A former operator has published a detailed confession describing how he ran a multi-account promo code abuse operation against Russian marketplaces and delivery services for more than three years.
Chapter 1: The Golden Rush of Customer Acquisition Budgets
Domestic e-commerce platforms, driven by investor pressure to show rapid user growth, offered first-order discounts of 50 percent or more. Services such as Ozon, Yandex and Sber were willing to spend 1,000–1,500 rubles to acquire each new customer. The abuser registered accounts using Android emulators and cheap SMS-activation numbers, applied public promo codes, paid with virtual cards and resold the goods at a 20–25 percent discount. At peak, the operation cleared 350–400 thousand rubles per month.
Chapter 2: Building an Industrial Farm with Anti-Detect Tools
When platforms began blocking pools of virtual numbers and reading hardware fingerprints, the operator invested in professional equipment. A 64-channel GSM gateway and physical SIM cards replaced virtual numbers. Traffic was routed through paid anti-detect browsers including Dolphin Anty, Octo and AdsPower, each profile loaded with genuine device fingerprints. Mobile proxies on USB modems provided residential IP addresses that platforms could not block without affecting real users.
Chapter 3: Behavioral Biometrics and Graph Analysis Defeat Manual Patterns
Retailers deployed systems similar to those developed by Group-IB (now F.A.C.C.T.) and internal ML teams at Yandex, Sber and Ozon. These solutions analyzed keystroke dynamics, gyroscope data and mouse movement trajectories. Mechanical clicking and copy-paste actions stood out immediately. Geolocation black zones were created around addresses that repeatedly received first orders, and shadow bans froze funds for up to 14 days even after orders were accepted.
Chapter 4: Criminal Liability under 115-FZ and Article 159.6
Banks applying 115-FZ rules flagged transit activity and blocked personal and family cards. Use of third-party “drop” cards crossed into Article 187 territory. Corporate security teams, staffed by former law enforcement officers, built relationship graphs and waited until losses exceeded 250,000 rubles before filing cases under Article 159.6 of the Criminal Code for fraud in the sphere of computer information. One associate received a suspended sentence, sold his car to cover damages and now carries a fraud conviction.
The operator shut down the farm six months ago, citing both technical saturation and the clear criminal risk that had replaced earlier low-stakes arbitrage.
