Why Isolated Bank Scoring Fails to Prevent Counterparty Default: OSINT Case Study of a Scam Deal
A social entrepreneur operating as an individual entrepreneur (IE) signed a contract in October 2023 for the supply of complex IT equipment worth more than 600,000 rubles, of which 500,000 rubles came from a targeted state grant. The agreement required 100 percent prepayment.
Before transferring the funds, the entrepreneur checked the supplier, conditionally named AvtoTransSnab-90 LLC, through the compliance service of a major bank. The system assigned the counterparty a green marker indicating high reliability. The transaction was approved and payment was sent.
The supplier shipped goods worth only 15,000 rubles as cover, then ceased performance and effectively vanished. While the entrepreneur pursued court proceedings and attempted debt recovery through bailiffs, the Department of Investment Policy demanded return of the grant due to failure to achieve performance targets. To keep the business running, the entrepreneur had to purchase the remaining equipment at personal expense for another 485,000 rubles and repay the grant funds. The net loss for the micro-business reached almost one million rubles. Bailiffs and arbitration courts yielded no results in recovering unjust enrichment.
Four Critical Red Flags Missed by Automated Compliance
The bank algorithm evaluated the company in isolation and at a single point in time. On the query date, AvtoTransSnab-90 LLC was active, had no recent lawsuits, and no open enforcement proceedings. The robot checked formal checklists and approved the deal. Human analysis of the same public data immediately identified stop factors.
- Industry mismatch: The name and primary OKVED code in EGRUL clearly indicated cargo transportation, yet the contract concerned IT equipment supply. A sudden change in operational profile without adding relevant activity codes is a classic risk marker.
- Absence of financial reporting: The state information resource for accounting statements (GIR BO) showed the organization had not filed balance sheets for the three years preceding the transaction. Combined with a minimal charter capital of 10,000 rubles, this pointed to a typical dormant shell company.
- Direct affiliation via FTS registry: The Transparent Business service revealed that a 49 percent co-owner of the supplier was also the 100 percent owner of Computer Campaign LLC, registered at the same address. The second company was an actual IT wholesaler.
- Financial distress of the linked entity: At the time of the deal, Computer Campaign LLC was effectively bankrupt, with tax debts exceeding one million rubles, arbitration claims over five million rubles, and negative net assets of 248,000 rubles.
The beneficial owner had redirected incoming client payments to the clean transport entity to avoid imminent account seizures on the profile IT company.
Two years later, AvtoTransSnab-90 LLC was liquidated by tax authorities as an inactive entity and the debt was written off. The sister IT company was declared bankrupt under a simplified procedure for an absent debtor with budget liabilities exceeding seven million rubles. The beneficial owner was added to the FTS blacklist and disqualified for three years.
The core vulnerability of commercial bank scoring remains its single-entity approach. Automated systems assess a legal entity in a vacuum and ignore the collapse of related businesses owned by the same beneficiary. Basic manual checks against official state databases continue to outperform closed bank compliance algorithms.
Related articles
PhishIntel: Open-Source Python and Go Tool Automates Web Reconnaissance for OSINT Analysts
PhishIntel is a lightweight reconnaissance utility written primarily in Python with performance-critical components in Go. The tool launches via a single command and presents an interactive menu that lets analysts select language and modules. Its core crawler recursively visits a configurable number of pages at a chosen depth and concurrency level, harvesting Russian and US-format phone numbers, emails, cryptocurrency wallets, and physical addresses. Additional modules collect domain metadata including DNS records, RDAP, WHOIS, TLS certificates, redirect chains, and external JavaScript and API endpoints. A limited TCP port scan performed by the Go binary identifies listening services and basic technology fingerprints without replacing full port scanners such as Nmap. Results are exported in both structured JSON and human-readable HTML formats, while an optional .env file allows customization of user agents and proxies.
Smart Engines and Intek Deliver Russian Scanners for AI-Powered Document Verification and Fraud Prevention
Smart Engines has partnered with GK Intek to release a line of Russian software-hardware scanner complexes that combine automatic data entry with multi-spectral authenticity checks for passports and other identity documents. The systems support documents from Russia, CIS countries and 235 jurisdictions worldwide, analyzing optical, ultraviolet and infrared images plus RFID chips to detect forgeries including photo swaps and digital edits. Deployments at Genbank and Severgazbank have reduced manual passport entry to fractions of a second while blocking fraudulent documents in real time without sending images outside the organization. The same technology powers border control modules at Sheremetyevo, Vnukovo and Koltsovo airports inside the Sapsan system, cutting passenger processing time to 40 seconds. Additional use cases include automatic pass issuance at transport hubs, electronic signature issuance by the Federal Tax Service and a pharmacy robot in Minsk that verifies age-restricted sales. A newly patented U.S. method detects hidden digital manipulations by analyzing image provenance rather than content, while another patent identifies optically variable devices to spot copies and replicas.
Avito and BI.ZONE Launch Cyberdetective CTF for Non-Technical Employees Focused on Phishing and Social Engineering
Avito's Security Awareness team, in partnership with BI.ZONE, created the Cyberdetective jeopardy-style CTF competition specifically for non-technical staff who do not write code. The three-day event targeted 104 registered participants, with 44 completing tasks and 16 achieving maximum scores across scenarios involving phishing, OAuth consent abuse, file metadata analysis, and prompt injection. Tasks awarded flags not only for investigation but also for refusing risky actions such as granting excessive application permissions or clicking suspicious links. The design incorporated MITRE ATT&CK techniques including T1566.002 Spearphishing Link, T1528 Steal Application Access Token, and T1204.004 Malicious Copy and Paste. Organizers emphasized indirect hints to help participants recognize when an object required action, avoiding the common barrier where employees fail to understand that a strange string or domain needs examination. Feedback highlighted the value of hands-on decision-making over passive lectures, though some technical employees completed the set rapidly.
Paper Mail Combined with Phishing: Russians Targeted by Fake FNS Tax Portal Copies
Russian scammers have started blending traditional postal mail with digital phishing to steal taxpayer credentials. Victims first receive official-looking paper letters from the Federal Tax Service demanding corrections to tax declarations or supporting expense documents. These letters are followed by emails directing users to a counterfeit version of the FNS personal account portal. The fake site captures login details, passwords, and other authentication data that can be reused for further identity theft and account takeovers. Senator Artem Sheikin highlighted the scheme, noting that the paper letter builds initial trust before the electronic follow-up appears legitimate. Users are advised to access tax information only by manually visiting the official FNS website or through the Gosuslugi platform without clicking any links. The attack relies primarily on psychological manipulation rather than technical sophistication.