Sellers of stolen retail bonuses in Telegram continue to earn on them
Despite the active blocking of Telegram channels selling bonus programs stolen from retailers and marketplaces, this gray business continues to bring income to the attackers. Representatives of the retail believe that it is worth introducing legal responsibility for fraud with bonus programs and points, which are sometimes sophisticated with real money, but in practice it is not easy to implement such norms.
“Kommersant” got acquainted with the study of fraudulent schemes on F6 loyalty programs (previously Group-IB). If in the summer of 2024 experts recorded 72 bot, which traded bonuses and points of 55 different Russian networks (mainly federal) and marketplaces, then by May 2025 their number was almost doubled. About 36 sites continue to work, the rest are blocked by the Telegram administration. However, the main representatives of this market seek to develop business, including through advertising in large Telegram channels. Also, to bypass blocking, attackers are more often disguised as law -abiding services. In addition, money from sales in bots began to be withdrawn more often through legal entities due to tightening the requirements for transfers: earlier for the withdrawal, they more often resorted to the services of individuals-throps.
The average cost of bonuses in such bots is 20-30% of the nominal benefit. That is, for example, 3 thousand virtual points of any retail network can cost from 600 to 1000 real rubles. According to the specialist of the F6 Department of Vera Kolenikova, which they received from the chats of such channels, individual sites can bring to their owners more than 100 thousand real rubles a day from the sale of points. However, it is difficult to evaluate the entire scale of the shadow market, since retailers do not disclose data on possible losses due to the actions of scammers. In 2021, analysts of Inform Prisode estimated the monthly business losses of 2-3 million rubles. monthly (see “Kommersant” dated February 21, 2021).
Attackers receive points in two ways, told in F6. Either the loyalty programs are stolen from hacking personal accounts of users, or generated by interfering with the infrastructure of the retailers network. For the first option, simple password interruptions are still working, leaks or malicious programs are used.
To generate points, attackers in different ways are connected to the server of the retailer loyalty program, for example, through the self -service cash desk.
“The capacity of known attacks reaches 5 million points per hour: so much has accrued on different maps of the attackers of the loyalty program of the retailer, in which one score was equated with one ruble,” the F6 noted.
Since in Russian legislation, points are not equal to money, the attackers who are engaged in theft, actually work in the gray zone, said Andrei Ryumshin, expert on entrepreneurial activity. “But by the accumulation of such points and selling in various channels and other sources under the guise of promotions, promotional codes and special offers on behalf of companies or famous bloggers, they can fall under illegal entrepreneurship,” he says.
According to the press service of Wildberries & Russ, to combat such a scheme, they use a multi-level protection system from fraudsters using AI. On the tightening of punishment in this area, namely, the introduction of administrative or criminal prosecution for the theft of bonuses and points, as one of the methods of combating scammers, says Evgeny Evseeva, a production manager in the antifrod control of the Flowwow marketplace. “E-com market representatives also need to combine efforts in the fight against Frod and strengthen the protection of the Internet business,” she adds. Methods of combating schemes for the theft of bonus rubles and similar elements of loyalty programs should be primarily used by online stores and retailers, and the criminalization of bonus Froda, although possible, is difficult to implement in practice, said Timofey Voronin, Deputy Director of the Central Committee of the NTI Central Committee. In Ozon, X5, “Magnet”, “Auchan”, “Ribbon” and Metro “Kommersant” did not answer.
