Cashing in on grief: scammers became more active after the terrorist attack at Crocus City Hall

The very next day after the tragedy in the Crocus City Hall near Moscow, Russians began to massively donate money to the families of those killed and injured in the terrorist attack. Along with official collections from registered charities, many advertisements from scammers have appeared on social networks.

As RT found out, “fake” channels for collecting help began to be created in popular instant messengers as early as March 24. They are called the same: “Crocus Fundraising” and the like. Such pages often do not indicate any information about the fundraiser, and when you try to transfer to the specified card number, neither its number nor the owner’s full name are identified.

In a conversation with RT, the head of the Solar Aura external digital threat monitoring service, Alexander Vurasko, stated that high-profile tragedies like the one that happened at Crocus are often used by attackers for their own gain. He warned Russians against communicating with suspicious “suppliers” on social networks and instant messengers.

“The most common scenario in connection with a tragedy is raising money to help the victims. Fundraising advertisements appear online that are outright fake. And here I would recommend transferring money only to verified funds. Under no circumstances should you transfer money to unverified organizations, and especially to the bank accounts of individuals,” warned RT’s interlocutor.

FACCT information security specialists also told RT about the emergence of phishing sites online offering to send donations to the families of those killed and injured in the terrorist attack at Crocus City Hall. One of these resources, in particular, disguises itself as an article in the British edition of The Guardian - the article contains a link that supposedly leads to fundraising. When clicking on it, users are asked to link their crypto wallet for payment - after which money is stolen from it.

Write off debts for $2 thousand.

Fraudsters also work directly with potential victims, sending them messages promising that all loans will be written off for allegedly being included in the list of victims of a terrorist attack. The asking price is $2 thousand (at the current exchange rate - more than 180 thousand rubles). A resident of Novosibirsk, Ruslan Vyachisty, who encountered the attackers, told RT about such a scheme.

Ruslan had already dealt with scammers before - in January 2024, with their “help,” he lost 750 thousand rubles on a brokerage platform. He was never able to return that money.

On March 24, two days after the terrorist attack in Crocus, two people wrote to Ruslan at once - one of them he previously knew from a situation with fraud on the brokerage platform, and he communicated with the second for the first time. Both numbers sent him messages with the same content (spelling and punctuation were preserved).

“I have access to people who are involved in preparing lists. They charge $2,000 to add you to these lists and write off all your loans. Find this amount and we will solve the problem with your loans,” says one of the messages received by Ruslan.

The man did not transfer money to the scammers.

RT found another person who was offered by the same scammers to be included in the list of victims in Crocus and thus have his loans written off. He wished to remain anonymous. In a conversation with him, the attackers quoted the same prices, demanding $2 thousand for the “service.” 

Alexander Vurasko, head of the Solar Aura external digital threat monitoring service, noted that citizens who agreed to pay scammers for “being included in the lists of victims of the tragedy” themselves become accomplices in a fraud case.

“Here you need to immediately understand that, firstly, such advertisements are one hundred percent fake, and secondly, by signing up for something like this, you immediately become an accomplice in a fraud case. This is pure fraud, there are simply no options,” warns Vurasko.

The death of a non-existent friend

The tragedy at Crocus spurred scammers to create fake funds, supposedly to help the victims and families of those killed in the terrorist attack. A blogger from the Amur region under the nickname Prince Yuriel stated on his channel that he allegedly knew one of those killed in the terrorist attack at Crocus City Hall - a certain Dmitry Churilov. With tears in his eyes, the man told his subscribers that he had been friends with Dmitry for a long time, allegedly they played computer games together. 

Further in his video message, Yuriel announced the collection of funds for the family of the deceased. And he asked subscribers to send “at least 50 rubles.”

“Please help to somehow support the relatives and loved ones of those who died,” the blogger concluded.

Then an unexpected turn happened in the story: the “dead” Muscovite Dmitry Churilov turned out to be completely alive and well. He told RT that he was not even at the Picnic concert at Crocus when the terrorist attack occurred there. Moreover, he has no idea who Yuriel is, who “buried” him in his video blog.

Dmitry Churilov learned about his “death” from random people on social networks - they began to send him messages expressing regret about his death. Then Dmitry decided to clarify the situation by telling journalists about the attempted fraud. He also told RT that he wrote a statement to the police.

According to RT, after this Yuriel himself stated on his blog that he was mistaken and apologized to subscribers for disseminating false information. He also assured that the money collected “for the family of the person killed in the terrorist attack” (a little more than 1 thousand rubles) will be used for a real collection.