Sometimes victims of digital fraud have to fight not only with banks, but also with the total inaction of the police. A striking example is the case of a Ukrainian woman who, due to a full-scale invasion, left for Poland, but became a victim of a daring scheme to reissue her SIM card in her homeland.
Sometimes victims of digital fraud have to fight not only with banks, but also with the total inaction of the police. A striking example is the case of a Ukrainian woman who, due to a full-scale invasion, left for Poland, but became a victim of a daring scheme to reissue her SIM card in her homeland.
The dev.ua editorial team examined the materials of the court ruling of the Novobuzky District Court of Mykolaiv Oblast to find out why the cyber police and the local district police department «played football» on the victim’s statement for two months.
The victim of the crime has been permanently residing in Poland since April 2022. In March 2026, she unexpectedly discovered that her financial phone number of the Kyivstar operator stopped working.
As it turned out later, the card had been «released» from the operator and was likely re-registered to another person. Having gained control of the number, the attackers gained full access to the woman’s banking and began intercepting OTP confirmation codes.
In just one day, March 25, 2026, the scammers managed to:
Write off the entire credit limit at the bank (which was previously unused and was fully repaid) in the amount of UAH 36,421.35.
Go to the Kasta+ marketplace and open a credit limit there for another 20,000 UAH.
Submit applications and try to obtain microloans on the ShvydkoGroshy and Moneyveo websites.
The woman immediately contacted the bank with a demand to block the accounts, declare the transactions fraudulent, and initiate a chargeback procedure. But the bank set a strict condition: the debt could only be canceled after providing an official extract from the Unified Register of Pre-Trial Investigations (URDR). And here the most interesting thing began.
On March 27, 2026, the victim filed an online application through a special service of the Cyber Police Department (ticket.cyberpolice.gov.ua). Cyber cops forwarded the materials for investigation to Police Department No. 1 of the Bashtansky Regional Police Department of the Main Police Department in the Mykolaiv region.
There, the application was registered in the Unified Registration system under No. 2220, a precinct officer was appointed, who collected all the screenshots of the bank messages from the victim’s lawyer… and that was the end of the investigation.
Instead of opening criminal proceedings under Part 3 of Article 190 (fraud) and Article 361 of the Criminal Code of Ukraine (unauthorized interference with the operation of information systems) within the 24-hour period stipulated by the Criminal Procedure Code, the police simply stopped the inspection.
Since the applicant is outside Ukraine, it was not possible to interview her in person and «take a written statement.» Therefore, law enforcement officers decided to consider the cybercrime complaint not under the Criminal Procedure Code, but under the regular Law «On Citizens’ Appeals» as a domestic complaint, and quietly closed the case without entering it into the ERDR.
The victim’s lawyer sent an official request to the police, but in response she received a regular letter stating that «the verification has been terminated, the information has not been entered into the ERDR.» By the way, the bank also ignored the 5-day deadline for responding to the lawyer’s request for an official investigation of the incident.
Since the woman continued to have a fraudulent loan due to police inaction and the lack of an extract from the ERDR, the defense filed a complaint with the court.
The investigating judge of the Novobuz District Court found the police actions completely unlawful. The court reminded law enforcement officers of the basic rules of law:
Verification of the presence or absence of a crime should be carried out AFTER entering information into the ERDR through investigative actions, not instead of it.
By-laws of the Ministry of Internal Affairs or the Law «On Citizens' Appeals» cannot replace the Code of Criminal Procedure of Ukraine.
The police had no right to refuse to investigate because the victim was abroad.
Court decision: The lawyer’s complaint was partially satisfied. The court ordered the responsible persons of the Bashtansky RVP to immediately enter information about the crime against the Ukrainian woman into the ERDR under articles on fraud and unauthorized interference in computer networks.
This case once again highlights two critical issues:
Vulnerability of financial number: Schemes to steal Kyivstar SIM cards (especially from prepaid subscribers who are roaming and have not blocked remote card replacement) remain extremely dangerous.
Bureaucratic wall: Banks require victims of cyberattacks to provide a certificate from the ERDR, while regional police units are looking for any excuse (like «you are abroad, we cannot take a signature») so as not to spoil the statistics with «hangings» and not to register complex digital crimes.
Now, after the court ruling, the police are obliged to open a case, and the victim will finally be able to receive an official document to resolve the issue with the credit debt.
