Russia to Launch Unified Payment Card Registry in 2026 to Combat Dropper Fraud Schemes

Starting September 1, 2026, Russia will introduce a single nationwide system for recording all payment cards issued by domestic banks. The registry will include every card regardless of the payment system used, covering existing Visa and Mastercard products as well as expired cards that banks continue to service. The measure is designed to give banks visibility into the total number of cards held by any individual across multiple institutions, thereby disrupting dropper schemes that rely on multiple accounts for laundering stolen funds. No immediate mass closure of cards will occur; instead, the first year will focus on data collection and preparation. From September 1, 2027, a hard limit of 20 cards per person will apply to new issuances only, while existing cards above the limit will remain operational. The policy grants individuals time to decide which cards they truly need before the issuance restriction takes effect.

AntiMalwareTranslated from Russian

Read at source

From September 1, 2026, Russia will activate a unified national registry that records every payment card issued by Russian banks, irrespective of the underlying payment system.

The new database will capture all cards, including previously issued Visa and Mastercard products and even expired cards that banks continue to maintain. This comprehensive approach prevents individuals from concealing card holdings behind foreign payment-system logos.

The primary objective is to strengthen the fight against dropper schemes, in which criminals use multiple third-party cards and accounts to move and cash out stolen funds. Under the current fragmented system, each bank only sees the cards it has issued itself.

With the single registry, banks will gain a complete view of how many cards are linked to any one person across all institutions. This visibility is expected to make it significantly harder for fraud networks to operate large numbers of mule accounts undetected.

No mass cancellation of cards will take place on the launch date. The restriction limiting any individual to a maximum of 20 cards across all banks will only begin on September 1, 2027. Cards already exceeding this number will continue to function; the limit will apply solely to the issuance of new cards.

During the initial year, the system will focus on accurate counting and preparation. Holders of large card collections will have time to evaluate which cards they actually use and which can be closed before the new issuance rules come into force.

Meridian digestThe week's most consequential security stories, distilled into one briefing.See the digest

More in Fraud & Social Engineering

Scammers Use *#62# USSD Command to Fabricate Surveillance Claims and Steal Victims' Funds
Aroshka Cloud Faces Scrutiny Over Alleged False Claims of SOC 24/7 Operations and High-End Infrastructure
Reports Surface on Alleged De-Anonymization of Admins Running Major Russian Hacker Forums