegram-marketplace operation, which puts it squarely in RelayShield's monitoring territory. The bots and the threat-intel corpus watch the Telegram scam markets where cash-out schemes like CIVIC DRAIN recruit their customers. Screenshot one of those "pay your fines at 70 percent off" Telegram posts and forward it to the RelayShield Telegram bot, or drop it into /scan: the checks evaluate the channel's links and wallet addresses against the corpus, and the rescan capability keeps watching, so indicators checked today can surface new verdicts as investigators map more of the infrastructure. The eSIM-swap layer is covered too: SIM-swap monitoring is one of the checks RelayShield runs, because a number port you did not request is very often the first move in a takeover chain.

The concrete takeaway: a paid ad is not a trust signal. Reach government and insurance services only through the official app or a bookmark you saved yourself, never through a sponsored search result, and treat any stranger offering to settle your bills at a discount through a Telegram channel as a fraud lure, not a bargain.

Sources: Security MEA summary of Group-IB's investigation, "Group-IB Reveals $2M Cyber Scam Exploiting GCC Government Portals," published October 7, 2026.

Originally published at https://blog.relayshield.net on October 14, 2026.