Russia’s favorite scam The Kremlin’s proposed ‘anti-fraud’ laws mean fewer freedoms, more surveillance, and a free pass to hack its enemies
In Russia, the fight against “fraudsters” has become a favorite pretext for tightening digital legislation. Some of the new measures are genuinely aimed at cybercrime, but others appear designed to expand the state’s repressive machinery. After banning voice and video calls on Telegram and WhatsApp — cutting millions of Russians off from their go-to channels of communication — the government is preparing another wave of restrictions. Now, the Digital Development Ministry has unveiled a new package of bills supposedly targeting phone and Internet fraud. Meduza examines some of the proposals — from new restrictions on citizens to carve-outs that allow targeting the state’s enemies.
A centralized database of all mobile phone identifiers
Proposed new amendments to Russia’s federal law “On communications” provide for the creation of a unified database of mobile device identifiers:
Database of end-user device identifiers — an information system maintained by a mobile telecommunications operator that contains data on the identifiers of end-user devices, as recorded when registering a subscriber’s device for mobile telecommunications services;
Central database of end-user device identifiers — an information system containing data from the identifier databases maintained by mobile telecommunications operators, as well as information on which end-user devices are authorized or prohibited for use in mobile telecommunications networks within the Russian Federation.
The identifiers in question are most likely IMEIs (International Mobile Equipment Identity numbers). Each telecom operator will compile its own database and transfer the information to the central system. The centralized database will be administered by Russia’s federal censorship agency, Roskomnadzor, which will act on behalf of the state as the official holder of the information.
Some identifiers will be blacklisted for use in Russia.The Federal Security Service (FSB) will decide on such bans and, together with Roskomnadzor, will draft the procedures for how those decisions are made.
Foreigners who swap SIM cards into another phone could get their carrier fined
Since January 1, 2025, when a foreign national signs a contract with a Russian mobile carrier, the document must include details about the user’s device, including its identifier.
The Digital Development Ministry has proposed fines for carriers that conclude contracts without this information or provide service to foreigners who insert their SIM cards into different phones. This violation will be added to the already lengthy Article 13.29 of the Administrative Code.
Fines for improper contracts will range from 300,000 to 500,000 rubles (about $3,600 to $7,200) for companies, and from 30,000 to 50,000 rubles (about $360 to $600) for individuals and officials. The same penalties would apply if carriers continue providing service after a SIM card swap.
A repeat violation of either ban could result in criminal charges for an official — but only if the offense causes damages exceeding five million rubles ($60,300). A new provision in the Criminal Code, Article 200.8, titled “Violation of requirements for providing mobile telecommunications services to a foreign national or stateless person by an individual previously subjected to administrative punishment,” allows for prison terms of up to one year.
New fines for issuing SIM cards above the legal limit
Starting November 1, Russian citizens will be limited to 20 SIM cards each, while foreigners remain capped at 10. The Digital Development Ministry is proposing fines for carriers that issue more than the allowed number.
Providing SIM cards beyond the cap — unless the actions “contain elements of a criminal offense” — would be treated as an administrative (misdemeanor) violation. Companies could face fines ranging from 300,000 to 500,000 rubles (about $3,600 to $7,200), while officials would be fined between 30,000 and 50,000 rubles (about $360 to $600).
New criminal penalties for cyber extortion and system attacks
The Digital Development Ministry plans to add a new article to the Criminal Code, 163.1, titled “Extortion in the sphere of information and telecommunications technologies.” It’s aimed primarily at groups that use ransomware — malicious software that infiltrates victims’ systems, encrypts their data, and then demands payment for decryption. The provision would also cover prolonged DDoS attacks if attackers demand money in exchange for stopping them.
Extortion that involves “inserting, destroying, blocking, or altering computer data” — or otherwise deliberately interfering with information systems or networks — could be punished with up to 15 years in prison and a fine of five million rubles ($60,300), or the equivalent of five years’ salary. The maximum penalty would apply only to members of organized groups or in cases where the ransom exceeds one million rubles ($12,000). Even in less severe cases, however, offenders could still face up to five years in prison and a fine of 500,000 rubles ($7,200), or one year’s salary.
A separate article covers attacks without extortion. Article 272.2, “Malicious interference with an information system, telecommunication network, computer data, or communications network,” would criminalize deliberate actions involving the blocking or destruction of computer data if they cause damages exceeding 250,000 rubles ($3,000) or result in serious consequences. Violators could face up to eight years in prison and fines of two million rubles ($24,100), or three years’ salary.
But hacking Meduza will be legal
One of the most striking provisions would effectively legalize certain types of hacking. The Digital Development Ministry proposes exempting hackers from liability if their attacks target websites already banned or restricted in Russia. In practice, this could mean protection for cyberattacks on outlets like Meduza or other media designated as “undesirable organizations” or “foreign agents.”
The text states: “A person shall not be held criminally liable under this article if their actions are directed against information resources on the Internet whose access is prohibited or restricted under Russian law.”
Our only hope is you. Support Meduza before it’s too late.
Cryptocurrency will be considered property and can be confiscated
In Russia’s Criminal Code, under Article 104.1 “Confiscation of property,” cryptocurrency will now be classified as property — meaning it can be seized and confiscated.
The Criminal Procedure Code will also be amended to set out procedures for seizing digital currency. These rules will apply to both “hot wallets” (such as mobile apps or web-based wallets) and offline “cold wallets” (dedicated devices or even seed phrases written on paper).
Investigators will be able, at their discretion, to confiscate a hardware wallet containing cryptocurrency, transfer seized funds to a government-controlled wallet, or do both. The government will be tasked with establishing the procedure for transferring funds “to an address identifier that ensures the safekeeping of seized digital currency.”
Text by Denis Dmitriev