Uzbekistan's State Security Service announced on October 15 the arrest of five individuals connected to a fraudulent call center operating in Tashkent's Mirzo-Ulugbek district. The operation combined social engineering techniques common to banking fraud rings with a notable insider component: one of the five detainees was employed in the cybersecurity department of a financial institution.
How the scheme worked
Operators called victims posing as bank employees warning that an unauthorized loan application had been submitted in the victim's name. The social engineering relied on urgency and financial fear, a combination that consistently produces high compliance rates in vishing campaigns targeting banking customers. Once the caller established false trust, victims were guided through steps that allowed the operators to access and drain existing debit card balances. In some cases the operators also opened new credit lines in the victim's name before the victim could act.
Cryptocurrency laundering through a fictitious LLC
Investigators found that proceeds were converted to cryptocurrency and moved through accounts held by a fictitious limited liability company registered specifically to receive and launder funds. The total value laundered through this structure is assessed by investigators at approximately $8 million. The use of a corporate wrapper for cryptocurrency laundering is consistent with financial crime typologies documented by the Financial Action Task Force in the context of CIS-region fraud operations.
The insider threat dimension
The participation of a bank cybersecurity department employee is the most significant element of this case from an insider threat perspective. A person with legitimate access to banking security systems would have visibility into fraud monitoring thresholds, detection logic, and alert patterns: information that would allow a fraud ring to calibrate their activity to avoid triggering automated controls. Uzbekistan's financial institutions should treat this case as a prompt to review access controls for security operations staff, including data loss prevention coverage for internal fraud detection documentation.
Context
Uzbekistan's State Security Service has increased public reporting on cybercrime operations in 2026, following expanded legislative mandates for financial crime enforcement. This case is the first publicly reported instance of an insider threat at a financial institution being directly linked to an active fraud ring in the country. Call center fraud with insider components has been documented in neighboring Kazakhstan, Georgia, and Moldova in similar operational periods.