Deceptive Telegram Channels Exploit Young Families with False Payment Schemes

Company **F6**, a leading developer of technologies for combating cybercrime, has reported a new wave of investment scams using bait in the form of fake news regarding payments to young families, child benefits, and mortgage assistance. These fabricated stories often imitate reports from major Russian media outlets and are disseminated through social-themed Telegram channels. The entire fraudulent scheme, which ultimately leads to the theft of money and personal information, operates solely within the messenger without resorting to third-party resources.

As the new academic year approaches, analysts from F6’s Digital Risk Protection department have uncovered yet another mass scam targeting residents of Russia through fake news. Numerous Telegram channels, featuring titles incorporating the words «benefits,» «payments,» and «privileges,» are actively sharing misleading information among authentic content about social support measures in Russia. These channels boast subscriber counts in the tens of thousands, with some registered with the Roskomnadzor (the Federal Service for Supervision of Communications). The false news predominantly targets parents of minors and other recipients of government support measures.

Examples of such false claims include:

— *“Starting July 30, 2025, a one-time support program from the Russian Social Fund launches—citizens of Russia can receive 16,000 rubles.”*

— *“From August 1, 2025, families will be able to apply for an annual benefit of 35,000 rubles for each child up to 17 years old.”*

— *“The President has instructed to provide support in the form of a certificate worth 1,000,000 rubles for housing for young families and single parents.”*

These misleading news items have been circulating through social networks and Telegram channels since 2024. The sources cited for these false payment announcements point to non-functional websites. Other links within these messages redirect users to Telegram channels engaged in investment fraud. The entire scam, involving the extraction of financial resources and personal data, takes place exclusively within the messenger.

Additionally, subscribers to Telegram channels focused on benefits and payments are offered to complete paid surveys related to childcare satisfaction, vote for the best child nutrition options, and receive refunds for children’s clothing purchases. Links in these messages lead to a Telegram channel centered on remote work, which then redirects users again to channels involved in investment scams.

Some messages directing users to channels associated with investment fraud disguise themselves as content from leading Russian media outlets. A typical headline for such fake news reads: “Russia is shocked by a female investor who pays off her followers’ mortgages and debts every Sunday.”

In December 2024, F6 reported on a network of Telegram channels spreading fakes about pre-New Year payments. Following our publication, a disclaimer stating, “We are not responsible for the publications,” appeared in the descriptions of all the Telegram channels identified by F6 analysts as sharing false information. One of these channels has continued to disseminate misleading content after obtaining registration with Roskomnadzor.

“Scam artists have exploited information related to social support for quite some time. Fake websites offering social payments have been created in the name of both real and fictional agencies. The goal of such campaigns is not to assist citizens but to steal money. This is not the only way the benefits and payments scheme is being utilized. With the rising popularity of messaging apps, cybercriminals have recognized the significant potential traffic generated on these platforms, which can be channeled into fraudulent schemes—exactly what we observe in this instance,” highlights **Evgeny Yegorov**, senior analyst at F6’s Digital Risk Protection department.

Recommendations to avoid falling victim to such fraud include:

— Rely only on verified sources. Information about available social support measures can be confirmed through personal accounts on the «Gosuslugi» portal or by visiting the Multifunctional Centre (MFC) in person.

— Do not click on suspicious links from messages in social networks and messengers.

— Guard your financial information: never share your personal details, bank card information, SMS codes, or passwords, and avoid leaving such information on websites.

— Never transfer money to strangers under any circumstances.

— In any confusing situation, consult with trusted individuals before taking action.