Kanybekova shared details of the criminal case, emphasizing that the names of the participants have been changed.
In October 2025, 40-year-old Askar begins planning criminal activities. To avoid using his own IP address and bank account, he finds an 18-year-old student named Arthur through Telegram. Askar assures the young man that he will teach him how to earn money in cryptocurrency and offers test tasks, including linking his bank card to a specific website.
As a reward, Askar pays Arthur 15,000 soms. Thus, the student becomes a "dropper," whose task is to find new people willing to provide their bank cards. Arthur offers his acquaintances an easy way to earn money: just hand over the card for 10 days, receive money, and then block it. As a result, he creates a group that includes five guys and a girl named Aizhan.
In January 2026, Arthur hands over six ready bank cards and their passwords for cryptocurrency wallets to Askar. At this stage, Askar begins sending phishing links, gaining remote access to the victims' phones. Now he can manage the "droppers'" accounts remotely.
Every morning at 10 o'clock, Askar makes calls to citizens, posing as an employee of a mobile company. On February 5, one of the residents of the capital receives a call via WhatsApp, where he is informed about the urgent need to extend the validity of his SIM card. Askar sends a 4-digit SMS code, and the victim, unaware of the danger, opens the message and dictates the code.
Kanybekova noted that this was actually a code for resetting the password for the banking app. The victim confirms his identity and remains unaware of what is happening when he receives the next call.
“This is the security service. We are monitoring your account and see suspicious activity. You will receive a code to block the transaction; please dictate it,” they say on the other end of the line.
The resident of Bishkek, unaware of the substitution, provides four digits. This is not a blocking code but a confirmation code for transferring all his savings. The entire operation, from the first call to the account being emptied, was completed in just 30 minutes. The victim only learns about this through an SMS from the bank about the closure of his deposit and contacts the police.
As a result, the damage amounted to 1 million 999 thousand 6 soms.
The case has been registered under Article 209, Part 3, Clause 1 ("Fraud in a large amount") of the Criminal Code of the Kyrgyz Republic.
Among those detained were also suspects in the dropping: M.S.M., born in 2005, S.A.Z., born in 2008, B.A.I., born in 2006, T.U.B., born in 2006, and O.S.A., born in 2007.
During interrogations, they stated that they needed money and agreed to sell their passport and bank details.
As the investigation continued, employees of the Cybercrime Department of the Main Department for Combating Organized Crime tracked down the organizer of the scheme, T.E.T., born in 1984. According to Kanybekova, the detained individual registered accounts on various cryptocurrency platforms, where he exchanged stolen funds for digital assets to conceal and legalize them. For this purpose, he used VPN services and regularly changed his IP addresses.
The investigation is ongoing.
