Vienna, Monaco, Bali. Scam call centres in the shadow of attacks and a conflict between Ukrainian institutions

Editorial analysis based on the cited reporting, law enforcement announcements and a court statement. Information current to 1 November 2026.

Arrests in Vienna, an explosion outside a businessman's home in Monaco and the killing of a young Ukrainian in Bali have separate case files, victims and suspects. Reports about each nevertheless return to fraudulent call centres and people with money, connections and experience in the security services. Recent allegations of a threat against former prosecutor general Ruslan Kravchenko add a further dimension. They do not establish a common mastermind. They do show why following the proceeds of telephone fraud has become an issue extending far beyond Ukraine.

Vienna: from suspected espionage to an assassination hypothesis

In late October, Austrian media reported suspicions that men detained in Vienna and linked to Ukrainian military intelligence may have been preparing action against Ruslan Kravchenko, who was staying in Austria. Accounts of reporting by Kurier and Don't Fund Russia raised the possibility of an assassination attempt. They referred to the Artan unit, surveillance equipment and interest in the former prosecutor general's surroundings. This remains a hypothesis reported in the press, rather than a finding announced by an Austrian court.[1]

The criminal investigation itself is on firmer ground. On 9 October, Der Standard reported the detention of four Ukrainians. Two men suspected of intelligence links were remanded in custody; a court spokesperson said they denied the allegations. Austrian authorities referred to suspected secret intelligence activity detrimental to Austria. Two other detainees, journalist Mykhailo Tkach and cameraman Yaroslav Bondarenko, were released.[2]

The distinction between espionage and preparing a killing matters. Cameras, trackers and surveillance can serve different purposes. Establishing an assassination plan would require additional evidence: instructions, communications, operational preparations and a reliable determination of the intended objective. Intelligence personnel being near a public figure does not settle those questions.

The Park Hyatt account also needs precision. According to Ukrainska Pravda's description of Austrian case documents, officials checked Artan commander Viktor Torkotiuk's identity at the hotel in September. He reportedly said he was a tourist. An identity check is not the same as arresting a commander on suspicion of preparing an assassination. The newspaper also described the subsequent detention of two subordinates allegedly carrying military documents, hidden cameras and trackers.[3]

Journalists cannot be treated as agents by association

Tkach and Bondarenko were looking for Kravchenko on an editorial assignment. Their detention added a further dimension: reporters investigating an influential official became entangled in suspicions concerning intelligence personnel.

Vienna prosecution spokesperson Nina Bussek told Der Standard that suspicions concerning two additional people had emerged during another investigation but had not been substantiated. The four cannot therefore be described as an exposed assassination team, nor can it be claimed that all remained in custody.[2]

Ukrainska Pravda also reported that surveillance footage used to suggest a connection between its cameraman and servicemen actually showed Tkach sitting beside Bondarenko. According to prosecutorial records quoted by the newspaper, the journalists' explanations were considered credible and no connection between the cameraman and military intelligence personnel had been established.[3]

That does not resolve every aspect of the Vienna operation. It does rule out a shortcut: a journalist was in the same city and interested in the same person, therefore he was working for an intelligence service. In a security case, that shortcut can turn suspicion into a public verdict.

Kravchenko accuses; NABU and SAPO deny

The former prosecutor general offered his own interpretation. He said that in September he had learned of a group sent to Austria to commit unlawful acts of violence against him. He pointed towards the leadership of the National Anti-Corruption Bureau of Ukraine, the Specialized Anti-Corruption Prosecutor's Office and the presidential administration. He also acknowledged that he lacked reliable information about who specifically had issued the alleged order.[4]

NABU and SAPO rejected the accusations. In responses to the media, they described Kravchenko's statement as an attempt to secure protection in his country of residence after leaving Ukraine following Operation Carthage.[4]

Both positions require careful treatment. A person's assertion that he fears an attack does not prove that the institutions he names ordered it. Their denial is not a substitute for an independent examination of a possible threat either. The Austrian investigation, rather than the political standing of any party to the dispute, should establish what happened.

Carthage: protecting fraudsters becomes an official investigation

A specific corruption case forms the backdrop to the Vienna story. On 5 September 2026, NABU and SAPO announced the exposure of an alleged criminal organization centred on a senior official in the Prosecutor General's Office. Investigators said the group took bribes in return for allowing fraudulent call centres to operate without interference. Victims included Ukrainians and foreigners.[5]

NABU also described alleged money laundering through property, jewellery and other valuable purchases, assets registered to third parties, and funds placed in relatives' accounts as purported legitimate income. Its initial announcement identified five alleged participants.[5]

On 22 October, the bureau announced another suspect: a former head of a prosecution department. He allegedly managed contacts with illegal call centres, collected funds and helped provide security and concealment for the group. The announcement put documented illicit benefits at more than one billion hryvnias. That figure concerns a particular investigation, rather than the size of the entire fraud industry.[6]

The alleged mechanism goes beyond tolerating a single illegal office. If proved, it would amount to selling protection from prosecution by people within an institution responsible for enforcing criminal law. Victims would then lose money not only through manipulation by a caller but also through possible corruption further along the enforcement chain.

Where does the former prosecutor general stand?

Public reporting connected Kravchenko to Carthage, but his position must be distinguished from that of formally named suspects. The Kyiv Independent reported a search of his office and the involvement of Serhii Kropyva, an official considered a significant figure in the case. It noted that NABU's September announcement did not directly identify Kravchenko as the organizer.[7]

Reports discussed recordings referring to a 'boss' with the patronymic Andriiovych, interpreted as a reference to Kravchenko. He denied protecting call centres, issuing relevant instructions or using his office for that purpose. The prosecution service also disputed the sufficiency of the grounds for some searches.[8]

As recently as 28 October, The Kyiv Independent stated that Kravchenko had not been officially charged. Reports about searches, his departure and suspicions concerning his associates cannot automatically be turned into a statement that he was convicted or formally accused of directing the scheme.[9]

Two issues remain independent: possible responsibility for protecting fraudsters, and a possible threat of violence. Someone whose conduct needs investigation may still be a crime victim. Equally, a public claim of danger does not remove the need to scrutinize earlier official decisions.

Monaco: an explosion opens competing lines of inquiry

On 29 June 2026, an explosive device detonated outside a residential building in Monaco. Three people were injured, including a teenager; a woman's injuries were life-threatening. Prosecutor Stéphane Thibault announced an investigation into attempted murder and placing an explosive device in a public place. A terrorism classification was not adopted at that stage. Media identified businessman Vadym Yermolayev as the target.[10]

On 1 July, Ukrainska Pravda, citing Le Figaro, reported a hypothesis involving Ukraine's Security Service, the SBU. It came from journalistic sources, rather than a public accusation against the SBU by Monaco prosecutors.[11]

Later developments complicated that picture. On 7 July, the SBU officially announced the discovery in Ukraine of the body of Anastasiia Berezovska, suspected by Monaco authorities of involvement in the attack. Two men were detained: a former law enforcement officer and a serving military intelligence employee. According to the announcement, transfers to Berezovska's accounts justified examining their possible involvement in the explosion as well.[12]

The SBU also said the serving intelligence employee described acting independently, without informing his superiors. That is the investigating authority's account, not an independently settled answer about the mastermind. The same announcement said the organizers of the attack were still being sought.[12]

Yermolayev publicly implicated military intelligence personnel. HUR representative Andrii Yusov rejected his accusations, as reported by Suspilne. The initial SBU hypothesis, subsequent arrests and denials demonstrate why the statement 'the SBU organized the attack' goes beyond established facts.[13]

The most concrete call-centre connection leads to the businessman's son

The Yermolayev family has a court-documented connection to telephone fraud. On 30 April 2026, Estonia's Harju County Court announced that Artur Yermolayev had been found guilty of creating and directing a criminal organization specializing in such offences. The announcement described offices in different Ukrainian cities and more than EUR 100 million obtained through fraud between 2019 and 2022, including around EUR 5.4 million from people in Estonia.[14]

The court approved an agreed five-year prison sentence, of which four months and 26 days were to be served immediately. It also described an EUR 8.5 million payment replacing confiscation, expulsion and a ten-year entry ban. At the time of publication, the court stated that the judgment was not yet final.[14]

A son's responsibility does not establish his father's. In an August interview with Ukrainska Pravda, Vadym Yermolayev denied his own connections to scam call centres and any connection between the explosion and events in Bali. He also said his son had reached an agreement without admitting guilt. That is the father's position, distinct from the court announcement.[15]

There is another relevant intersection: on 7 September, Ruslan Kravchenko himself told journalists that a possible call-centre motive for the Monaco attack was being examined. Interfax-Ukraine reported that he referred to the son's case while acknowledging that the attack's motive had not been established.[16]

That is a genuine point of contact between investigations, not proof of a common operation. A relative's criminal case may justify examining a motive, but cannot determine why family members were attacked or who made that decision.

Bali: a killing cannot be reduced to a recorded 'confession'

Ihor Komarov, a 28-year-old Ukrainian described by Ukrainian media as the son of a businessman from Dnipro, was abducted in Bali in February 2026. Indonesian police subsequently announced identification of recovered remains through DNA testing. Their statement gave 15 February as the reported abduction date and described traces in a rented car and villa, alongside a video demanding ransom.[17]

On 30 March, Bali police said they had identified seven foreign suspects. Six had reportedly left Indonesia. Investigators described preparations before the abduction and inquiries at several locations. That supports reporting a planned crime, but not an established connection to every other case involving Ukraine.[18]

The call-centre connection appeared in recordings of Komarov in captivity. According to Ukrainska Pravda, he spoke about involvement in Dnipro 'offices' and people allegedly providing protection. In August, citing law enforcement sources, the newspaper also reported an examination of veteran Hlib Novostroinyi's possible connections to call centres and the Komarov case.[19]

A recording of an abducted person is not freely given testimony. A victim may be reading a dictated statement, attempting to survive or saying a mixture of true and coerced claims. Accusations against people named in such material cannot be treated as proved without independent examination.

The status of people being investigated is equally important. Suspilne noted that the proceedings it was describing against Novostroinyi did not include an official suspicion of murder or abduction. Examining a possible connection, and a person's earlier military service, do not establish that a unit ordered a crime.[13]

Money, protection and a market bigger than a single office

The Global Initiative Against Transnational Organized Crime's April 2026 report, Kyiv Calling, describes scam call centres as an extensive ecosystem involving organizers, technical infrastructure, recruitment, criminal connections and protection by some corrupt officials. It records victims in at least 29 countries.[20]

The report also discusses estimates of around 60,000 workers and potential revenue reaching USD 1 billion a month. These are not the results of a comprehensive census or audited accounts. The authors acknowledge the difficulty of measuring the industry, and the revenue calculation relies on assumptions about the number and size of centres. The figures illustrate an assessment of scale, rather than a certain statistic for every network described.[20]

Separate European enforcement operations illustrate how these scams work. In 2023, Europol described a network using fake cryptocurrency platforms: a small initial deposit and fictitious profits were designed to encourage larger transfers. Victims in that particular investigation included people in Germany, Switzerland, Australia and Canada.[21]

That does not establish that the Europol network was connected to the people appearing in Vienna, Monaco or Bali. It does explain why the term 'call centre' can sound misleadingly harmless. In this context it means a tool for organized theft through deception, rather than legitimate customer service.

What actually connects these stories?

Documents and reporting identify several links without establishing a single scenario. Carthage concerns alleged protection of fraudulent centres by prosecution personnel. Kravchenko is central to a dispute over his associates' responsibility and his own safety. In Monaco, the victim was a businessman whose son was subject to an Estonian conviction for telephone fraud. In Bali, a man was murdered after his captors presented him in recordings discussing that industry.

A common subject is not a common body of evidence. Establishing one organization would require findings about financial flows, communications, shared operatives and instructions. Without them, attributing every event to one service, one political centre or one 'wartime business' exceeds the available material.

The analytical conclusion is narrower but serious: investigating scam call centres requires pursuing more than the people making calls. Protection arrangements, financial intermediaries and possible private exploitation of law enforcement skills matter just as much. That is the area emerging from official announcements which demands independent scrutiny.

Answers must come from evidence

The Vienna investigation should establish who was being watched, why, and whether violence was being prepared. Proceedings concerning Monaco and Berezovska's death must identify those who gave instructions and distinguish individual officers' actions from any responsibility of their superiors. In Bali, the essential questions concern the perpetrators, financing and real motive, rather than the content of coerced recordings.

For victims of telephone fraud, identifying who enabled the transfer of money and obstructed enforcement remains equally important. Arresting callers without addressing organizers and possible protectors cannot provide a lasting answer.

These cases merit attention together. Each nevertheless requires its own evidence. Independent investigators and courts will have to determine whether the stories intersect, involve private actions by people from security institutions, or form part of a wider criminal arrangement. Both suppressing documented suspicions and presenting a media hypothesis as a completed investigation would be serious errors.