Loading story…
Russia’s Ministry of Digital Development has released its proposed Anti-Fraud 3.0 legislative package for public consultation, seeking to curb fraud enabled by anonymous or stolen-identity mobile accounts. The measures would limit physical SIM registration to direct dealers, prohibit preloaded SIM balances, and require subscribers to execute service agreements before adding funds. Telecom operators would also be required to suspend every number registered to a subscriber when the FSB or Interior Ministry identifies one of their numbers as involved in unlawful activity, while data on people who transfer phone numbers or account credentials to fraudsters would be added to the GIS Antifraud system.
The package would require identifiable bulk-SMS senders, ban automated checks of number activity, and require websites and mobile-app operators to retain registration data for three years. Russian hosting providers would face customer-identification, service-purpose verification, and Roskomnadzor registry-screening requirements, including a one-year prohibition on serving registry-listed operators of tools used to access blocked resources. Proposed provisions also restrict online authentication methods and establish a unified consent-management platform through Gosuslugi; if approved as drafted, the amendments would take effect on March 1, 2028.
See the reporting duties and controls this puts on the clock.
1 event from the most recent confirmed update back to the earliest known activity.
Russia’s Ministry of Digital Development published its third anti-fraud legislative package for public consultation. The proposed measures would tighten SIM-card sales and activation rules, expand GIS Antifraud reporting and suspension powers, impose hosting-provider controls, restrict online authentication methods, and require retention of specified user and telecom-contract data.
See what this changes for your reporting obligations and which controls it puts on the clock.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Russia’s State Duma has passed a law imposing administrative fines on website and mobile application owners that violate the country’s user-authorization rules, including by failing to provide approved domestic login methods for users in Russia. The measure enforces requirements already in force since 2023 and targets operators of online services rather than end users; people are not being fined for signing in with accounts such as Google, Apple ID, or Gmail. Under the rules, services aimed at users in Russia must offer authentication through a Russian mobile number, **Gosuslugi** (`ESIA`), the **Unified Biometric System** (`EBS`), or another Russian-owned information system, with penalties reported at up to **700,000 rubles** for noncompliance. The legislation also broadens liability in adjacent digital-regulation areas. It introduces penalties for violations involving recommendation technologies, including unlawful collection of user preference data and failure to disclose the use of recommendation algorithms, and it raises sanctions for telecom operators that breach obligations to cooperate with law enforcement during operational-search and security activities. Reports indicate the updated framework includes multimillion-ruble fines and turnover-based penalties for repeat offenses, expanding enforcement pressure across Russia’s online platform and telecom sectors.
Jun 29, 2026
The Indian government has introduced new regulations requiring messaging apps such as WhatsApp, Telegram, Signal, and Snapchat to operate only with active SIM cards linked to users’ phone numbers. This move is intended to curb the rising incidents of cyber fraud and misuse, particularly those perpetrated from outside the country using Indian mobile numbers. Under the new rules, web and desktop sessions must automatically log out within six hours, and users will be required to re-verify their accounts frequently. Messaging app providers have 90 days to implement these changes and 120 days to report compliance, as part of an amendment to the 2024 Telecom Cyber Security Rules. The Department of Telecommunications (DoT) stated that the previous ability to maintain long-lived sessions without an active SIM was being exploited for large-scale, cross-border scams, phishing, and other fraudulent activities. By enforcing SIM-binding and frequent re-verification, authorities aim to close this security loophole and make it more difficult for criminals to operate anonymously or from abroad using Indian identifiers. The new measures are a direct response to the increasing sophistication of cybercriminals targeting Indian users through messaging platforms.
Jul 12, 2026
South Korea has announced a new policy requiring facial recognition scans for individuals registering new mobile phone numbers, aiming to curb the widespread use of stolen identities in telecom-related scams. The Ministry of Science and ICT stated that the initiative, which will be implemented by the country's three major mobile carriers and mobile virtual network operators, is designed to prevent criminals from using stolen or fabricated IDs to activate SIM cards. The new requirement will compare the photo on an official identification card with a real-time facial scan, making it significantly harder to register devices under false names. This measure follows a series of high-profile data breaches and a surge in voice phishing scams, with over 21,000 cases reported in 2025 alone. The policy is set to take effect on March 23, following a pilot phase, and will leverage existing digital credential apps such as “PASS” to store and verify biometric data. Recent incidents, including the massive data breach at SK Telecom that exposed SIM card data of nearly 27 million subscribers, have highlighted the vulnerabilities in South Korea’s telecom sector. Authorities have responded with stricter penalties for carriers failing to prevent scams and have imposed significant fines for poor security practices, such as storing credentials in plaintext and lacking basic access controls. The government hopes that the new facial recognition requirement will restore trust and reduce the risk of identity-based telecom fraud.
Jun 29, 2026