Scammers issued a loan, is there a chance to get the money back?

[Father]

Every year, more than 25% of Russians fall for the bait of financial fraudsters, and only a few successfully get out of this unpleasant situation. For the hero of our story (let's call him M.), the attackers fraudulently issued a loan in the amount of more than 1.3 million rubles, but everything ended well: with the help of a lawyer and cybersecurity experts from the IT company CREDO-S, he managed to cancel the loan agreement through the court.

We tell you how it was, and the most inquisitive readers will receive a bonus instruction on what to do if fraudsters have issued a loan.

How did scammers apply for a loan?​

In August 2022, M. received a call from a fraudster. Introducing himself as an employee of a mobile communication company, he offered to disable via SMS allegedly connected paid services to the tariff, which was the first step of the fraudulent scheme.

How did the scammers proceed?​

1. On behalf of the mobile operator, the service of SMS forwarding from the victim's smartphone to their smartphones was activated.
2. Reset the password for the mobile banking app, thereby gaining access to the resource where personal data is stored.
3. From their mobile number, they called the bank on behalf of M. and, after confirming his identity using the stolen data, left an application for an online loan.
4. After the loan was approved online and the money was credited to the victim's account, the funds were sent in installments to the bank accounts of three accomplices in the amount of 247,000, 2x248,000 and 249,000 rubles, each time confirming the operation through the bank operator by phone.

M. found out about the scam when he couldn't log in to the banking app. Calling the bank, he found that a loan agreement was concluded on his behalf in the amount of 1,336,898 rubles, part of which was an insurance premium of 336,898 rubles. The loan was concluded for 84 months, the monthly payment amount is 21,441,67 rubles.

Access to the mobile bank was blocked by the bank's security staff, as after receiving credit funds to M.'s personal account, suspicious money transfers to unknown people began.

To get rid of the illegally issued loan, M. applied to the bank with an official request to cancel the loan agreement and delete information from the credit history, and also filed a police report.

The bank refused to cancel the loan, but returned the insurance premium, with which M. was able to pay the loan during the investigation and legal proceedings. The victim tried several more times to get the loan obligations to be withdrawn from himself through the bank, but without success, so he decided to file a lawsuit in court.

Can fraudsters apply for a loan over the phone? Yes, if they managed to get hold of your personal data — full name, passport number and registration address, which are usually saved in banking applications.

What did the court of first instance decide?​

M. applied to the court to declare the loan agreement invalid, delete data from the credit history, and stop the transfer of personal data by the bank to third parties. He also pledged to return the remaining credit funds — an insurance premium, if the court decides in his favor.

The court of first instance refused to comply with all the claims, as, in their opinion, the victim himself violated the bank's information security rules, namely, passed the code from the SMS to restore the password for entering the banking application to third parties. M. was not satisfied with the decision, so he decided to file an appeal.

What did the court of appeal decide?​

M. decided to prove his case by resorting to the help of information security specialists from the CREDO-S IT company: at his request, a cybersecurity specialist was involved in the trial as an expert.

Having studied the details of the victim's phone number, the IT specialist presented a number of arguments in court in favor of the fact that M. did not violate the bank's information security rules:

1. All incoming text messages were redirected to the fraudsters ' phone numbers — which means that M. did not receive any text messages, including about changing the password in the bank's app, applying for a loan, and signing a loan agreement.
2. SMS forwarding was enabled through the personal account of the mobile operator — to enter it, just a one-time code from the SMS that the victim fraudulently found out fraudsters.

In August 2023, the court, taking into account, among other things, the arguments of the invited IT specialist, invalidated the loan agreement, released M. from credit obligations, and also ordered the bank to delete the loan agreement data from the credit history.

What should I do if a loan was issued to you or your relative?​

If this happens, proceed as follows:

1. Call the bank and report the incident — the sooner the better.
2. Apply to the bank and write an application with a request to cancel the loan — it is important to attach as much evidence as possible that you did not apply for the loan yourself.
3. For the duration of the proceedings, try to negotiate with the bank to reduce the monthly payment, refinance or grant deferral on the loan.
4. Write a statement to the police — the statement must describe in detail the circumstances of the case, so that the police have grounds for initiating a case.
5. Ask for help from experts-lawyers, IT specialists.
6. If the loan agreement could not be canceled through the bank, then you should file a lawsuit in court, attaching to it as much evidence as possible of your non-involvement in the loan processing. When applying to the court, if possible, contact a lawyer and involve experts.
7. If the court of first instance rejected you, then you should apply to the court of appeal: you will need to find even more evidence of your rightness in order for the case to be decided in your favor.