Russian scammers have begun combining traditional postal mail with modern phishing techniques to target domestic users. Victims receive paper letters purportedly from the Federal Tax Service instructing them to correct tax declarations or provide documents confirming expenses.
The physical letter is designed to lend credibility to the request. Shortly afterward, emails arrive claiming that a new notification has appeared in the taxpayer’s personal account and urging the recipient to click a link to view it.
The link leads to a counterfeit copy of the official FNS website that includes a login form. Any credentials entered are captured by the attackers and can later be used for account takeovers or further social-engineering campaigns.
Senator Artem Sheikin described the operation, emphasizing that the combination of paper and electronic channels increases the perceived legitimacy of the messages. The use of official-looking logos, formal language, and the trusted postal channel makes the subsequent email appear less suspicious.
Security experts recommend that taxpayers never follow links from unsolicited messages. Instead, they should manually open the official Federal Tax Service website or check tax information directly through the Gosuslugi portal.
The core element of the scheme is psychological rather than technical: the paper letter preconditions the victim to trust the later digital notification.
