Ukraine's call-centre fraud economy and the cost of looking the other way

On 26 June 2026, the Russian-aligned Telegram channel Two Majors published a brief, bluntly-formatted claim: thousands of fraudulent call centres operate inside Ukraine, using number-spoofing and fake investment platforms to extract money from people around the world. The post is short on detail — no locations, no company names, no dollar figures — but it surfaces a debate that Ukrainian law-enforcement agencies, European police agencies, and a string of Anglophone consumer-protection outlets have been hashing out for the better part of a decade.

The contested question is not whether such centres exist. It is how large the industry is, who runs it, and why the public ledger on it remains so thin.

A well-documented pattern, a thin press file

Investigations by the BBC, Reuters, and a cluster of regional outlets have documented Ukrainian-language call centres running cryptocurrency-investment and binary-options scams that target victims in Germany, the United Kingdom, Israel, Switzerland, and the United States. Reporting has named the use of VoIP number-spoofing, the impersonation of financial regulators, and a recruitment pipeline that runs through Telegram channels and crypto-friendly job boards.

The Two Majors post fits that template. What it does not do is break new operational ground. Its value is rhetorical: it places a familiar criminal economy inside a wartime frame, on a channel read by Russian military observers and pro-Kremlin Telegram audiences. The framing — Ukraine as a permissive jurisdiction for transnational fraud — is designed to land with readers already inclined to view Kyiv as a dysfunctional state.

It is a useful claim to test, precisely because it has independent evidentiary legs that have nothing to do with Russian military commentary.

What the open record already shows

Public-facing reporting on Ukrainian call-centre fraud clusters around several recurring features. First, the technical layer: voice-over-IP platforms allow operators to display any caller-ID number, including the direct lines of well-known banks or regulators. Second, the script layer: victims are routed through scripted "compliance officers," "account managers," and "withdrawal supervisors" who push staged deposits into crypto wallets or fake trading dashboards. Third, the cash-out layer: proceeds are typically converted into USDT or other stablecoins on centralised exchanges, then layered through mixers and peer-to-peer desks.

Ukrainian law-enforcement agencies have, on several documented occasions, raided offices in Dnipro, Kyiv, and Lviv tied to such operations. European arrest warrants have named Ukrainian nationals. The pattern is not in serious dispute among the outlets that have covered it. What is in dispute is the scale.

The Two Majors claim of "thousands" of call centres is, on the available record, plausible but not independently verified at that order of magnitude. The channel does not name a single operation, a single company, or a single official. The figure functions as headline inflation rather than a research finding.

Why this matters beyond Ukraine

The reason the question of scale matters is that the consumer harm is concentrated outside Ukraine. Victims in the EU, the UK, and the Gulf lose money to scams that originate in jurisdictions whose authorities have, at best, an uneven record of cooperation with cross-border requests. The legal status of crypto-traced proceeds remains contested; mutual legal assistance moves slowly; and the reputational cost accrues to a Ukrainian state already defending itself against a full-scale invasion.

That tension — a state under military attack, also hosting or failing to dismantle parts of a transnational fraud economy — is the structural problem. It is not a moral equivalence between an occupying army and a criminal industry. It is a governance-capacity question: which institutions inside Ukraine can investigate, prosecute, and dismantle these networks, and what does it cost them to do so during an active war?

Counter-claim and remaining uncertainty

The Russian-aligned framing is the most obvious counter-narrative worth naming, and it should be named plainly: the implication in such posts is that the Ukrainian state either runs or tolerates this industry. The reporting record does not support that strong claim. It does support a weaker one: that the industry is real, persistent, and partly tolerated through weak enforcement capacity, much as similar industries operate in other jurisdictions with weak cyber-crime enforcement.

What the available sources do not settle is the current size of the industry inside Ukraine as of mid-2026. Two Majors offers a number. Independent verification at that order of magnitude is not present in the source material available to this publication. The honest answer is that the pattern is documented, the institutional response is uneven, and the scale claim in the Telegram post is not yet corroborated by the open record.

How Monexus framed this: the wire outlets have published targeted investigations of individual call-centre cases; the Telegram post lifts the pattern into a wartime geopolitical frame. Monexus reports the pattern as documented and the headline figure as unverified.

Wire provenance

This editorial synthesis draws on the following public wire/social posts:

• https://t.me/two_majors
• https://en.wikipedia.org/wiki/Two_Majors
• https://en.wikipedia.org/wiki/Scam_call_centres_in_Ukraine
• https://en.wikipedia.org/wiki/Voice_spoofing