A Russian infosec activist thinks his bank records were hijacked

For the first time, the Russian bank Alfa-Bank has addressed allegations that opposition activist and blogger Ruslan Leviev (real name: Ruslan Karpuk) was the subject of secret monitoring. On August 3, Leviev said he'd discovered that someone else's phone number had mysteriously been added to the contact information on his Alfa-Bank account. Leviev speculates that Russian intelligence agencies are to blame, saying it could be part of an effort to monitor his opposition work with the Conflict Intelligence Team, a website that uses open-source investigation to conduct citizen journalism on armed conflicts involving the Russian military. Leviev says he encountered similar problems in 2014, when Alfa-Bank regularly froze his debit card because someone kept meddling with his mobile phone's SIM card. He believes this was the result of attempts to wiretap his calls.

On August 3, Leviev wrote about an unfamiliar telephone number (from telecommunications operator Beeline; the activist is a MegaFon customer himself) linked to his bank accounts at Alfa-Bank and Sberbank. After this, many other political activists began contacting their banks with requests for information on unfamiliar telephone numbers linked to their bank accounts.

In an online conversation with Leviev, Alfa-Bank representatives claimed that the blogger linked the unfamiliar number to his bank account himself back in 2010.

However, as an Alfa-Bank call-center operator told Leviev on August 3, the Beeline number was filed in “a completely different place,” as opposed to the member profile section that is ordinarily reserved for clients’ telephone numbers. The bank offered no explanation for why the phone number appeared where it did, or how—six years after the old account was closed—Leviev's name appeared when the Beeline number was transferred.

Leviev insists that the account given by Alfa-Bank representatives changed within 24 hours. On August 3, the operator insisted that the number was added on November 24, 2011. Now, however, the bank maintains that the number has been linked to the account since 2010.

On the morning of August 4, Leviev was told at an Alfa-Bank branch that the unfamiliar number is not only not linked to his bank account, but was never linked to it to begin with and does not appear anywhere in the client’s transaction history. Leviev insists that he has never linked any Beeline telephone numbers to his debit cards through ATMs. On the one occasion when he did choose to link a telephone number to his card, he chose his “public” MegaFon number (+7 926 970 5847), he says.

“All right. Let us assume that I am mistaken and Alfa-Bank’s version is correct. Why is it that over the course of these five years I did not see this number appear in my personal profile on the bank’s website? I check and monitor this account meticulously and I know where clients’ contact details are stored […] It is a very strange situation when you cannot control what telephone numbers are linked to your [bank] account,” Leviev wrote.

According to Vladislav Zdolnikov, an IT expert and Leviev’s friend, it's still unclear who owns the phone number added to the bank account, despite efforts to make contact. Alfa-Bank, at any rate, no longer has any traces of the number in its records.

“We tried to call this number. On the first occasion, we were hung up on. On the second occasion, the call was taken. A man responded, but then hung up. Twelve hours ago it was still possible to find Ruslan’s account by searching for this number on the Alfa-Bank webpage, but now the number has been removed from the profile […] and from the history of his profile, [as well]. It is as if this number had never even been added or deleted from the profile to begin with. Furthermore, the account was fully blocked and unblocking it required turning to technical support. The profile page had an alarm symbol of sorts that a bank employee at a branch was surprised and said he had never seen anything like it before,” said Zdolnikov.

How the unfamiliar number ended up in the Sberbank system still remains unclear to Leviev. It was because of this that the oppositionist began to suspect that his accounts are being monitored. “How did Sberbank learn that I once had this telephone number (though I never actually did)? Did they search for it on the Internet? An operator at Alfa-Bank has just informed me that there is no communication between banks and that Sberbank could not have learned this number from [Alfa-Bank],” Leviev says.