How to Secure Your Gosuslugi Account Against Hacks and Recover Access After Takeover
Russia's Gosuslugi portal serves as a central hub for official documents, tax notifications, child records, data-sharing consents, and access to numerous other government services. A compromised account can lead to fraudulent applications, altered contacts, unauthorized consents, and even financial risks such as loans taken in the victim's name.
Strengthen Login Protection Beyond a Single Password
Users should always access the portal directly at gosuslugi.ru rather than through links in messages. In the Profile section under Security and Login, enable an additional verification method. Recommended options include TOTP one-time codes from an authenticator app or biometrics, as SMS codes remain vulnerable to SIM swapping. After setup, save backup TOTP codes in a secure location and verify the change by logging out and back in.
The linked phone number also requires protection. Immediately block a lost SIM card with the mobile operator and review active sessions in important services. Regular checks of the Security section help identify unknown logins, devices, or changes.
Review Connected Devices, Consents, and Trusted Contacts
Within Profile and Security, examine recent actions, mobile applications, and granted consents. Remove old phones, unknown devices, and unnecessary permissions. Add a trusted contact who can assist with recovery without gaining account access. Control questions should use answers not available in public data.
The Consents section deserves special attention after any suspicious activity. Review each permission for validity, revoke unknown ones, and keep screenshots as evidence.
Respond to Unexpected Codes or Suspicious Calls
An unsolicited verification code almost always signals an attempted login. Do not reply, click links, or share the code. Instead, manually open the official site, change the password, and audit all sections. Support staff, banks, or police never request codes, passwords, or personal data over the phone to verify an account.
Recover Access and Mitigate Damage After a Breach
If the account is already compromised, first change the password and end foreign sessions if possible. Use the recovery page with passport, INN, or SNILS details, or visit a service center in person. After regaining access, verify all personal data, statements, and consents, then secure the linked email and phone account.
Request a credit report and consider placing a self-ban on consumer loans through Gosuslugi starting March 2025 or MFC from September 2025. The ban covers most credit products but excludes mortgages and certain educational loans, and it cannot be lifted instantly.
Prevent Social Engineering Attacks
Most attacks begin with phone calls claiming urgent issues such as fines, blocked accounts, or suspicious activity. Never share codes or install remote-access software. Always verify requests independently by visiting official websites directly. Store records of suspicious messages for potential reports to the Ministry of Internal Affairs.
Related articles
AI-Powered Drainer Scams Target IT Job Seekers via Malicious Repositories and Fake Recruiters
IT hiring has become a fertile ground for drainer scams that trick candidates into running malicious code under the guise of technical interviews. Scammers pose as recruiters on job platforms, offering roles that require downloading projects from private repositories or installing browser extensions for supposed corporate tools. These attacks often lead to crypto wallet drainers stealing funds, with victims reporting losses around $2000 in documented cases. AI tools are heavily used by attackers to generate realistic job postings, LinkedIn profiles, deepfake videos for calls, and obfuscated malicious code hidden in test assignments. Candidates are advised to inspect package.json, lock files, and CI/CD configurations before any execution and to use AI assistants like Claude for static analysis without running the code. The trend has grown amid mass layoffs and economic uncertainty, turning desperate job searches into opportunities for financial theft.
Marketplace Scraping in 2026: Why Timer-Based IP Rotation Undermines Parsers
Analysis of one full day of telemetry from MobileProxy.Space reveals how marketplace anti-fraud systems detect scrapers through session continuity and rotation patterns rather than IP reputation alone. Over 2 million IP changes were recorded across 8,878 modems, with a median of 95 unique addresses per modem. Timer-driven rotations accounted for 60.2% of all changes, and 92.2% of those intervals were exact multiples of one minute, with a median of 120 seconds. Such rigid periodicity stands out against natural mobile network behavior where address changes occur irregularly due to cell handovers or PDP context resets. The data also shows that 73.1% of address changes complete within five seconds, yet duplicate rotation commands still occur in 0.8% of link-triggered events. The recommended approach ties rotation to parser session state, recreates cookies and TLS profiles on each change, and waits for address confirmation before resuming requests.
Bank Transfer Comments Such as 'Bribe' or 'To the Common Pot' Risk Triggering Compliance Reviews
Lawyer Meri Valishvili warned that casual or joking comments added to bank transfers can prompt automated compliance checks and account restrictions. Systems scan payment descriptions for terms like 'bribe', 'kickback', or 'to the common pot' without assessing humorous intent. No single public list of flagged phrases exists, as each bank independently configures its monitoring algorithms. Even routine descriptions such as 'for manicure' or 'utilities payment' may raise flags when combined with regular amounts or recurring patterns. Valishvili advises private individuals to omit unnecessary comments and to reference specific contract numbers and dates when a transfer has legal significance. For group collections, she recommends using bank-provided tools that clearly state the purpose of the payment.
Scammers Impersonate Social Fund to Threaten Child Benefit Cancellation and Steal Savings
Fraudsters have launched a new social engineering campaign targeting parents by impersonating officials from Russia's Social Fund. Callers claim that suspicious transfers have been detected on family accounts and threaten the cancellation of child benefits unless savings are moved to a special transit account. The scheme relies on fabricated rules about income assessment and uses the promise of an 'unreported' account to trick victims into sending money. The Narodny Front's Moshelovka platform, cited by RIA Novosti, confirms that the Social Fund never requests transfers to third-party accounts for benefit verification. Families are instructed to check official notifications exclusively through Gosuslugi or by visiting an SFR office in person. Authentication codes from government services or banking apps must never be shared over the phone.