Habr•September 15, 2026•🇷🇺Translated from Russian

Why Isolated Bank Scoring Fails to Prevent Counterparty Default: OSINT Case Study of a Scam Deal

A social entrepreneur operating as an individual entrepreneur (IE) signed a contract in October 2023 for the supply of complex IT equipment worth more than 600,000 rubles, of which 500,000 rubles came from a targeted state grant. The agreement required 100 percent prepayment.

Before transferring the funds, the entrepreneur checked the supplier, conditionally named AvtoTransSnab-90 LLC, through the compliance service of a major bank. The system assigned the counterparty a green marker indicating high reliability. The transaction was approved and payment was sent.

The supplier shipped goods worth only 15,000 rubles as cover, then ceased performance and effectively vanished. While the entrepreneur pursued court proceedings and attempted debt recovery through bailiffs, the Department of Investment Policy demanded return of the grant due to failure to achieve performance targets. To keep the business running, the entrepreneur had to purchase the remaining equipment at personal expense for another 485,000 rubles and repay the grant funds. The net loss for the micro-business reached almost one million rubles. Bailiffs and arbitration courts yielded no results in recovering unjust enrichment.

Four Critical Red Flags Missed by Automated Compliance

The bank algorithm evaluated the company in isolation and at a single point in time. On the query date, AvtoTransSnab-90 LLC was active, had no recent lawsuits, and no open enforcement proceedings. The robot checked formal checklists and approved the deal. Human analysis of the same public data immediately identified stop factors.

  • Industry mismatch: The name and primary OKVED code in EGRUL clearly indicated cargo transportation, yet the contract concerned IT equipment supply. A sudden change in operational profile without adding relevant activity codes is a classic risk marker.
  • Absence of financial reporting: The state information resource for accounting statements (GIR BO) showed the organization had not filed balance sheets for the three years preceding the transaction. Combined with a minimal charter capital of 10,000 rubles, this pointed to a typical dormant shell company.
  • Direct affiliation via FTS registry: The Transparent Business service revealed that a 49 percent co-owner of the supplier was also the 100 percent owner of Computer Campaign LLC, registered at the same address. The second company was an actual IT wholesaler.
  • Financial distress of the linked entity: At the time of the deal, Computer Campaign LLC was effectively bankrupt, with tax debts exceeding one million rubles, arbitration claims over five million rubles, and negative net assets of 248,000 rubles.

The beneficial owner had redirected incoming client payments to the clean transport entity to avoid imminent account seizures on the profile IT company.

Two years later, AvtoTransSnab-90 LLC was liquidated by tax authorities as an inactive entity and the debt was written off. The sister IT company was declared bankrupt under a simplified procedure for an absent debtor with budget liabilities exceeding seven million rubles. The beneficial owner was added to the FTS blacklist and disqualified for three years.

The core vulnerability of commercial bank scoring remains its single-entity approach. Automated systems assess a legal entity in a vacuum and ignore the collapse of related businesses owned by the same beneficiary. Basic manual checks against official state databases continue to outperform closed bank compliance algorithms.

Related articles

Habr•Fraud & Social Engineering

Aroshka Cloud Faces Scrutiny Over Alleged False Claims of SOC 24/7 Operations and High-End Infrastructure

StackWorks has published the fourth installment in its investigative series on Aroshka Cloud, detailing how the cloud storage provider accused the studio of orchestrating a DDoS attack shortly after the third part appeared. The service published five posts claiming technical evidence linked StackWorks to the attack, including IP traces from Moscow, Ufa, and Stavropol, while asserting that its SOC 24/7 team mitigated a 3.5 Gbit/s assault within seconds. StackWorks responded with a pre-trial claim demanding removal of the posts and a public retraction, which Aroshka Cloud rejected within seven minutes. Analysis of the provider’s own Kwork job postings reveals requests for template-based support staff, a five-VDS server pool, and later up to eight NVIDIA H200 GPUs with InfiniBand, contradicting public statements about multi-country data centers and round-the-clock security engineers. Further inconsistencies include mismatched time zones in email headers, inflated user statistics, and reliance on the BeDrive script rather than custom development. The investigation continues with plans to involve law enforcement regarding suspicious visitor logs.

Habr•Fraud & Social Engineering

Reports Surface on Alleged De-Anonymization of Admins Running Major Russian Hacker Forums

An independent researcher has compiled publicly available information pointing to the possible identities of administrators behind prominent Russian-language darknet forums including exploit.in and duty-free.to. The analysis traces exploit.in back to its 2006 launch by a user known as Toha, later linked to Ukrainian authorities or associates, with the forum reportedly transferred or sold. Forum moderator Quake3, identified in open sources as Anatoly Kravchuk, ceased activity in October 2026 and appears on a German police wanted list. Additional details from forum posts and anonymous Telegram channels name Mikhail Rytikov, known as Abdulla, as a key figure tied to server hosting and operations. The report also notes the recent involvement of known Russian hacker wazawaka on duty-free.to and highlights the declining viability of several legacy forums due to law enforcement actions. All claims are presented as unverified public speculation without new original sourcing.

AntiMalware•Fraud & Social Engineering

Google Strengthens Chrome Defenses Against ClickFix Clipboard-Based Scams

Google has updated Chrome to detect and warn users about malicious commands copied to the clipboard as part of ClickFix attacks. These scams trick users into pasting harmful scripts into system tools such as PowerShell under the guise of fixing errors or providing tech support. The new protections activate when Enhanced Protection in Safe Browsing is enabled and send suspicious commands for analysis after removing personal data. Google has also shifted scam page detection from a local Gemini model to a server-side implementation to improve accuracy against fake tech support, antivirus, and browser update sites. The changes make it harder for attackers to bypass browser download checks by abusing clipboard and system console execution. Official details were published in the Google Security Blog.

Habr•Fraud & Social Engineering

SPF, DKIM and DMARC: Practical Guide to Detecting Email Spoofing and Phishing

The article explains how email authentication mechanisms SPF, DKIM, and DMARC work together to combat spoofed messages that impersonate trusted services. It provides concrete DNS record examples and shows how to interpret Authentication-Results headers in received emails. SPF verifies authorized sending IP addresses but does not check the visible From address. DKIM adds cryptographic signatures to message content and headers, while DMARC ties these checks to the sender domain visible to users and defines handling policies. The guide also covers common configuration errors, forwarding issues, and why successful authentication does not guarantee message safety. It concludes that these protocols must be combined with additional security measures such as attachment scanning and user awareness training.