Kyiv, October 14, 2025 — The National Police of Ukraine uncovered a major fraud scheme: a woman, while in Poland, used fake DeepFake videos and the BankID / Diia system to take out loans in the names of 286 Ukrainians totaling more than UAH 4 million.
How the scheme worked
According to the investigation, the organizer — a Ukrainian citizen living in Poland — collected personal data (names, identification codes, user photos) from unidentified sources. Then, using this data and authorization via BankID in the Diia app, the fraudsters gained access to users’ bank accounts.
The key technology was the generation of short fake DeepFake videos, onto which the victims’ faces were overlaid in order to pass photo verification. In this way, the fraudsters “became” these people. The money was transferred to controlled bank accounts, then converted into cryptocurrency and cashed out through a network of transfers and exchanges.
The woman acted with the help of her ex-husband and an acquaintance from Mykolaiv, who assisted with the technical side of the scheme.
Scale of the damage
— Number of affected citizens: 286 people
— Total fraud amount: more than UAH 4 million
— Average “loan” per victim: around ~UAH 14,000 (on average)
These figures point not merely to small-scale scams, but to a systematic organized criminal group with technical expertise.
Context and similar cases
- Similar fraud cases involving BankID and Diia have already been recorded before. In December 2024, a Ukrainian woman described how fraudsters took out loans using her Diia account through a hack and BankID authorization.
- A data leak from Diia and the compromise of phone numbers are one of the channels through which fraudsters gain access and begin their attacks.
- Individual cases of loans being registered through Diia have already raised questions about the app’s security.
Why This Is Dangerous
- Misplaced trust assessment
People casually share data or photos, thinking, “Phew, that’s none of my concern.” Meanwhile, fraudsters are already building an entire chain around it. - Technology is becoming more accessible
Deepfake and AI tools can replicate a face, facial expressions, and skin tone — making identity verification more difficult. - BankID / Diia as a vulnerable node
The BankID system is the link between a citizen and a banking / government service. If fraudsters take control of it, they gain access to financial assets and services. - Difficulties with recovery
Even if a person proves it was fraud, getting the money back can be difficult — the funds have already been spread across multiple accounts and cryptocurrency wallets.
How to protect yourself
- Do not give anyone photos + documents + access codes, even “just for a minute.”
- Use two-factor authentication and monitor login notifications.
- Check loan/credit activity with the credit bureau.
- At the slightest suspicion, contact law enforcement and block accounts.
- Change passwords and email, especially in the event of a data leak.
