Bank Card Fraud: 10 Schemes and How to Protect Yourself

Fraudsters rarely need to “hack” a bank: much more often they make the cardholder hand over the data themselves. The National Bank of Ukraine (NBU) names social engineering as the fraudsters’ main tool: people disclose card details, passwords or SMS codes, and the money disappears from the account. Below are ten schemes described by the NBU, the Cyberpolice and banks on their official pages, and the rules that work against each of them. Data checked on 15 October 2026.

What Fraudsters Want to Get

According to the NBU, fraudsters hunt for three groups of data: card details (the 16-digit number, the three-digit CVV/CVC on the back, the expiry date), the login and password for internet or mobile banking, and one-time codes that arrive by SMS or app notifications. They also try to find out the code word or persuade you to lift the limits on the card.

10 Bank Card Fraud Schemes

1. A call from the “bank’s security service.” You are told the card is blocked or that suspicious activity is under way on the account, and asked to read out your details or the SMS code. The Cyberpolice warns that fraudsters can spoof the number, so the bank’s number may appear on the screen. Hang up and dial the number on the back of your card yourself.
2. A phishing link and a cloned site. A link from an SMS or messenger leads to a copy of a bank’s, shop’s or delivery service’s website. The NBU advises not to follow such links, to check the address and, if you need to reach a company’s website, to find it through a search engine.
3. Fake payouts and “compensation.” They promise help from the state, the EU, the UN or a bank, often through a chatbot in a messenger. They ask for card details, a PIN, the banking password, or a “commission” or “state duty” (the NBU gives an example of UAH 100–200). Online payments from the state, the NBU reminds, are arranged only in Diia.
4. “Go to an ATM to receive a payment.” The “buyer” asks for card details for a prepayment, then a “bank employee” calls and leads you to an ATM, dictating what to press. In reality you are transferring money to fraudsters: there is no “transfer to your own card” operation at an ATM. If you are being directed somewhere over the phone, hang up.
5. A fake shop or seller. A very low price, a prepayment to a card, a refusal of cash on delivery, shortened links. The NBU advises paying on verified websites, choosing cash on delivery, discussing the deal only in the platform’s chat and paying with a virtual card.
6. Fake QR codes. According to a Cyberpolice message (February 2025), fraudsters replace QR codes on signs in public places where people pay for parking or transport or make donations. Scan only codes from reliable sources and check the website address after you open the link.
7. SIM card takeover. According to the NBU, a fraudster reissues your SIM card or restores it as “lost” by luring out the operator’s code. In this way they obtain a financial phone number and with it access to banking.
8. Account hacking and a request to “lend money.” After hacking the owner’s social media page, fraudsters send the owner’s friends identical messages asking for money. Before you transfer anything, call your friend on a number you know or ask something only the two of you would know.
9. Investment “platforms.” Signs from the NBU website: “guaranteed” high returns (for example, 1–3% a day), rapid growth of “profit” in the account, demands to pay a “tax” or “commission” to withdraw funds, and a request to install remote access software.
10. “Money mules” (drops). They offer a “job” in which you receive money on your own card and transfer it further. The NBU writes that mules are considered accomplices: Article 209 of the Criminal Code provides for imprisonment for 3 to 12 years, and the account will be blocked.

The schemes differ, but the signs repeat: you are frightened with a card block or the loss of money, tempted with a payout or easy earnings, and pushed to act immediately. The NBU advises not to act on the caller’s instructions, but to check the information yourself in official sources: on government websites, through “hotlines” or at the bank.

How to Protect Yourself

The NBU repeats these rules on its payment security pages, and most of them block several schemes at once.

• Do not disclose your CVV/CVC, PIN, banking password or one-time codes. PrivatBank adds that its employees never ask for such data and do not call first to clarify personal information.
• Enable SMS notifications about transactions and set individual limits on card operations.
• For online purchases, use a virtual card and transfer only the required amount to it.
• Create a complex unique password (the NBU advises 12 or more characters) and enable two-factor authentication. Change your PIN every three months.
• Protect your SIM card: set a PIN, disable remote SIM replacement in the operator’s account and do not publish your financial phone number in ads.
• Use only the bank’s official contacts: its website, its app and the number on the back of your card.

What to Do If Your Data Has Been Exposed

1. Block your card, accounts and banking access. Call the bank at the number on the back of the card or block the card in online banking. If fraudsters have obtained your banking password or financial phone number, block the accounts as well.
2. Contact your mobile operator if you suspect a SIM reissue or have lost your phone.
3. File a complaint with the Cyberpolice online at ticket.cyberpolice.gov.ua or by phone at 0 800 505 170. Fraud is punishable under Article 190 of the Criminal Code.
4. Collect evidence: the link to the phishing site, screenshots, the bank statement, and the numbers from which you were called.
5. Notify the platform or service on which the scheme took place, for example the marketplace or the delivery service.

Banks also have their own forms. In the Privat24 app this is the “Communications” menu and the “Report fraud” item; you can also call 3700.

Frequently Asked Questions

Can a real bank ask for an SMS code?

No. The Cyberpolice reminds that real bank and government employees do not ask for the CVV, the card’s expiry date, one-time SMS passwords or login details for online banking. If they ask, the conversation should be ended.

What should I do if I entered my card details on a suspicious website?

The NBU advises blocking the card immediately through online banking or calling the bank at the number on the back of the card. If you may also have disclosed your banking password, block the accounts and banking access as well, and then contact the Cyberpolice.

Does a virtual card protect me?

It limits losses. If you keep on it only the amount for a specific purchase, then even if data leaks, fraudsters cannot benefit, PrivatBank writes. The NBU advises transferring the needed amount to such a card just before the purchase.

How can I tell that a shop is fraudulent?

An underpriced offer, a request for a prepayment to a card, a refusal of cash on delivery and shortened links should raise suspicion, the NBU lists. Also check whether the site appears on lists of fraudulent resources: the NBU provides a list of such services in a separate article.

Where should I complain if the money has already been debited?

First to the bank, to block the card, and then to the Cyberpolice. The NBU reminds that fraud falls under Article 190 of the Criminal Code, and that a statement is better filed together with evidence: screenshots, statements and links.