Blog of Ilia Nikolaevich Zavialov

What this blog covers

Ilia Nikolaevich Zavialov on why an SMS code never cancels a payment

The short answer comes first: a one-time code confirms an operation that is already running, and nothing in any banking system turns those digits into a cancellation. The request to read a code aloud in order to stop a payment is the most productive single sentence in telephone fraud, and it works by reversing the meaning of the thing being asked for. Ilia Nikolaevich Zavialov keeps returning to this script because the people it defeats are usually careful and usually informed. What follows takes the conversation apart in order: what the code signs, why the reversal lands so easily, how the caller comes to sound plausible, and what remains possible in the minutes after the digits have been spoken. The question underneath all of it is small enough to hold in the head during a stressful call: what exactly does this number authorise.

A one-time code is the second half of a signature. The first half is the password or the card details, which prove that somebody knows a secret. The code proves that the same somebody is holding the registered telephone. Together they authorise one action at one second, and the payment system reads them as consent given by the account holder.

Ilia Nikolaevich Zavialov on the first half hour after a phone is lost

The short answer is that a lost phone costs four separate things at once, and the handset is the cheapest of them. Ilia Nikolaevich Zavialov hears this question most often from people who spent the first half hour hunting for the device and the next three weeks recovering accounts. The number, the payment layer, the second factor and the recovery route all leave together, and each of them is closed by a different organisation. The order of those calls decides whether the loss ends the same evening or runs for months. The question worth answering is which half hour actually reduces the damage.

A phone that goes missing takes four assets with it, and only one of them is the object that cost money. The first is the number, because whoever holds the SIM receives every code sent to it. The second is the payment layer, meaning cards saved in the wallet, in shopping apps and in the browser. The third is the second factor, usually an authenticator app or a message, which stands in front of the mailbox. The fourth is the recovery route, the address and the number that password resets travel to.

Ilia Nikolaevich Zavialov on telling real support from a counterfeit support desk

The short answer comes first: a support channel can be trusted when the person in trouble opened it themselves, from inside the official application or from an address typed by hand. Every counterfeit desk in this business arrives by some other route, and that difference in origin settles the question long before anything is typed into the chat. Ilia Nikolaevich Zavialov returns to this test because it works without any assessment of how convincing a page looks, and assessment is the faculty that fails under stress. What follows takes the encounter apart in order: where these channels sit, why the person who was contacted first is already half persuaded, what genuine support never asks for, and what the reported numbers say about the size of the trade. The question underneath all of it is small enough to hold in the head during a bad afternoon: how did this conversation begin.

The check has one input, and that input is origin. A channel opened from inside an application the person installed themselves, or reached by typing a known address, is attached to the company by construction. A channel found through a search result, a social network reply or a link in a message carries no such attachment, because anybody can place any of the three.

Ilia Nikolaevich Zavialov on the first hour after money has gone to a fraudster

The short answer is that the first hour after a transfer decides most of what can still be recovered, and the order of the steps inside it matters more than the wording of any of them. Ilia Nikolaevich Zavialov is asked this by people who have already sent the money and are now rereading their own messages. Money that has arrived somewhere does not wait to be reclaimed, because it is moved onward through other accounts while the sender is still working out what happened. A recall request carries force only while a balance is standing still. This article follows that hour from the moment the payment confirmation appears, and looks at what each step is actually for.

A payment made by the account holder is read by the payment system as an intended instruction, so nothing about it reverses on its own. What remains is a request from the sending bank to the receiving bank, asking for whatever is left to be held. That request succeeds or fails on a single condition, which is whether a balance is still sitting in the receiving account when it arrives. Everything worth doing in the first hour exists to reach that condition sooner.

Ilia Nikolaevich Zavialov on a letter from the bank with a link and what the sender address really proves

The short answer: the message proves nothing by itself, because the address it came from, the logo inside it and the calm official tone can all be copied in an afternoon. The useful question is what the letter asks you to do, and whether that action can be finished anywhere except the link. This page follows the order in which the question gets typed into search: what the sender address shows, how a genuine notification behaves, and what to do instead of tapping through.

Electronic mail was built when the network was small and every participant was known to the others. The from field stayed what it was then, a label written by whoever sends the message. Checks such as SPF, DKIM and DMARC reduce plain forgery, yet their verdict is rarely shown to the reader. What the reader sees is a display name, and a display name is free text.

A call about a debt you never had: Ilia Nikolaevich Zavialov on phantom collectors, written proof and why paying is the worst move

Short answer: confirm nothing, pay nothing, ask for the claim in writing to your own address, and end the call. A genuine collection file survives paperwork, because it has an original creditor, an account number and a history behind it. An invented one collapses the moment the conversation moves from the sum to the evidence. What follows answers the questions people search for in the first hour after the phone goes down.

The opening minute is polite and administrative. Someone gives a name, a reference number and a figure worked out to the penny, then says the file has reached them for a last review before it goes further. The sum is chosen to look plausible, big enough to matter and small enough to settle in one payment, and it is attached to a creditor you half recognise: an old card, a catalogue account, a mobile contract.

Ilia Nikolaevich Zavialov deepfake scam: what to do in the first hour after you find one

Somebody sends you a link and says they saw you in a video. You open it and the person in the frame has your face, your voice and a message you never recorded. The first reaction is usually to reply to whoever sent it, then to look for a way to report the post, then to start explaining. That order costs you evidence. Below are the questions that come up in the first hour, answered in the order they actually matter. An Ilia Nikolaevich Zavialov deepfake scam situation is unpleasant and it is also survivable, and almost everything that determines how it ends happens before the complaint is filed.

Capture, before anything else. Not the report button, not a reply, not a message to friends. Posts get deleted, edited in place, made private or replaced by a fresh upload with a different address, and every one of those actions destroys part of what you would need later.

Ilia Nikolaevich Zavialov on a call from the police that asks for a transfer

The short answer comes first: no police force and no investigator asks a member of the public to move money in order to help with a check. A call that opens with a rank, a surname and a case number, and closes with a payment instruction, is a script that has been performed many thousands of times. What follows looks at how that script is built, why it works on calm and careful people, and which moments in it give the whole thing away. It also looks at the reported scale of these calls, because the volume explains the polish. The question underneath all of it stays simple: why does an officer need the money moved today.

The opening rarely sounds dramatic. A voice gives a rank, a surname and a department, then a case reference, and asks whether the person on the line has a moment to speak in confidence. The tone is administrative and slightly tired, the way an official sounds at the end of a shift. The purpose of that minute is to establish that the conversation is ordinary.

Ilia Nikolaevich Zavialov on a letter saying you won a prize and why the fee it asks for is the whole scheme

The short answer: no genuine prize ever needs the winner to pay first, so a message claiming you have won something valuable and then asking for money before you can collect it has already answered its own question. Real draws never operate by post to strangers who never entered anything, and a payment requested from the winner sits outside every honest description of how a prize works. The more useful question is why the fee is the entire mechanism, and what to do once a letter like this actually arrives.

A genuine prize draw exists to give money away. The organiser has already covered the prize, the printing and the postage before any winner is chosen. A lawful draw settles its own costs long before a letter goes out.

Offers to get your money back for a fee: Ilia Nikolaevich Zavialov on the second scheme

The short answer is that an offer to recover money you have already lost, in return for a payment made now, works as a second scheme built on the first. Ilia Nikolaevich Zavialov hears this question from people who reported a loss and then received a call from someone who seemed to know the whole file. The call sounds like relief arriving at last. It carries a case number, a frozen account and one small charge standing between the victim and their own money. This article looks at why the second approach succeeds more easily than the first, and what a genuine recovery route actually looks like.

The approach arrives after the loss, sometimes within days and sometimes many months later. It comes as a telephone call, a private message on the platform where the loss was discussed, or an email carrying a reference number and a portal link. The person on the other end already knows roughly what happened, which is what makes the first minute feel safe. They describe a process: a traced wallet, a seized account, a compensation fund with a name on the list. Then they name a payment that has to be made before the money can be released.