Fraudfare: A Wartime Label Tests the Limits of International Law
In August 2024, a Russian singer sanctioned by the European Union for supporting the invasion announced that she had been defrauded from Ukraine. According to a Lawfare essay syndicated through Apple News, she lost more than a million dollars and her Moscow apartment; the essay reports that the stolen proceeds were allegedly partly donated to the Ukrainian military. The case is reported, not independently verified.
It illustrates what the essay calls fraudfare: cyber-enabled scam campaigns used as a means of war. The essay, by Tymur Mykhailov, presents fraudfare as a reportedly emerging subdomain of hybrid warfare. It is the author’s analytical term, not a statutory offence or treaty category. The essay says financial fraud is economically harmful, illegal and morally wrong, but also that there is no evidence of formal state sponsorship comparable to letters of marque. Its analysis assumes the allegations reflect at least some truth because multiple independent media reports and investigations are cross-referenced. An assumption is not proof.
A label and a reported machinery
The reported detail mostly comes through the Global Initiative Against Transnational Organized Crime, as cited by Lawfare. Call centres in Kyiv and Dnipro allegedly employed hundreds of workers who used social engineering and number spoofing to impersonate the Central Bank of Russia and major banks. Victims were reportedly told their accounts faced unauthorised transactions, then tricked into giving the fraudsters enough information to drain those accounts. The conduct is alleged and second-hand.
The scale figures are second-hand. According to the essay’s account of GITOC, scam calls to Russia rose from about 300,000 per month before the invasion to 8 million per day by February 2024. The apparatus reportedly grew to more than 60,000 employees. An August operation that the essay does not date by year reportedly raided more than 400 locations and closed 94 call centres.
In early September, again without a stated year, the essay says the National Anti-Corruption Bureau raided the Office of the Prosecutor General. Several top prosecutors were charged with creating an organised criminal society, bribery and money laundering. The prosecutor general was dismissed by parliament and fled the country. These are charges and reported events, not findings of guilt.
The figures travel from GITOC through Lawfare to an Apple News syndication. The underlying report was not available, so the numbers remain reported estimates rather than audited statistics. They show political salience, not state direction.
Corruption is not direction
The essay’s legal spine is the difference between private crime, corruption and state responsibility. Under the ICJ’s Nicaragua and Bosnia decisions and Article 8 of the Articles on State Responsibility, a state is responsible for private groups only when it exercises effective control over the specific operation. Financing, training or equipping is not enough; the state must direct or control it. This is stricter than the ICTY’s overall control test in Tadic.
The essay says there is no direct evidence that Ukrainian ministries, security services or other state organs directed or carried out the call centre activity. It says there is no evidence authorities affirmed or approved the centres officially, and no evidence of selective targeting of Russian nationals under Ukrainian direction. Accepting proceeds likely does not create agency or attribution. Mere hesitation to prosecute would not be state ratification.
The essay describes the centres as appearing to be private groups, sometimes morally justified in patriotic terms and covered by corrupt officials. Corruption can explain persistence and justify concern, but it is not state direction. The essay says reports are unclear about the dominant cause of the phenomenon: Russian victims may not complain, law enforcement may be corrupt, or wartime resources may be stretched. Putin’s claim, reported by GITOC, that the centres were state policy does not fill the gap; the essay says such claims likely demonstrate cognitive warfare.
Treaties built for crime, not war
The Budapest Convention requires signatories to criminalise computer-related fraud, defined as causing loss of property through data manipulation or interference with a computer system, with fraudulent or dishonest intent. The UN Convention against Transnational Organized Crime requires parties to ensure that discretionary prosecution powers are exercised to maximise law enforcement effectiveness, with due regard to deterring covered crimes. The UN Cybercrime Convention, not binding when the essay was written, sets a similar due regard framework.
Wartime application is unclear. The draft articles on the effects of armed conflicts on treaties list criminal justice treaties, but commentaries say the intention was to cover international crimes, not ordinary fraud. Ukraine and Russia both ratified the organised crime convention; Ukraine, but not Russia, ratified Budapest. Both address criminal activity, not warfare.
The newer treaty adds a live debate. A UN in Jordan page says the General Assembly adopted it in December 2024, with entry into force 90 days after the 40th ratification. It describes the convention as the first global treaty to criminalise cyber-dependent crimes and offences related to online fraud. Current ratification status is not established in the available material. Adoption is not operation, and a treaty is not a finding about a state.
Due diligence and the wartime gap
The essay examines due diligence under Tallinn Manual 2.0. Rule 6 requires a state not to allow territory or cyber infrastructure under its governmental control to be used for cyber operations affecting other states’ rights. Rule 7 says it should take all feasible measures to end them. The obligation remains unsettled; some states recognise it, while the United States has refrained from taking a side.
Due diligence is a duty of conduct, not result. Fraud on Ukrainian territory does not automatically establish state responsibility. The essay lists counterarguments: preventing all crimes is not feasible; prioritising violent crimes may be reasonable; the fraud is not attributable for lack of control; Russia may be barred by ex injuria jus non oritur, the principle that a wrongdoer should not profit from its own wrong; and due diligence may not apply in wartime the same way. These are arguments, not a ruling.
The factual question remains open. The dominant cause of the phenomenon is unclear, and corruption, resources, absent complaints and the chaos of war could contribute in different proportions. That uncertainty cuts against confident claims about state policy.
When fraud is framed as attack
If IHL applies, the essay says fraudfare operations likely do not qualify as a cyberattack under the Tallinn Manual, which requires injury or death to persons or damage or destruction to objects. Other scholars argue ransomware and spyware should be included despite causing no damage. The category is contested.
If fraudfare were an attack, proportionality would matter. Rule 113 prohibits attacks expected to cause incidental civilian harm excessive in relation to the concrete and direct military advantage anticipated. The essay argues conditionally that widespread harm to ordinary civilians could outweigh the uncertain military advantage of indiscriminate scams, so proportionality would bar the practice except in narrowly tailored operations.
Countermeasures face similar limits. Under the Articles on State Responsibility, they must be directed at the responsible state, proportionate and reversible, attributable to the state rather than private actors, and must not involve force or violate humanitarian law. The essay concludes that toleration of fraudfare would most likely exceed lawful countermeasures. That conclusion depends on treating the fraud as state conduct.
The treaty’s broad offence
The UN in Jordan page presents the cybercrime convention as a cooperative advance and a first global treaty covering online fraud. A Yale Journal of Law & Technology analysis examines Article 13 more critically. It says the provision has two prongs mirroring Budapest Article 8 and a new deception prong covering deception as to factual circumstances through an ICT system that causes a person to act or refrain from acting.
The Yale analysis argues that the offence covers social engineering and romance or investment scams, that a startling range of conduct could fall within the deception prong, and that broad readings could make it practically limitless. It also says civil liberties groups have criticised the latitude given to states with weak human rights protections. It argues that extraterritorial application erodes sovereignty and expands passive personality jurisdiction. These are critical assessments, not findings of state practice.
The views can coexist. A treaty can create useful cooperation tools while carrying overbreadth and sovereignty risks. For fraudfare, the treaty does not resolve the central question. It can make prosecution and evidence-sharing easier; it does not prove state direction or turn private crime into state responsibility.
The unresolved question
The essay ends with a dual conclusion. The facts are not yet clear. Cyber fraud is legally and morally wrong, and Ukraine remains obligated to prevent, investigate and prosecute it. But the essay argues that Russia, as the aggressor, is unlikely to succeed in an international remedy based on harm flowing from the war it initiated, under the principle that a right does not arise from injustice. That is the author’s legal opinion, not a judicial finding.
The singer’s case illustrates the harm, not the legal question. The harder issue is whether fraudfare becomes a durable legal category or remains a diagnostic label. The answer depends less on the scale of losses than on evidence of direction, control and state responsibility, and on whether treaty cooperation can produce that evidence before politics settles the blame.
A label can travel faster than the evidence needed to support it. Fraudfare asks whether a vast scam operation is private crime, tolerated corruption or state-directed warfare, and the essay’s own caveats show how much work sits between those categories. That same discipline, keeping an observed activity separate from the actor and the authority behind it, is useful whenever security claims are made. Cybersecurity fundamentals gives readers a broad base for asking precise questions about systems, identities and defensive responsibilities before more specialist study. Readers who want to build that groundwork can explore The Hack Academy’s online cybersecurity training programme, where cybersecurity fundamentals is a listed subject area, with self-paced learning and practical exercises alongside the theory. It will not decide the fraudfare question, but it makes the next confident claim about who is responsible easier to read.