SecuritylabJuly 20, 2026🇷🇺Translated from Russian

Protecting Your Credit History: How to Check for Unauthorized Microloans and Set Up Self-Bans in Russia

Russians typically learn about loans taken out in their name only after a bank refuses a new card or loan, at which point an unfamiliar debt appears in their credit report. Checking your credit history can be done online and free of charge. First, identify which credit bureaus hold your data, then download the reports and carefully examine all contracts, applications, and creditor requests instead of stopping at the credit score. If you do not plan to take out loans soon, it makes sense to immediately place a self-ban, which makes it significantly harder for fraudsters to obtain credit using your personal data.

Where to Check Your Credit History

There is no single centralized database. Banks, microfinance organizations, and other lenders send data to different credit bureaus, and it is impossible to know in advance which ones hold your information. The list of bureaus storing your credit history is provided by the Central Catalogue of Credit Histories (CCCH) of the Bank of Russia.

Through Gosuslugi, the entire process takes just a few minutes. Open the service for obtaining information from the CCCH, verify your passport details, submit the request, and receive the list of bureaus. Without a Gosuslugi account, you can use the Bank of Russia section “How to find out your credit history,” though this requires a credit history subject code.

Obtain bureau addresses from the official state register maintained by the Bank of Russia, as the list changes periodically and search engines may return outdated information. While major players such as NBKI and United Credit Bureau are well-known, you must check every bureau listed in the CCCH response. In each bureau’s personal account, download the report in PDF format. The electronic version is free twice a year, while the paper version is available once.

What to Look for in Your Credit Report

The credit score reduces your entire history to a single number and explains nothing. Protection against fraud comes from other sections that list contracts, applications, and creditor inquiries. These sections show who accessed your history, which contracts remain open, and where delinquencies exist. For every entry, verify the creditor, date, amount, obligation number, and last update date.

An unfamiliar microloan of just a few thousand rubles is not a minor issue, as fraud chains often begin with small amounts. Pay special attention to the inquiries block. If multiple lenders requested your report on the same day without your involvement, change passwords immediately, check Gosuslugi, and activate a self-ban.

What was foundWhat it meansWhat to do
Unknown loan or microloanFraud or errorSave the report, contact the creditor, file a police report
Multiple MFO applications in one daySomeone was shopping for a loanCheck accounts, SIM card, email, enable self-ban
Closed loan still shown as activeCreditor failed to update dataRequest closure certificate and dispute the record
Delinquency that never occurredPayment accounting errorPrepare receipts and request correction
Inquiry from unknown creditorApplication made without your participationCheck all bureaus and change passwords

Self-Ban on Loans: How to Activate It and When It Helps

A self-ban is recommended for anyone who does not intend to take out credit or microloans in the near future. From 1 March 2025, it can be issued via Gosuslugi; from 1 September 2025, also through MFC. After submission, a mark appears in your credit history, and banks and MFOs must reject applications while the ban remains active.

If a lender issues funds despite an active ban, the contract is concluded in violation of the law. The creditor acquires no rights to demand repayment, the borrower is not obliged to return the money, and the record is removed from the history even if the debt has already been sold.

Through Gosuslugi you can choose a full or partial ban. A full ban blocks consumer loans and borrowings from banks and MFOs. A partial ban can be configured more precisely, for example, prohibiting only remote applications while allowing in-person applications at branches. Mortgages, car loans secured by the vehicle, state-supported education loans, suretyship, transactions on already opened cards, and repayment of existing debts are not covered. Existing loans do not need to be closed to activate the self-ban.

The ban takes effect the day after the mark appears in the history, and it can only be lifted on the second calendar day Moscow time. This one- or two-day pause disrupts telephone scams that pressure victims into making “safe” transfers or urgent loans before they change their minds.

Pre-Travel Security Checks

During travel, control over documents and communications weakens. Passport scans may be sent in chats, phones can be lost, and hotel Wi-Fi is often open. The Russian self-ban does not apply to foreign banks, but access to domestic banks, Gosuslugi, and SIM cards remains vulnerable. After intercepting these, fraudsters can operate remotely regardless of your physical location.

Before departure, download your credit reports, activate a self-ban, and enable bank notifications. Verify logins to Gosuslugi, email, and banks. For international travel, confirm that SMS messages arrive in roaming. Review the security section of Gosuslugi for activity history and close unknown sessions. Do not leave passport scans in open chats. Avoid accessing credit bureaus, banks, or Gosuslugi from other people’s devices or unsecured Wi-Fi. If you lose your passport, immediately report it to the police and keep the confirmation. If your phone is lost, block the SIM card and active sessions, then download a fresh report upon return.

What to Do If Fraudsters Have Already Taken Out a Loan

Disputes are won with documents, not phone calls to call centers. The earlier written evidence appears, the stronger your position.

  • Download reports from all your credit bureaus, save the PDFs and screenshots of disputed entries, and note the creditor, contract date, amount, and obligation number.
  • Submit a written statement to the creditor denying the contract and receipt of funds, and request an investigation including signing method, phone number, disbursement details, and IP addresses. If you were in another city that day, attach tickets, bookings, and receipts.
  • File a police report in person at an МВД department, via the agency’s website, or by calling 102 (not 112, which is for emergencies). Keep the notification coupon.
  • Dispute the record through the credit bureau free of charge. The bureau must provide a reasoned response within 20 working days; direct contact with the creditor requires a response within 10 days.
  • If the creditor remains silent, file a complaint via the Bank of Russia internet reception. If enforcement proceedings begin, check the FSSP database of enforcement proceedings.

Note that the FSSP database does not show recent loans and applications; it is useful only after the dispute reaches court or enforcement proceedings.

Paying someone else’s debt “to make them stop” is tempting but almost always harmful. Payment complicates the dispute and may be viewed by the creditor as acknowledgment of the debt. Written statements and persistent correction of the record are far more effective.

Protection Checklist

Credit fraud rarely relies on a single vulnerability; usually several gaps coincide. Therefore, protection depends on consistent habits rather than one-time settings.

  • Check your credit history twice a year at every bureau and additionally after losing a passport, phone, or SIM card.
  • Activate a self-ban if you do not currently need credit.
  • Use different passwords for email, Gosuslugi, banks, and mobile operators, and enable two-factor authentication everywhere it is available.
  • Periodically review the Gosuslugi security section and activity history.
  • Never dictate SMS codes or card details over the phone or send passport photos to unverified chats.
  • Store document copies in a secure location and update bank records immediately after changing your passport.

Related articles

AntiMalwareFraud & Social Engineering

Russians Create Digital Cheat Sheets to Shield Relatives from Online Scams, Kaspersky Lab Study Reveals

A new study by Kaspersky Lab shows that 54% of Russians are actively concerned about their relatives' online safety and are taking concrete steps to protect them from fraud. The primary fear is scammers, cited by 58% of respondents, followed by financial losses at 48%. Instead of simple warnings, 63% now produce detailed digital or physical cheat sheets, with screenshots featuring arrows being the most popular format at 31%. Generation Z leads this trend, with 53% creating such guides compared to 46% of Millennials and 27% of Baby Boomers. The findings come from a 2026 survey of 1,006 residents in major Russian cities, supplemented by data from the International Youth Festival.

HabrFraud & Social Engineering

PhishIntel: Open-Source Python and Go Tool Automates Web Reconnaissance for OSINT Analysts

PhishIntel is a lightweight reconnaissance utility written primarily in Python with performance-critical components in Go. The tool launches via a single command and presents an interactive menu that lets analysts select language and modules. Its core crawler recursively visits a configurable number of pages at a chosen depth and concurrency level, harvesting Russian and US-format phone numbers, emails, cryptocurrency wallets, and physical addresses. Additional modules collect domain metadata including DNS records, RDAP, WHOIS, TLS certificates, redirect chains, and external JavaScript and API endpoints. A limited TCP port scan performed by the Go binary identifies listening services and basic technology fingerprints without replacing full port scanners such as Nmap. Results are exported in both structured JSON and human-readable HTML formats, while an optional .env file allows customization of user agents and proxies.

HabrFraud & Social Engineering

Smart Engines and Intek Deliver Russian Scanners for AI-Powered Document Verification and Fraud Prevention

Smart Engines has partnered with GK Intek to release a line of Russian software-hardware scanner complexes that combine automatic data entry with multi-spectral authenticity checks for passports and other identity documents. The systems support documents from Russia, CIS countries and 235 jurisdictions worldwide, analyzing optical, ultraviolet and infrared images plus RFID chips to detect forgeries including photo swaps and digital edits. Deployments at Genbank and Severgazbank have reduced manual passport entry to fractions of a second while blocking fraudulent documents in real time without sending images outside the organization. The same technology powers border control modules at Sheremetyevo, Vnukovo and Koltsovo airports inside the Sapsan system, cutting passenger processing time to 40 seconds. Additional use cases include automatic pass issuance at transport hubs, electronic signature issuance by the Federal Tax Service and a pharmacy robot in Minsk that verifies age-restricted sales. A newly patented U.S. method detects hidden digital manipulations by analyzing image provenance rather than content, while another patent identifies optically variable devices to spot copies and replicas.

HabrFraud & Social Engineering

Why Isolated Bank Scoring Fails to Prevent Counterparty Default: OSINT Case Study of a Scam Deal

A Russian social entrepreneur lost nearly one million rubles after relying on a major bank's automated compliance system that assigned a green reliability score to a fraudulent supplier. The supplier, registered as a transport company, received 500,000 rubles in targeted government grant funds for IT equipment but delivered only 15,000 rubles worth of goods before disappearing. Retrospective analysis using public Russian registries revealed multiple red flags missed by the isolated scoring algorithm, including mismatched OKVED codes, missing financial statements for three years, and clear ownership links to a bankrupt IT firm. The beneficial owner later faced tax blacklist entry and three-year disqualification after the transport entity was liquidated as inactive. The case demonstrates that single-entity automated checks create a false sense of security by ignoring beneficiary networks and operational logic. Manual verification through official sources such as EGRUL, GIR BO, and arbitration court records proved far more effective at exposing the scheme.