Fraudfare: Weaponized Fraud Under International Law

The views expressed by the author are their own and do not represent those of any organization with which the author is or was affiliated.

Modern hybrid warfare extends to cyberspace as an auxiliary battlefield, combining cyber operations with kinetic military actions, influence campaigns, and economic disruption measures. Reportedly, it has also created a novel subdomain of cyber-enabled scam campaigns as a means of war: fraudfare. International law has struggled to address frontier issues; this is no exception.

According to the Global Initiative Against Transnational Organized Crime (GITOC),  Ukraine-based scam centers were involved in “patriotic scamming.” Scam calls to Russia reportedly surged from about 300,000 per month before the invasion to 8 million per day by February 2024—an approximately 800-fold increase. The GITOC report quoted President Vladimir Putin, who claimed these call centers had been “elevated to the rank of state policy,” trying to blame Ukrainian authorities. Putin also claimed that “no less than 40 percent” of the illicit proceeds were donated to Ukraine’s armed forces. 

As the GITOC report explains, leveraging patriotic motivation, fraudfare “call centers” grew and flourished in Ukraine, which led Russia to introduce anti-fraud measures. The scheme, however, backfired for Ukraine, as the fraudsters began targeting Ukrainian victims and people in other nations, as the scam apparatus grew to more than 60,000 employees.

After several crackdown attempts in previous years, Ukraine’s law enforcement conducted a large-scale operation in August, raiding over 400 locations and closing 94 call centers. In early September, the National Anti-Corruption Bureau raided the Office of the Prosecutor General, resulting in several top-level prosecutors being charged with creating an organized criminal society, bribery, and money laundering for the scam call centers, while the prosecutor general himself was dismissed by Ukraine’s parliament and fled the country. Ultimately, the parliament passed a law introduced by President Volodymyr Zelenskyy to tighten liability for digital fraud, and hopefully making fraudfare a historical phenomenon.

Can fraudfare—this modern privateering on the high seas of the internet—be justified under international law? Can an aggressor benefit from crime prevention treaty protections for peacetime under international law? Should fraudfare be attributed to Ukraine, if it is confirmed that the corrupt Office of the Prosecutor General orchestrated it? This article attempts to answer these questions. It first defines fraudfare and then examines crime prevention treaty provisions and the “due regard to deter” standard, attribution, the due diligence obligation, and, finally, the applicable framework of international humanitarian law (IHL).

 Important caveats: Financial fraud is a crime and is economically harmful, illegal, and morally wrong. There is no evidence of formal state sponsorship of fraudfare comparable to the 19th-century letters of marque to privateers. However, because of multiple independent cross-referenced media reports and investigations, this analysis proceeds on the working assumption that allegations about fraudfare in Ukraine reflect at least some truth.

What Is Fraudfare?

Most fraudfare schemes involve “call centers,” where rank-and-file scammers utilize social engineering by impersonating banks and government authorities. According to the GITOC, “call centers” in Kyiv and Dnipro have employed hundreds of workers who allegedly contact Russian clients through phone scams designed to obtain financial credentials. Using number-spoofing technology, these scammers reportedly make calls that appear to originate from trusted institutions, such as the Central Bank of Russia or major commercial banks. Victims are allegedly told their accounts face an unauthorized transaction and are urged to provide bank card numbers or authentication codes for protection; the credentials are then reportedly used to drain accounts into networks controlled by the fraudsters.  

Distinguished from fraudfare, comparable international criminal fraud has been documented and prosecuted elsewhere. India-based fraudsters who target elderly victims in the United States overlap with the Ukrainian-based call centers in terms of techniques, relying on social engineering and manipulating institutional trust to induce victims to part with funds, and exploiting the same native-level language proficiency in Russian and English. But these elderly-targeted scams don’t count as fraudfare without the context of armed conflict. 

The case of a prominent Russian singer, whom the European Union sanctioned for her support of the invasion, illustrates fraudfare. The singer announced in August 2024 that she had fallen victim to an elaborate fraud originating from Ukraine, resulting in losses exceeding a million dollars and the loss of her Moscow apartment. The stolen proceeds were allegedly donated, in part, to the Ukrainian military.

Variations of fraudfare become kinetic. The Kremlin considered targeting the fraudsters and waged drone attacks against “call centers.” In 2026, after Starlink terminals were blocked for Russians, they tried to bribe Ukrainian citizens to use their credentials to activate them; Ukrainians countered with a deception and fraud operation, obtaining and targeting the locations of those terminals.

Shall the Aggressor Benefit From the Duty to Prosecute and Duty to Prevent Under Treaties?

As treaty obligations are not ipso facto terminated or suspended in  war, two treaties may apply to fraudfare: the Budapest Convention on Cybercrime and the United Nations Convention Against Transnational Organized Crime (UNTOC). The third, the new long-debated UN Convention against Cybercrime, is also analyzed below.

The Budapest Convention on Cybercrime, among other things, requires signatory states to criminalize computer-related fraud, which it defines as the loss of property to another by input, alteration, deletion, or suppression of data, or by interference with a computer system, committed with fraudulent or dishonest intent. Article 11(2) of the UNTOC provides that each party shall ensure any discretionary legal powers relating to the prosecution are exercised to maximize the effectiveness of law enforcement measures with due regard to the need to deter crimes covered by the UNTOC. The new UN Convention against Cybercrime, though not yet a binding treaty, establishes a similar “due regard to deter” and language framework. 

This obligation is not an absolute duty to deter all crimes but, rather, a balancing test requiring prosecutors to act with due regard to the need to deter crimes and to allocate resources to particular crimes. In international law, “due regard” is a term of art that implicates obligations to act in good faith and reasonably, demonstrating that the relevant interest was taken into account.

Similar to the Budapest Convention on Cybercrime, the UN Convention against Cybercrime obligates each state party to criminalize cyber fraud. The UN convention’s drafters mirrored and expanded on the duty of prevention set forth in Article 31 of the UNTOC, specifying that duty for the context of the digital environment. In a nutshell, both conventions mandate that states maintain best practices and effective policies, cooperate in law enforcement, and reduce opportunities for crime.

All three conventions establish a robust framework for international cooperation, including joint investigations, combating the laundering of illicit proceeds, and confiscation.       

The issue of when these treaties apply in times of war is a frontier issue in international law. Draft articles on the effects of armed conflicts on treaties do not provide a clear answer. The draft articles give an indicative list of treaties that continue to operate during war, including criminal justice treaties. The commentaries, however, clarify that the intention was to include only international crimes—outside the scope of regular fraud.

The UNTOC, ratified by both Ukraine and Russia, and the Budapest Convention, ratified by Ukraine but not Russia, address criminal activity rather than warfare; therefore, the treaties’ nature, context, object, and purpose don’t support their applicability in times of war. Neither the text of these conventions nor their travaux préparatoires, or explanatory materials, foresee how they can be applied during wartime; therefore, the rules of treaty interpretation provided in the Vienna Convention on the Law of Treaties are not helpful.

The Budapest Convention and the UNTOC did not anticipate the complexities of hybrid warfare, which supports the argument that the multiple protections listed above—especially the obligations for procedural assistance for extradition and to cooperate with forensic investigations—cannot be applied to the total war Russia started. Other arguments could be made, for example, that these treaties, either entirely or in part, do not apply because of the change in circumstances or are impossible to perform. 

The most convincing argument, however, is that these treaty obligations may be incompatible with a state’s inherent right to self-defense, as the aggressor shall not benefit from the treaty in question. Ukraine, as a victim of aggression, may be entitled to suspend, in part, the operation of the aforementioned treaties insofar as their investigatory-cooperation obligations are incompatible with the exercise of self-defense. But whether the same is true for Ukraine’s obligations to deter and prosecute conduct related to self-defense and use of force remains a frontier issue in international law. 

Attribution: Can Fraudfare Be Attributed to Ukraine?

A relevant source here is the Tallinn Manual 2.0 on the International Law Applicable to Cyber Operations. Although it is not binding law, the manual outlines rules of customary international law applicable to cyber operations and may be considered a subsidiary means for identifying rules of law, as the teaching of highly qualified publicists under Article 38(1)(d) of the International Court of Justice (ICJ) Statute.

Fraudfare falls under the Tallinn Manual 2.0’s category of a “cyber operation,” which defines such an operation as “the employment of cyber capabilities to achieve objectives in or by the use of cyberspace.” The manual also specifies that cyberspace includes physical, logical, and social layers, and describes social engineering techniques, such as phishing, spear-phishing, and whaling, as belonging to the social layer of cyberspace.

It will be difficult to attribute fraudfare to the state. The ICJ in Military and Paramilitary Activities in and Against Nicaragua, and the Application of the Genocide Convention (Bosnia and Herzegovina v. Serbia and Montenegro), together with Article 8 of the Articles on State Responsibility, provide the relevant attribution framework. Under this framework, a state bears responsibility for the acts of private groups only when it exercises “effective control” over the specific operation in question. This requires more than financing, training, or equipping a non-state group; it requires that the state direct or control the specific operation. 

This standard is stricter than the “overall control” test articulated by the International Criminal Tribunal for the former Yugoslavia in Prosecutor v. Tadić. Under Rule 15 of the manual, “[c]yber operations conducted by organs of a State, or by persons or entities empowered by domestic law to exercise elements of governmental authority, are attributable to the State.” State organs are defined as any persons or entities with the status of an organ under domestic law or that exercise governmental authority. Under Rule 17, the conduct of non-state actors can be attributed to a state when non-state actors “are (a) engaged in pursuant to its instructions or under its direction or control; or (b) the State acknowledges and adopts the operations as its own.” 

Due to the nature of corruption and criminal activities, it is not yet clear how mere nonprosecution or even providing cover by corrupt officials can amount to “overall control,” as no evidence exists of Ukrainian authorities affirming or even approving the call centers, at least in their official capacity, let alone evidence of selective targeting of Russian nationals under the direction of Ukrainian authorities.

Meanwhile, Tadić requires planning and finds financing, training, and equipping insufficient. Accepting proceeds also likely does not create any agency or attribution for the state. The Ukrainian nongovernmental sector de facto has created a broad financial infrastructure to crowdsource the war. Thus, government accounts are unlikely to be involved. While Ukraine is working to improve its anti-money laundering and anti-fraud infrastructure, it is implausible to assume that Ukrainian authorities and banks intentionally enabled fraudfare or other financial crimes. 

In the context of fraudfare, there is no direct evidence that Ukrainian ministries, security services, or other state organs directed or carried out fraudulent call center activity. Mere hesitation to prosecute, even if it exists, would not qualify as state ratification. “Call centers” appear to be private groups engaging in fraudulent activity, sometimes morally justified in patriotic terms, and covered by corrupt officials.

Historically, states refrained from punishing private actors who targeted enemy commerce when such conduct aligned with national war aims, while still suppressing similar acts against neutrals or allies. In Anglo-American law, statutes authorizing the issuance of letters of marque formalized this practice. In the United States, the Constitution still empowers Congress to issue “Letters of Marque and Reprisal.” During the Revolutionary War and the War of 1812, Congress routinely issued such commissions. A privateer was defined as a “vessel owned, equipped, and armed by one or more private individuals, and duly commissioned by a belligerent power to go on cruises and make war upon the enemy, usually by preying on his commerce.” U.S. courts developed doctrines on privateering that shaped both domestic and international maritime law. While Europe abolished privateering through the Declaration of Paris (1856), the United States declined to sign it. Fraudfare departs from these precedents as its actors are uncommissioned civilians rather than formally authorized privateers.

Due Diligence and Prosecutorial Discretion

Does fraudfare violate Ukraine’s due diligence obligation toward Russia? This subsection assumes that such an obligation applies in cyberspace, although the notion remains unsettled: Some states recognize it, while others do not. For example, several European states recognize due diligence for cybercrime, whereas other states, including the U.S., have refrained from taking a side. 

The principle of due diligence, as specified in Rule 6 of the Tallinn Manual 2.0, requires that a “[s]tate must exercise due diligence in not allowing its territory, or cyber infrastructure under its governmental control, to be used for cyber operations that affect the rights … other [s]tates.” Rule 7 further clarifies that a state should “take all measures that are feasible in the circumstances to put an end to cyber operations.” This principle, rooted in sovereignty, draws from classic international jurisprudence such as the Corfu Channel incident, in which the ICJ affirmed that “it is every State’s obligation not to allow knowingly its territory to be used for acts contrary to the rights of other States.”

The formal analysis raises doubts that Ukraine violated its due diligence obligations by allowing fraud targeting Russian nationals to occur. The major counterarguments are that (a) it is not feasible to prevent all crimes, and it may be reasonable to prioritize the investigation of violent crimes over fraud; (b) fraudfare cannot be attributed to Ukraine’s government due to the lack of control; (c) after its military aggression, Russia may be limited in its ability to benefit from the due diligence obligation due to the principle of ex injuria jus non oritur (law or right does not arise from injustice); and (d) the due diligence principle may not apply during wartime the same way, where international humanitarian law and doctrines such as necessity and countermeasures may prevail.

The Due Diligence Obligation Is a Duty of Conduct, Not of Result

Ukraine is not automatically responsible for every fraud scheme, but it must act reasonably and in good faith once aware of such operations. The question in the fraudfare context is whether Ukraine discharged that duty by prosecuting some frauds while deliberately not prosecuting those against Russians, or whether multiple factors contributed to the nonprosecution. 

Media reports are unclear about what dominant factor allowed fraudfare to exist, but multiple factors likely contributed. The environment for fraud, for example, may have occurred because Russian victims simply do not complain to Ukraine’s authorities. It also may have occurred due to corruption in Ukraine’s law enforcement or its wartime resource constraints.

Putin’s claims that the fraud is a “state policy”  likely demonstrate cognitive warfare. Controlling and directing criminal enterprises to enforce selective targeting would have been almost impossible. Also, from the feasibility standpoint, Ukraine’s possible hesitation to prosecute fraud against Russians can in theory be explained by establishing enforcement priorities to prosecute violent and war crimes, even though no evidence exists of such prioritization. Finally, Ukraine’s law enforcement demonstrated at least some due diligence by prosecuting and closing dozens of “call centers” and holding corrupt officials accountable. 

Prosecutorial Discretion

fraudfare could be explained as the establishment of enforcement priorities and the exercise of prosecutorial discretion. Russian and Ukrainian domestic law, unlike in the U.S. and other common law systems, limits prosecutorial discretion because of the principle of legality in law enforcement, which is common in post-Soviet civil law jurisdictions. 

A U.S. prosecutor may, after finding probable cause to believe a person committed a federal crime, consider whether to commence or recommend prosecution or decline prosecution without taking other action. The American prosecutor has discretion to weigh “all relevant consideration,” and federal courts generally cannot compel prosecution.  

A Ukrainian or Russian prosecutor is obligated to start an investigation and bring charges to court after gathering “sufficient evidence.” Ukrainian courts can compel prosecutors to bring a case. Russian and Ukrainian criminal procedural law, however, provide some limited prosecutorial authority to dismiss the charges (Article 340 of the noted Ukrainian code).

International law also recognizes prosecutorial discretion. Under Article 53 of the Rome Statute of the International Criminal Court, the prosecutor may decline to initiate an investigation or to prosecute even when there’s a reasonable basis that a crime was committed. This discretion is structured around three factors: jurisdiction, admissibility, and the interests of justice, which serves as a broader balancing criterion.

In different periods, Ukrainian law enforcement has demonstrated at least some due diligence and due regard to deter, although corruption likely limited their capacity to prosecute.

Why IHL and Countermeasures Do Not Cleanly Justify Fraudfare 

Because fraudfare is a novel issue, it is unclear whether the IHL rules would replace the due diligence principle because of the doctrine of lex specialis: A specific legal rule prevails over a general rule.

As the Tallinn Manual 2.0 acknowledges, this question is not yet settled. IHL rules and other standards for state responsibility, such as the prohibition on attacking civilians, proportionality, and necessity, as well as legal defenses such as countermeasures and self-defense, could at least supersede, if not replace or preempt, the due diligence principle, even though some international law scholars argue that they can be applied concurrently.

First, if IHL rules apply to fraudfare, the cyber operations likely do not qualify as a cyberattack, because the Tallinn Manual defines a cyberattack as involving injury or death to persons or damage or destruction to objects. For example, psychological cyber operations and cyber espionage are not attacks. Other scholars disagree, arguing that ransomware and spyware attacks should be included in the definition, despite causing no damage.

Targeting 

IHL requires parties to distinguish between civilians and combatants and to refrain from attacking civilians. Fraud schemes directed indiscriminately at the general population—through spoofed calls, phishing campaigns, or credential theft—run afoul of the distinction principle if they rise to the level of an “attack.” By contrast, if the operations are targeted narrowly against combatants—fraudfare against the militaries, such as in the case with Starlink—it is justified targeting.

Necessity and Proportionality 

The proportionality principle outlined in Rule 113 prohibits attacks expected to cause incidental civilian harm “which would be excessive in relation to the concrete and direct military advantage anticipated.” If fraudfare is classified as an “attack,” then even if the objective is to degrade Russia’s war economy, the widespread incidental harm to ordinary civilians could easily outweigh the uncertain military advantage gained. In such a scenario, proportionality would bar the practice, overriding any latitude that might otherwise be read into due diligence. Only in narrowly tailored operations, such as depriving sanctioned elites or known military donors of assets, could proportionality plausibly be satisfied.

Pursuant to Rule 72, only a necessary and proportionate use of force involving cyber operations undertaken by a state in self-defense may be justified. Applied to fraudfare, the fact that draining Russian accounts may weaken the adversary does not legitimize the conduct in itself. At best, necessity may explain Ukraine’s reprioritization of law enforcement resources in wartime, but it cannot transform indiscriminate fraud into a lawful measure.

The Law of State Responsibility

Under the Articles on State Responsibility (ARSIWA), countermeasures are a circumstance precluding wrongfulness. They must be directed at the responsible state, proportionate, and reversible. Fraud against Russian civilians, tolerated by nonprosecution, fits poorly within this framework. Countermeasures must be attributable acts of the state, not private actors. More importantly, countermeasures cannot involve the use of force or violate humanitarian law. Thus, even if Ukraine characterized toleration of fraudfare as an economic countermeasure, the indiscriminate civilian harm would most likely exceed the boundaries of lawful countermeasures.

Under the ARSIWA, a state may invoke necessity to preclude the wrongfulness of an act if the act is “the only way for the State to safeguard an essential interest against a grave and imminent peril.” Applied to fraudfare, this narrow defense likely falls short, as nonprosecution of fraudfare would not be the only feasible means. At best, necessity may explain Ukraine’s reprioritization of law enforcement resources in wartime, which, if applied concurrently with the due diligence obligations outlined above, leaves fraudfare in a gray zone of international law due to the possible infeasibility of preventive measures caused by corruption, the reasonable establishment of enforcement priorities to prosecute violent crimes, and other factors outlined above.

Article 51 of the UN Charter recognizes “the inherent right of individual or collective self-defense if an armed attack occurs against a Member of the United Nations.” Recent scholarship argues that the right to self-defense includes not only the use of force but also a broad array of nonforcible measures, which includes, for example, cyber operations and actions of private actors. Pursuant to Rule 72, only a necessary and proportionate use of force involving cyber operations undertaken by a state in the exercise of its right of self-defense may be justified. Even when acting in self-defense, states remain bound by the rules on necessity, proportionality, imminence, and immediacy. 

*          *          *

While the factual details of fraudfare as criminal activity are not yet clear, cyber fraud is both legally and morally wrong, and Ukraine remains obligated to prevent, investigate, and prosecute it. However, even if this selective targeting existed, as the aggressor state, Russia is unlikely to succeed in pursuing an international legal remedy based on harm flowing from the war it initiated: Under the principle ex injuria jus non oritur, together with its treaty-based and customary law analogues, a state should not be permitted to derive a legal advantage from its own wrongful conduct. 

The phenomenon of fraudfare demonstrates that governments and international law cannot tolerate organized cybercrime, even when it is purportedly motivated by patriotism. Hopefully, fraudfare is now stopped, belongs to history, and will not continue.