Fraudsters took money from my card: what to do and how to get it back
Step by step: blocking the card, reporting to the bank and police, NBU rules and the Supreme Court position on when a bank must return the money.
Genuine government payments and aid from the UN, UNICEF or the Red Cross are never arranged through a link from Telegram, Viber or a social media ad, and none of these organisations asks for your CVV, PIN, a code from an SMS or messenger, or a “transfer fee”. If a “payout” comes with a link and a request for card details, a code or a payment, it is a scam. Check government payments in Diia and on websites ending in gov.ua, and international aid on the organisation's own website and hotline.
Every version of this scheme is built the same way. Scammers take a well-known name (the Pension Fund, the Ministry of Social Policy, the UN, UNICEF, the Red Cross, the European Union), attach it to a sensitive topic (pensions, blackouts, displacement, children, holidays) and promise a specific amount. A specific figure and a familiar logo make the message look credible. The person is then led to a website, a form or a chatbot, and that is where the theft happens.
The channels are the same too: Telegram channels and bots with names like “Help from the state”, Viber and WhatsApp mailings, SMS with a short link, Facebook and Instagram ads, calls from “volunteers” or “partners of an international organisation”. Messages often come from accounts with ordinary first names and profile photos to make them feel personal.
Names and amounts change every season, but the storylines repeat. These are schemes that the cyber police, the Interior Ministry, the Ministry of Social Policy, the Centre for Countering Disinformation and the international organisations themselves warned about.
| What was promised | In whose name | What victims were asked for |
|---|---|---|
| “New aid for pensioners” of UAH 3,200 to 5,300 depending on region and work record (May 2026) | The Pension Fund; the Fund denied any such aid | Press a button, “confirm your region”, enter personal and bank details |
| “Mandatory identification of pensioners to keep your pension” (May 2026) | The Pension Fund | Follow a link and enter data on a phishing site |
| “Social payments, your turn has come” (April 2026) | The state, sometimes “UN representatives” | Send “+”, wait for a call and read out four digits of a code received in Viber |
| State or international aid because of power and heating outages (February 2026) | The state, international funds | Enter personal data and card details on a site copying an official one |
| “EnergoPidtrymka from the EU” (February 2026) | Ukrenergo together with the Red Cross | Fill in a form with personal data in Telegram |
| Cash aid and gift kits for children (January 2026) | UNICEF and its partners | Register through social media ads, pay a “registration fee” or “transfer fee” |
| A “special card” for the one-off UAH 6,500 payment (November 2025) | The state | Order a “card to receive the payment” and hand over card details |
The last scheme is telling. A one-off payment of UAH 6,500 really existed in November 2025 for categories set by the government, and the Pension Fund paid it. Scammers used real news and added a made-up step: “get a special card”. No “special” cards are needed for government payments. Government bodies also do not send links through third-party services.
How fast you need to act depends on what exactly you entered or said.
| What you handed over | What a scammer can do |
|---|---|
| Card number, expiry date and CVV | Pay online with your card, link it to their own wallet or service |
| An SMS code “to credit the payout” | Confirm a debit or transfer from your card: such codes confirm a transaction, they never bring money in |
| A code received in Viber, Telegram or WhatsApp | Log into your messenger, send your friends requests to “lend some money until tonight” and new fake “payouts” |
| Online banking login and password, or a BankID sign-in | Transfer money, take out a loan in the banking app |
| Photos of your passport, tax number, phone number | Take out an online loan in your name, use the data in other schemes |
| A “fee”, “insurance payment” or “delivery charge” | Simply take the money; after the first “fee” a second one usually follows |
State aid in Ukraine is arranged through a few official channels: the Diia app and portal, the Pension Fund web portal, social protection offices and administrative service centres (TsNAP). The government and ministries announce new programmes on their websites, whose addresses end in gov.ua. The Interior Ministry advises checking any “new payment” there.
Which state payments really exist for families with children and how to apply is covered in our guide to child benefits.
International organisations do provide cash aid in Ukraine, which is exactly why so many fakes use their names. This is how the organisations themselves describe their rules.
| Organisation | What it states |
|---|---|
| UNHCR | There is no online registration for cash assistance. A CVV code is not needed and registration staff must not ask for it. All services, including cash assistance, are free of charge. Hotline 0800 307 711. |
| UNICEF | Does not register people for aid programmes or hand out humanitarian kits via social networks or messengers. Urges people never to share their CVV, passwords or secret word and not to send a “registration fee” or “transfer fee” to private cards. Hotline of the Spilno programme 0 800 600 017 (free, Mon-Fri 8:00-18:00). |
| United Nations | Charges no fee at any stage of humanitarian assistance and never asks for a CVV. UN organisations may ask for bank details in order to transfer money. |
| Red Cross | On “EnergoPidtrymka from the EU”: the organisation published no such announcements, does not register anyone for this “aid” and informs people only through its official channels. |
This gives a simple dividing line. A genuine programme may ask for your personal details and account number to check your eligibility and send the money. It never asks for codes, CVV, PIN, passwords or money. If any of these appears in a form, do not fill it in.
If the answer to any of these is “yes”, you are looking at a scam, or at least at a very risky situation.
Act within minutes: the faster you move, the better the chance of stopping a debit.
Whether the bank must refund stolen money, who has to prove your fault and how to challenge a refusal is covered in “Fraudsters took money from my card: what to do”. If the “payout” story also involved a call in the bank's name, learn the signs of a fake bank security service: the schemes are often combined.
Fake “pension supplements” and “aid for pensioners” target older people who trust the Pension Fund's name and check website addresses less often. A few agreements remove most of the risk:
Yes, international organisations in Ukraine provide cash aid to certain groups of people. But selection and registration go through their official programmes, partners and hotlines. UNHCR states plainly that there is no online registration for cash assistance, and UNICEF that it does not register people through social networks or messengers. A post or ad with a “leave your card details” form has nothing to do with genuine programmes.
A card number or IBAN is genuinely needed to transfer money, and a real programme may ask for it. The danger is when the number comes with a request for the expiry date, CVV, PIN, an SMS code or a password, or when the form was opened from a link in a message. It is also safer to give the number of a separate card with a small balance.
No, unless that person received this payment themselves and knows where the message came from. Often their account has already been hijacked and the mailing goes out without their knowledge. Call them on a number you know and ask.
If you entered no data, installed no files and shared no codes, most likely nothing happened. Close the page, do not open downloaded files, scan your phone with an antivirus and watch your card transactions for a few days. If you installed an app from the site, delete it and change your banking and email passwords.
To the cyber police via ticket.cyberpolice.gov.ua (cyber police hotline 0800 50 51 70). If an international organisation's name was used, tell its hotline too. You can also report the channel or page through the social network or messenger itself.
This article is for information only and is not financial or investment advice. Check current terms with your bank or financial institution before making decisions.
Spotted a mistake or an outdated figure? Let us know and we will check it against the primary source and fix it.
Write to redaktsiia@wm2.com.ua: what is wrong and, if possible, a source with the correct information. In Gmail or your mail app the page address will already be in the message.