Common scenarios used to siphon money from cards
Fraudsters increasingly rely on social engineering to trick people into giving up access to funds or taking out loans in a mobile app themselves. Perpetrators invent scenarios that seem plausible — from calls supposedly from a bank’s security service to messages about winnings or lucrative jobs — and through pressure or deception obtain one‑time passwords and account details from the victim.
Communication tools have changed too. Calls and messages often come not through the telephone network but via internet services such as VIBER or Telegram, so it can be hard to verify the number. Maksym Yadviga, head of the payment operations monitoring and security department at Idea Bank, notes that current criminal scenarios include requests to register in an app to receive a loan and then transfer those funds to the fraudsters' accounts. Older schemes — such as renting non‑existent accommodation or selling goods without shipping them — still occur but are now less common.
Why fraudsters started using artificial intelligence
Artificial intelligence has removed the need for deep technical knowledge for many attackers, as modern platforms generate attack texts, analyse methods and even suggest steps to bypass protections. Maksym Yadviga emphasises that today a fraudster often only needs to set the right task for an AI and then refine the results to get a ready‑made attack plan.
Many criminal groups use well‑known models and services such as CHATGPT, GOOGLE Gemini, Claude, GROK and Microsoft Copilot to automate preparation of phishing messages and call scripts. This does not make the attacks novel in content, but it makes them more scalable and requires users to be more vigilant because messages become more personalised and believable.
Which protection tools banks use and what clients should do
Banks use suites of anti‑fraud systems configured for each payment instrument and channel to detect suspicious transactions in time according to set rules and limits. Idea Bank says that it is the combination of different rules and monitoring that helps reduce risks in each individual case.
Key recommendations for clients include setting limits on cash withdrawals and online payments, enabling SMS or push notifications and issuing a separate card for online purchases. Banks also advise regularly updating the mobile app, changing passwords and reading messages from the bank carefully, since if a client has compromised their own digital data the bank may refuse reimbursement of funds, as an expert from Idea Bank explained.
What the rise in cashless transactions means for users
Cashless payments are becoming more popular, which means more transactions per day and a larger share of cashless payments in the overall volume. According to the National Bank of Ukraine (NBU), the number of payment card transactions in Q1 2026 was 2,300 million and their value was 1,830.6 billion UAH, compared with Q1 2025 when there were 2,191.3 million transactions worth 1,646.5 billion UAH. Of these figures, 2,208.8 million transactions worth 1,232.5 billion UAH were cashless — increases of 5.9 and 14.8 percent respectively year on year — and, data from the NBU show that 96 out of 100 payment card transactions are cashless.
For users, this means checking statements and instant notifications more often, choosing sensible limits and using a separate card for internet purchases if there is a risk. It is also worth remembering that by the end of March 2026 the number of issued payment cards in Ukraine reached 151.7 million, and more than half of active cards — 57.1 percent — are contactless cards, which speeds up transactions but also requires appropriate security settings.
Idea Bank. Banking licence of the NBU Nº96 dated 04.11.2011. Entered into the State Register of Banks under Nº46.
