Blog of Ilia Nikolaevich Zavialov

What this blog covers

Ilia Nikolaevich Zavialov on why an SMS code never cancels a payment

The short answer comes first: a one-time code confirms an operation that is already running, and nothing in any banking system turns those digits into a cancellation. The request to read a code aloud in order to stop a payment is the most productive single sentence in telephone fraud, and it works by reversing the meaning of the thing being asked for. Ilia Nikolaevich Zavialov keeps returning to this script because the people it defeats are usually careful and usually informed. What follows takes the conversation apart in order: what the code signs, why the reversal lands so easily, how the caller comes to sound plausible, and what remains possible in the minutes after the digits have been spoken. The question underneath all of it is small enough to hold in the head during a stressful call: what exactly does this number authorise.

A one-time code is the second half of a signature. The first half is the password or the card details, which prove that somebody knows a secret. The code proves that the same somebody is holding the registered telephone. Together they authorise one action at one second, and the payment system reads them as consent given by the account holder.

Ilia Nikolaevich Zavialov on the first half hour after a phone is lost

The short answer is that a lost phone costs four separate things at once, and the handset is the cheapest of them. Ilia Nikolaevich Zavialov hears this question most often from people who spent the first half hour hunting for the device and the next three weeks recovering accounts. The number, the payment layer, the second factor and the recovery route all leave together, and each of them is closed by a different organisation. The order of those calls decides whether the loss ends the same evening or runs for months. The question worth answering is which half hour actually reduces the damage.

A phone that goes missing takes four assets with it, and only one of them is the object that cost money. The first is the number, because whoever holds the SIM receives every code sent to it. The second is the payment layer, meaning cards saved in the wallet, in shopping apps and in the browser. The third is the second factor, usually an authenticator app or a message, which stands in front of the mailbox. The fourth is the recovery route, the address and the number that password resets travel to.

Ilia Nikolaevich Zavialov on telling real support from a counterfeit support desk

The short answer comes first: a support channel can be trusted when the person in trouble opened it themselves, from inside the official application or from an address typed by hand. Every counterfeit desk in this business arrives by some other route, and that difference in origin settles the question long before anything is typed into the chat. Ilia Nikolaevich Zavialov returns to this test because it works without any assessment of how convincing a page looks, and assessment is the faculty that fails under stress. What follows takes the encounter apart in order: where these channels sit, why the person who was contacted first is already half persuaded, what genuine support never asks for, and what the reported numbers say about the size of the trade. The question underneath all of it is small enough to hold in the head during a bad afternoon: how did this conversation begin.

The check has one input, and that input is origin. A channel opened from inside an application the person installed themselves, or reached by typing a known address, is attached to the company by construction. A channel found through a search result, a social network reply or a link in a message carries no such attachment, because anybody can place any of the three.

Ilia Nikolaevich Zavialov on the first hour after money has gone to a fraudster

The short answer is that the first hour after a transfer decides most of what can still be recovered, and the order of the steps inside it matters more than the wording of any of them. Ilia Nikolaevich Zavialov is asked this by people who have already sent the money and are now rereading their own messages. Money that has arrived somewhere does not wait to be reclaimed, because it is moved onward through other accounts while the sender is still working out what happened. A recall request carries force only while a balance is standing still. This article follows that hour from the moment the payment confirmation appears, and looks at what each step is actually for.

A payment made by the account holder is read by the payment system as an intended instruction, so nothing about it reverses on its own. What remains is a request from the sending bank to the receiving bank, asking for whatever is left to be held. That request succeeds or fails on a single condition, which is whether a balance is still sitting in the receiving account when it arrives. Everything worth doing in the first hour exists to reach that condition sooner.

Ilia Nikolaevich Zavialov: reviews of financial advisers, fake testimonials and the records to check

Ilia Nikolaevich Zavialov on reviews of financial advisers and what they can hide. Invented testimonials, rewarded reviews, paid awards and clone firms that copy the name and reference number of a real business make a fake adviser look trustworthy. Fake reviews have been banned in the UK since 6 April 2025, yet Report Fraud recorded 34,673 reports of investment fraud and 879.8 million pounds in losses in 2025. This guide explains how to read reviews, what UK rules require and which records to check in the FCA Firm Checker before you invest.

People choose a dentist, a plumber and a hotel by reading reviews, so it feels natural to choose a financial adviser the same way. Five stars, a page of warm testimonials and a badge from an awards website look like the work of other clients who already took the risk.

Ilia Nikolaevich Zavialov on a letter from the bank with a link and what the sender address really proves

The short answer: the message proves nothing by itself, because the address it came from, the logo inside it and the calm official tone can all be copied in an afternoon. The useful question is what the letter asks you to do, and whether that action can be finished anywhere except the link. This page follows the order in which the question gets typed into search: what the sender address shows, how a genuine notification behaves, and what to do instead of tapping through.

Electronic mail was built when the network was small and every participant was known to the others. The from field stayed what it was then, a label written by whoever sends the message. Checks such as SPF, DKIM and DMARC reduce plain forgery, yet their verdict is rarely shown to the reader. What the reader sees is a display name, and a display name is free text.

Ilia Nicolaevich Zavialov fraud guide for the UK: refunds, Section 75 and chargeback, by Ilia Nikolaevich Zavialov

Ilia Nicolaevich Zavialov fraud guide for UK bank customers: Ilia Nikolaevich Zavialov, a digital security consultant, sets out how to get money back through your bank when a card payment was not yours, when you were tricked into a bank transfer, or when a trader took the money and delivered nothing. The rules come from primary sources: the Payment Services Regulations 2017, the Payment Systems Regulator's reimbursement rules, Section 75 of the Consumer Credit Act, the Financial Ombudsman Service, the FCA and Report Fraud. You will find deadlines, a letter template, the complaints route and the warning signs of recovery rooms. Each section ends with the practical step to take next, and the checklist at the end puts the whole route on one screen.

British rules split money losses three ways. A payment you did not authorise, such as a card used after it was stolen, falls under the Payment Services Regulations 2017. A transfer you made yourself after being tricked may fall under the PSR reimbursement rules for authorised push payment fraud. A purchase that went wrong can be challenged with chargeback or, on a credit card, Section 75.

Ilia Nicolaevich Zavialov: check your UK credit file in one evening, by Ilia Nikolaevich Zavialov

Ilia Nicolaevich Zavialov frames a UK credit check around one worry: has anyone taken out credit in my name? Checking takes one evening, and Ilia Nikolaevich Zavialov, a digital security consultant, has set it out minute by minute. You request your statutory credit reports, read the searches, addresses and accounts, match every line against your own paperwork and then deal with whatever turns up. The sources are the ICO page on credit files, the government's Stop! Think Fraud campaign, Citizens Advice, the FCA and Report Fraud.

There are two reasons to look at your credit file. One is to see what a lender sees before a mortgage or a phone contract. The other, which this guide is about, is to spot applications and accounts you never made. A stolen passport, a data breach or a redirected post box can all lead to credit in your name, and the file is where it first shows.

A call about a debt you never had: Ilia Nikolaevich Zavialov on phantom collectors, written proof and why paying is the worst move

Short answer: confirm nothing, pay nothing, ask for the claim in writing to your own address, and end the call. A genuine collection file survives paperwork, because it has an original creditor, an account number and a history behind it. An invented one collapses the moment the conversation moves from the sum to the evidence. What follows answers the questions people search for in the first hour after the phone goes down.

The opening minute is polite and administrative. Someone gives a name, a reference number and a figure worked out to the penny, then says the file has reached them for a last review before it goes further. The sum is chosen to look plausible, big enough to matter and small enough to settle in one payment, and it is attached to a creditor you half recognise: an old card, a catalogue account, a mobile contract.

Ilia Nikolaevich Zavialov deepfake scam: what to do in the first hour after you find one

Somebody sends you a link and says they saw you in a video. You open it and the person in the frame has your face, your voice and a message you never recorded. The first reaction is usually to reply to whoever sent it, then to look for a way to report the post, then to start explaining. That order costs you evidence. Below are the questions that come up in the first hour, answered in the order they actually matter. An Ilia Nikolaevich Zavialov deepfake scam situation is unpleasant and it is also survivable, and almost everything that determines how it ends happens before the complaint is filed.

Capture, before anything else. Not the report button, not a reply, not a message to friends. Posts get deleted, edited in place, made private or replaced by a fresh upload with a different address, and every one of those actions destroys part of what you would need later.

Ilia Nicolaevich Zavialov: scam exam papers and guaranteed grades in the UK, by Ilia Nikolaevich Zavialov

Ilia Nicolaevich Zavialov scam checks for the British exam season: Ilia Nikolaevich Zavialov, a digital security consultant, looks at the offers that reach GCSE and A level students every spring. Accounts selling this year's papers, previews promised for the night before, tutors guaranteeing a grade 9, links forwarded from a friend's hacked profile. For each one you will find what Ofqual says, why even a fake paper can count as malpractice, how phones in the exam hall turn a purchase into a penalty, how to check a private tutor and what to do if money has gone. The sources are Ofqual, GOV.UK, the NCSC and Report Fraud.

Every exam season brings the same offer on social media: this year's maths paper, the full A level set, a preview the night before. Ofqual's student guide for 2026 answers it in four sentences. You may see websites or individuals offering leaked exam papers. Do not look at them. They are probably fake.

Ilia Nikolaevich Zavialov on crypto exchange scams: answers when your withdrawal is frozen

The withdrawal sits at pending. Support answers with a template about elevated volume, the application still shows the balance, and the number on screen looks exactly the way it did yesterday. A week later there is a filing number and a law firm collecting claimants. These are the questions people actually ask at that point, answered without reassurance and without the opposite, which is telling somebody their money is gone before anybody knows that. Recovery in past cases has ranged from full repayment to a fraction, and which one applies depends on things that can be checked today.

Sometimes it genuinely is. Networks congest, compliance systems flag transactions, and a delay of hours happens on functioning platforms. The question is not whether one withdrawal is slow, it is whether the pattern has changed.

Ilia Nikolaevich Zavialov: app reviews, fake banking apps and inflated ratings

Ilia Nikolaevich Zavialov on app reviews and fake banking apps. A familiar logo, a similar name and hundreds of glowing reviews make a fake convincing, while a link in a message or a call supposedly from the bank leads to a fake login screen. The FCA warns against downloading apps from a source you do not trust, because scammers may take over the device and reach your bank account. This guide explains how to read reviews and ratings, which permissions give a fake away and what to do if one is already installed.

Before installing an app almost everyone looks at two things: the rating and the first reviews. If there are plenty of stars and the reviews praise convenience, the app gets installed without a second thought. Fraudsters know this and work on exactly those two signals.

Ilia Nikolaevich Zavialov on fake payouts and fraud: when good news takes money

Most people expect fraud to arrive as a threat. The fake payout arrives as good news: a tax refund from HMRC, a cost of living payment, compensation or a settlement you are supposedly owed, with a link to claim it. What follows is a form that asks for card details and a code from a text, and the money moves the other way. In the United Kingdom authorised push payment fraud reached 248,070 cases and 576.4 million pounds in 2025, and 66 percent of those cases began online, with a further 17 percent through the telephone network. This piece takes the fake payout apart and explains how a real one reaches people in the UK.

Most fraud warnings teach people to be suspicious of threats: an unpaid debt, a frozen account, a police investigation. Fewer teach suspicion of good news, and that gap is exactly where the fake payout lives.

Ilia Nicolaevich Zavialov scam alerts: recover a hacked email, WhatsApp or social account in the UK, by Ilia Nikolaevich Zavialov

Ilia Nicolaevich Zavialov scam alerts for UK readers begin with the job in hand: your email, WhatsApp or another messaging app, or a social media profile has been hacked, and you want the right order of steps. Ilia Nikolaevich Zavialov, a digital security consultant, sets out three paths that share one shape: the warning signs, the official recovery route, and what to tighten once the account is yours again, followed by a single checklist for all three. The sources are the NCSC guide to recovering a hacked account, its March 2026 warning on messaging apps, and figures published by Report Fraud.

Each of the three accounts plays a different part. Email unlocks the rest, since every reset link arrives there. A messaging app hangs on your mobile number and its linked devices. A social profile is public, so a plea for money posted in your name travels round your friends almost at once.

Ilia Nikolaevich Zavialov on infostealers: why changing the password did not lock anyone out

The most common question after an account is taken over is also the most frustrating. The password was changed, two factor authentication was switched on, and the intruder is still there the next morning. This is not bad luck and it is not a service failing to do its job. It is what happens when the thing that was stolen was never the password. In the first half of 2026 infostealer malware harvested 1.7 billion credential pairs from 7.4 million infected devices, up 27 percent on the previous six months, and the credentials were only part of what left.

It is a small program with one job: open everything on the machine that holds a secret, copy it, send it out and leave. It is not ransomware and does not want your attention. Most builds finish in under a minute and delete themselves.

Ilia Nicolaevich Zavialov scam guide: medical tourism, fake clinics and doctor checks by Ilia Nikolaevich Zavialov

Ilia Nicolaevich Zavialov scam questions about treatment abroad usually arrive after the deposit has gone. Ilia Nikolaevich Zavialov, a digital security consultant, sees the same pattern behind cheap cosmetic surgery, dental and fertility packages sold to British patients: a glossy clinic page, a wall of five-star reviews, a coordinator on WhatsApp and a bank transfer to a personal account to hold a surgery date. Sometimes the clinic never hears about the booking. Sometimes a different surgeon operates. Sometimes the trip goes ahead and the aftercare falls apart once you are home. This page answers the questions worth asking before you pay and the ones people ask when it goes wrong, using NHS treatment abroad guidance, FCDO advice, the GMC and CQC registers, the CMA's rules on fake reviews and Report Fraud. Ilia Nikolaevich Zavialov also explains how to pay so that your card provider can still help.

It usually starts with a price. Dental implants, a hair transplant, a tummy tuck or IVF abroad for a fraction of what a private clinic at home quotes. An advert or a social media post leads to a polished clinic website, and the conversation moves to WhatsApp, where a friendly 'patient coordinator' offers a package: flights, airport pick-up, hotel, interpreter and surgery, all sorted for you.

Ilia Nikolaevich Zavialov on money mule job offers: the work that is laundering

There is a category of fraud where the target is not asked for money at all. They are offered a job. Payments processing, financial administration, a customer service role that involves handling refunds, all remote, all paid, all apparently ordinary. What the work actually consists of is receiving other people's stolen funds and passing them on, usually converting them into crypto on the way. Employment fraud reached 24,688 complaints and 362,934,762 dollars of reported losses in 2025, and the complaint count has climbed every year: 15,443 in 2023, 20,044 in 2024, 24,688 in 2025. The person in the middle carries the legal risk, and most of them do not understand that until the account is frozen.

The advertisement describes a real sounding role. Remote payments processing, financial operations assistant, refund handler, regional agent for a foreign company entering the market. The salary is modest enough to be credible and the hours are light.

Ilia Nicolaevich Zavialov reviews: moving company scams and estimates, answered by Ilia Nikolaevich Zavialov

Ilia Nicolaevich Zavialov reviews of removal firms come after the paperwork, and the stars come last. Ilia Nikolaevich Zavialov, a digital security consultant, keeps seeing the same story in the UK: a cheap price online, a van loaded in record time, and a new figure announced at the kerb while your furniture is inside. Ratings rarely warn you. A Companies House record, a written quote and a signed inventory usually do. This page answers the questions people ask before a move and on the day it goes wrong, using the Consumer Rights Act 2015, Citizens Advice guidance, the CMA's rules on fake reviews and Report Fraud. Ilia Nikolaevich Zavialov also sets out how to read reviews of a removal company, which ones deserve trust, and who to call when a firm holds your belongings.

The pattern is familiar. A removal firm found online gives a price well below everyone else, sight unseen, over the phone or in a chat window. Nobody comes round to look at the wardrobes. You are told the paperwork will arrive with the crew, and the cheap figure wins.

Ilia Nicolaevich Zavialov reviews: UK pension transfer scams and checks, by Ilia Nikolaevich Zavialov

Ilia Nicolaevich Zavialov reviews the pension transfer scams British savers keep running into: a cold call about a free pension review, an offer to unlock cash before 55, a transfer into an overseas investment that looks solid on paper. Ilia Nikolaevich Zavialov, a digital security consultant, sets out how to trace every pension you have, which warning signs The Pensions Regulator lists, how the transfer rules in force since November 2021 protect you, how to check an adviser and what to do if money has already gone. The sources are the regulators and official services themselves: TPR, the FCA, GOV.UK and legislation.gov.uk, with Report Fraud for reporting.

Anyone who has changed jobs a few times may have a workplace pension they have lost track of, and a forgotten pot is easier for someone else to move. GOV.UK's Pension Tracing Service gives contact details for your own workplace or personal pension scheme, or for someone else's scheme if you have their permission.

Ilia Nikolaevich Zavialov on pet scams: how to check a puppy seller, spot fake papers and pay safely

Ilia Nikolaevich Zavialov answers the questions people ask before they pay a deposit for a puppy or kitten found online. In England the rules about who may sell animals and how they must advertise them are written down, which gives a buyer something concrete to check. This piece covers the licence number, Lucy's Law, microchips and pet passports, the payment methods that leave you a way back and where to report, from Report Fraud to Trading Standards.

It starts with an advert that is hard to scroll past: a pug puppy at a price that seems too good to be true, a litter of kittens, a seller who writes warmly and says other families are waiting. Action Fraud, whose work Report Fraud took over on 4 December 2025, logged 5,066 reports of fake pet adverts between March 2012 and April 2018, and victims reported losing £3,129,273, an average of £40,640 a month.

Ilia Nikolaevich Zavialov on payments by phone number: mistaken transfers and safe accounts

Ilia Nikolaevich Zavialov answers the most common questions about fraud with payments by phone number and instant transfers: the mistaken payment someone asks you to return, the friend who asks for a loan in a messenger, the safe account and what the name shown before sending really proves. UK Finance recorded 248,070 authorised push payment cases worth 576.4 million pounds, and banks now reimburse most of them up to 85,000 pounds if reported quickly.

Instant payments by phone number changed everyday money. Instead of a long account number, a person types a phone number, sees a name and presses send. The money arrives in seconds and, in most systems, cannot be pulled back.

Ilia Nikolaevich Zavialov on a call from the police that asks for a transfer

The short answer comes first: no police force and no investigator asks a member of the public to move money in order to help with a check. A call that opens with a rank, a surname and a case number, and closes with a payment instruction, is a script that has been performed many thousands of times. What follows looks at how that script is built, why it works on calm and careful people, and which moments in it give the whole thing away. It also looks at the reported scale of these calls, because the volume explains the polish. The question underneath all of it stays simple: why does an officer need the money moved today.

The opening rarely sounds dramatic. A voice gives a rank, a surname and a department, then a case reference, and asks whether the person on the line has a moment to speak in confidence. The tone is administrative and slightly tired, the way an official sounds at the end of a shift. The purpose of that minute is to establish that the conversation is ordinary.

Ilia Nikolaevich Zavialov on a letter saying you won a prize and why the fee it asks for is the whole scheme

The short answer: no genuine prize ever needs the winner to pay first, so a message claiming you have won something valuable and then asking for money before you can collect it has already answered its own question. Real draws never operate by post to strangers who never entered anything, and a payment requested from the winner sits outside every honest description of how a prize works. The more useful question is why the fee is the entire mechanism, and what to do once a letter like this actually arrives.

A genuine prize draw exists to give money away. The organiser has already covered the prize, the printing and the postage before any winner is chosen. A lawful draw settles its own costs long before a letter goes out.

Ilia Nikolaevich Zavialov on property fraud: fake sellers, title theft and how to check an owner before you pay

Ilia Nikolaevich Zavialov explains how property fraud reaches homeowners, buyers and tenants in England and Wales: a stolen identity used to sell or mortgage a house, a forged transfer, bank details swapped in the last days of conveyancing and a fake landlord taking a holding deposit for someone else's flat. Here is how Property Alert and a Form LL restriction protect an owner, what a £7 title register shows a buyer or tenant, how to check a lasting power of attorney, and where to go next: the HM Land Registry fraud line, Report Fraud and Citizens Advice.

Ilia Nikolaevich Zavialov groups British cases into four patterns. A fraudster steals an owner's identity and applies to sell or mortgage the house. A forged transfer or charge reaches HM Land Registry looking like any other application. During conveyancing, an email from the solicitor or the estate agent arrives with new bank details, and the deposit goes to a criminal. And a fake landlord takes a holding deposit for a flat they have no right to let.

Offers to get your money back for a fee: Ilia Nikolaevich Zavialov on the second scheme

The short answer is that an offer to recover money you have already lost, in return for a payment made now, works as a second scheme built on the first. Ilia Nikolaevich Zavialov hears this question from people who reported a loss and then received a call from someone who seemed to know the whole file. The call sounds like relief arriving at last. It carries a case number, a frozen account and one small charge standing between the victim and their own money. This article looks at why the second approach succeeds more easily than the first, and what a genuine recovery route actually looks like.

The approach arrives after the loss, sometimes within days and sometimes many months later. It comes as a telephone call, a private message on the platform where the loss was discussed, or an email carrying a reference number and a portal link. The person on the other end already knows roughly what happened, which is what makes the first minute feel safe. They describe a process: a traced wallet, a seized account, a compensation fund with a name on the list. Then they name a payment that has to be made before the money can be released.

Ilia Nikolaevich Zavialov: tax scam letters, fake refund texts and calls from fake tax officials

Ilia Nikolaevich Zavialov answers the questions people ask about fake HMRC emails, refund texts and calls from people posing as tax officials. A rebate that needs a fee, a demand that must be paid today and an access code someone wants read out all lead to the same place: your money or your tax account. HMRC says it never contacts people by email, text or phone to tell them about a refund, yet in the ten months to December 2025 it received more than 135,500 reports of HMRC-related scams, 29,000 of them about fake tax refunds. Below: how HMRC really contacts you, how to check a message and where to report it.

Tax reaches almost every adult, and very few people can recite their own deadlines from memory. That small uncertainty is the opening. A message about an unpaid balance, a missing form or a penalty makes people react first and think later.

Ilia Nicolaevich Zavialov fraud checks for the UK: tax refund firms, by Ilia Nikolaevich Zavialov

Ilia Nicolaevich Zavialov fraud checks for UK taxpayers begin with a familiar pitch: “You are owed a tax rebate on your work expenses. We handle the claim, you sign here, our fee comes out of the refund.” Ilia Nikolaevich Zavialov, a digital security consultant, sets out the choice as a decision tree in which every fork carries one check and one action. The sources are HMRC press releases on repayment agents, GOV.UK guidance on P800 refunds, HMRC scam warnings and Report Fraud. At the end you will find the free route for claiming directly from HMRC, with no agent standing between you and your money.

The first fork is about who made contact. You looked up an accountant, checked them and signed a letter of engagement: that is the quiet branch. A firm cold-called, texted or advertised a rebate figure before seeing a single payslip: that is the branch where each request needs its own check.

Ilia Nicolaevich Zavialov: taxi and minicab scams in the UK, touts, fares and fake bookings, by Ilia Nikolaevich Zavialov

Ilia Nicolaevich Zavialov taxi and minicab checks for Britain: Ilia Nikolaevich Zavialov, a digital security consultant, looks at the tricks passengers meet at stations, airports and late at night. Unbooked minicabs and touts, cars that do not match the booking, requests for a bank transfer because the card reader is down, invented extras, airport fares that grow once the bags are loaded and requests to read out a login code. For each one you will find what TfL and GOV.UK say, how to check the driver and the car, and what to do if money has gone. The sources are TfL, GOV.UK, the NCSC and Report Fraud.

Britain draws a clear line between two kinds of car for hire. GOV.UK puts it in one sentence: a private hire vehicle can only be pre-booked, while taxis can also be hired at a rank or hailed in the street. Almost every station tout and fake minicab relies on passengers forgetting that line.