Major on the Line: Inside the Scam Call Center Industry

A billion a month — that's just one national market out of eight

The research network Global Initiative Against Transnational Organized Crime (GI-TOC) analyzed in its report Scammers' Paradise? the fraudulent call center markets in eight countries: Ukraine, Russia, Belarus, Kazakhstan, Kyrgyzstan, Uzbekistan, Georgia, and Armenia. The $1 billion estimate comes from a member of the Verkhovna Rada and refers to the entire Ukrainian market, not an individual operation. This market is highly consolidated: most centers belong to "networks" run by organized criminal groups. According to the United Nations Office on Drugs and Crime (UNODC), the industry is controlled by five groups, each operating at least ten call centers, with the largest identified as "Khimprom" and the Dnipro networks.

Beyond that, the map diverges. Ukraine, Russia, Georgia, and Belarus are countries where call centers are based. Armenia, Kazakhstan, Kyrgyzstan, and Uzbekistan are primarily targets for now, though their own operations are emerging there as well. The report identifies Russia as the main target for scammers across the region, citing the size of its economy and the potential number of victims. A separate finding concerns Belarus: the authors call it the most vulnerable country in the region by losses per capita. 

According to official data from three central banks, losses from scammer activity in 2025 have been significant. Russia lost 29.3 billion rubles, Belarus — 54 million Belarusian rubles (1.46 billion Russian rubles), and Ukraine — 1.4 billion hryvnias (2.45 billion Russian rubles).

Ukraine: A Conflict That Removed Industry Constraints

The expansion of fraudulent call centers began after February 2022, and the report identifies one of its drivers as "patriotic fraud": Ukrainian operators pivoted from the domestic market to Russian victims, while authorities chose not to interfere with such organizations' activities. From their traditional bases in Dnipro and Kyiv, call centers spread across all regions of the country. A large Ukrainian center employs 250–300 staff, comparable in size to a mid-sized regional bank.

Recruitment in Ukraine follows a standard HR funnel. Young people are lured with promises of high earnings, only to discover that base salaries without bonuses are modest, and bonuses are difficult to achieve. Most leave, but "fresh blood" is found quickly enough. Problems also arise for those who prove successful: they aren't allowed to leave, facing pressure and threats. The industry behaves like a normal employer right up until the moment an employee starts caring about their labor rights.

That said, there's no complete impunity in Ukraine—local law enforcement periodically hunts down call centers. Waves of crackdowns have been underway since 2023, when the number of centers was estimated at 1,000–2,000, and after the first campaign the market contracted by roughly a third. In 2025, under Prosecutor General Ruslan Kravchenko, hundreds more were shut down. The report's authors treat these figures cautiously: some raids have turned out to be merely fictitious, and those without protection from security structures were closed first.

What exactly gets shut down is illustrated by an operation in April 2026 in Dnipro. Police dismantled a network operating on a "pseudo-romance plus crypto investment" scheme, detained four Ukrainian organizers, and described the offices as high-security facilities: round-the-clock video surveillance, guards, and staff polygraph checks. The victims were primarily foreigners, including citizens of Kazakhstan and Lithuania.

The report captures the operators' own attitude toward their work in a single remark from a Ukrainian fraudster in correspondence with researchers in December 2025: he wouldn't call it legal, but it's not against the law either. In other words, call centers in Ukraine effectively exist in a gray, semi-legal zone.

Russia: Attacks From Both Domestic and Foreign Sources

The Russian picture is more distorted than the others. According to official information, most fraudulent calls originate from abroad: in December 2024, TASS reported that 80% of phone fraud in Russia originates from Ukraine. 

However, researchers note that beyond the external call centers, Russia has a substantial domestic fraud market that formed well before 2022. Call centers emerged in Russian prisons in the mid-2010s, with hundreds of these "black" centers operating with the tacit approval of Federal Penitentiary Service employees, later expanding beyond prison walls. According to Sberbank, telephone fraud grew by 91% in 2019 alone. The Prosecutor General's Office estimates that social engineering accounts for two-thirds of all telephone and internet fraud. An important nuance here is that most prison call centers are organized locally with the participation of inmates, and media outlets have reported that inmates themselves smuggle in SIM cards and equipment in their mouths.

This "machine" operates across different age groups, with separate "legends" prepared for each. 

The scale of losses depends on the methodology and which organizations are doing the counting. The FSB reported 640,000 cases of remote fraud in 2024 with losses exceeding $2.1 billion. Sberbank estimated losses for the same year at roughly $3.2 billion.

Russia's office-based scam operations are structured similarly to Ukraine's. A former employee described to researchers a call center in central Moscow that operated relatively openly, though with heavy security, in a leased business center. Base salaries ranged from $950 to $2,100 per month, with the potential to earn an equal amount in bonuses from closed deals. The average salary in Moscow in 2025 was around $2,000, meaning the operator's base rate alone didn't amount to much—the real money came from commissions.

It's important to note that the authors of the Scammers' Paradise? report found no evidence in open sources that call centers receive protection from state representatives, a practice that occurs at various levels of government in the neighboring country.

Team Lead in Tbilisi Earns More Than a Bank Branch Director

The most revealing section of the report covers Georgia. In a country with a population of 3 million, the market is small in terms of players, with the number of call centers in Tbilisi estimated at 50-100. A typical center has 5-10 people, while one with fifty seats is considered large. Yet in terms of money, Georgian operations compete with Ukrainian ones.

An experienced manager of a fraudulent call center earns up to $30,000 per month. Experienced operators make up to $20,000. The best performers are given cars as gifts. For comparison: the average salary in the Georgian economy in 2023 was 1,600 lari (about $580). Conversion department employees received 4-5,000 lari ($1,400-1,800), managers earned 10,000 lari ($3,600), while two interviewed retention department employees cited their maximum one-time payouts: 80,000 and 100,000 lari, or $30,000 and $37,000. The most lucrative market was Germany, where victims regularly transferred "deposits" of €20-30,000.

This structure has spawned a separate—albeit criminal—but self-regulating labor market. In Georgia, an employee can move to a competitor without consequences, and the report describes a case where two call centers engaged in a bidding war over one employee, successively raising their salary offers. Meanwhile, recruitment has moved from job sites to personal networks following a series of journalistic investigations, with the typical candidate being a language-proficient student.

Borders Aren't a Risk—They're Part of the Business Model

Sophisticated fraudulent call centers follow the same rule as hackers: "don't work where you live." A Kazakh lawyer articulates the logic without any ethical considerations: scamming people in your own country is foolish, since security services have a direct interest in catching criminals. That's why such fraud is typically transnational—borders create safety from capture. In Georgia, the ban on targeting fellow citizens was explained just as pragmatically: Georgian victims have little money, and operators who speak Georgian are easy to find.

This creates a division of labor where locals are needed, but not for making calls. In Kazakhstan, maintaining SIM boxes that allow foreign operators to call from local numbers pays 20–30 thousand tenge per month, or $50–60. In February 2026 in Kyrgyzstan authorities detained a group selling activated SIM cards and dropper accounts to international fraudsters.

In Russia, the ground-level role is played by droppers. In 2025, according to Interior Ministry data, more than 2 million people were involved in money laundering, while in 2024 about 10 million bank customers transferred money to dropper accounts, with roughly half of the droppers themselves under 23 years old.

These roles connect in such a way that no single channel crosses borders entirely. Advertising and lures go through the internet, calls come from local numbers via SIM boxes, and money flows two ways: cash through couriers and cryptocurrency through chains of wallets.

Courier is a separate profession. The report cites the case of a Novosibirsk resident who traveled 4,000 km to collect 2.32 million rubles from a victim in St. Petersburg. The organizers paid for his travel and hotel and told him to buy a white shirt, trousers, and shoes to look respectable. His fee was 2% of the amount, about $600. He was later arrested, unlike his clients.

Geopolitics is built into this structure as a cost factor. The complete absence of law enforcement cooperation between Russia and Ukraine means that working on Russian victims from Ukraine creates almost no legal risk. Working Western countries is riskier, and the market feels it: after German investigators' operation in Tbilisi, Georgian operators began avoiding that market.

Protection is a line item expense, and it's optimized through relocation

The same major that the scammers impersonate to the victim is also present, in a different sense, on the call center's side. The report examines two models of state protection. The Ukrainian model is described as transactional: regular payments to law enforcement officials for non-interference, while the centers themselves belong to criminal networks. The Georgian model, according to sources, works differently—the state participates directly, while criminals provide informal protection and intermediation. As one interviewee put it: every call center operating in Georgia has a roof.

The Morgan Limited case shows how the Georgian model works in practice. The company was registered in Tbilisi in October 2018, nominally owned by a Ukrainian citizen, and was linked to Milton Group. Investigators established the theft of €5 million from victims in Germany, Slovenia, and Slovakia, with one German transferring €2 million. The financial police raided the office on Otara Chkheidze Street on December 12, 2019, after which the company resumed operations at the same address a few days later and continued working for several more years. The outcome: a plea deal on June 27, 2025—the defendants admitted guilt, received fines, and were released.

In fall 2025, arrests began in Georgia among former associates of Bidzina Ivanishvili. The prosecutor's office announced that the former head of the State Security Service had received bribes from call centers for protection, while the former prime minister received five years under a plea deal. The report's most telling observation relates to January 2026: Georgian operators began relocating their business to Armenia, with one source explaining this by the cost of state overhead at home. In this industry, a roof is calculated not as a risk but as an expense item that can be moved to a cheaper jurisdiction.

30% Fewer Crimes, but Losses Hold Steady

Russian statistics for 2025 look like a success story. The Ministry of Internal Affairs recorded 663,000 IT crimes, down 12% from the previous year; the number of victims decreased by 5.5% to 534,500 people; and losses fell from 205 billion to 189.5 billion rubles. In the first half of 2026, 252,900 such crimes were registered compared to 371,400 a year earlier— a decline by 30%. Rosfinmonitoring reported a 15% decline in the number of droppers alongside a 60% drop in the volume of suspicious transactions involving them.

Another figure tells a different story. The Bank of Russia counted 29.3 billion rubles stolen in 2025, up 6.4% from 2024, while the number of transactions without voluntary consent jumped 31.2%. The more than sixfold gap with the Interior Ministry's estimate comes down to methodology: the Central Bank only sees transfers that passed through banking infrastructure without client consent, whereas the Interior Ministry counts all losses, including loans taken out by victims, cash withdrawals, and cryptocurrency. Little is recovered—banks reimbursed clients 1.7 billion rubles, about 5.9% of what was stolen.

If you divide the losses by the number of crimes, the contradiction disappears. In 2023, the Interior Ministry counted 677,000 IT crimes and 156 billion rubles in losses; in 2024—765,400 crimes and 205 billion rubles.

Average losses per crime have been rising for three consecutive years: 230,000 rubles in 2023, 268,000 in 2024, and 286,000 in 2025. During this period, the number of crimes returned to roughly 2023 levels, while the "average ticket" grew by 24%. Sberbank reported a decline in fraudulent calls from 8–10 million to 5–6 million per day, while Moscow police in October 2025 stated that roughly 80% of cybercrime reports involve losses exceeding 250,000 rubles. Fewer calls, but each one more lucrative.

The Operator Becomes the Bottleneck

The entire structure described—from offices in business centers and retention departments to bidding wars for employees and payments for protection—exists for one reason: to convince a person to part with their money, you still need another person. It's the human element that makes the industry expensive, visible, and vulnerable to law enforcement.

But this reason is gradually disappearing. The report cites research from August 2025 demonstrating that artificial intelligence and language models can successfully execute a fraudulent call at a cost of around one dollar. Deepfakes are already being deployed in real schemes: Georgian operators used video forgeries of a financial advisor, radio host, and television presenter, defrauding approximately 6,000 clients in the United Kingdom. Sberbank Deputy Chairman Stanislav Kuznetsov estimated in June 2026 that Russia's potential losses from deepfakes by year-end could reach 250 billion rubles. That's more than the total damage from IT crimes recorded by the Ministry of Internal Affairs for all of 2025.

In effect, the industry has begun undergoing a transformation, just like the entire global economy thanks to advances in artificial intelligence. And the major who calls you in the evening may soon not be anyone's employee at all, but rather a set of code generated by a neural network.