Fraud surrounding the "Gosuslugi" portal became the most discussed topic in Russian social media in the second quarter of 2026. Over three months, users wrote more than 372 thousand times about account hacks, fake notifications, and attempts to gain access to data through the portal, according to a study by Win2Win Communications and Brand Analytics.

Transfers to a "secure account" came in second with almost 140 thousand mentions. This was followed by Telegram scams, calls from banks, and attempts to extract SMS codes. At the same time, the confirmation code is increasingly becoming not a separate scheme, but one of the stages of seizing "Gosuslugi", banking applications, or social media profiles.

Most often, attackers impersonate employees of the Ministry of Internal Affairs and the police – such legends were mentioned more than 122 thousand times. The top five also included VTB, "Gosuslugi" and ESIA, MFC, and Ozon. Instead of the usual "security service", fraudsters use names like "financial monitoring department" or "cybersecurity department" to sound more convincing.

The topic is most actively discussed by users over 55 years old – they accounted for 25.2% of messages. This is followed by audiences aged 35 to 44 and 25 to 34. Men wrote about fraud slightly more often than women – 54.7% versus 45.3%.

Researchers analyzed about 8.8 million publications posted from April 1 to June 30, 2026, on social networks, blogs, forums, video platforms, review sites, and microblogs.