Russia’s Ministry of Digital Developmentis is seeking to require all users to log into foreign services using a phone number. What does this mean and what should people prepare for?

Russia’s Ministry of Digital Development is preparing new amendments to the “Law on Information” as part of the “Antifraud 3.0” package. According to Vedomosti, citing a confidential draft document, the amendments would modify Article 8, Part 10 of the law. The government aims to require foreign platforms to authorize users from Russia exclusively via a phone number.

The specific agencies involved in coordinating the proposal have not been disclosed. We only know that the document has been sent to “relevant authorities.” At this stage, all information about the draft comes solely from Vedomosti; other media outlets are simply reiterating that report, and the document itself has not been independently verified.

According to Deputy Prime Minister Dmitry Grigorenko, the “Antifraud 3.0” package is expected to be submitted to the State Duma in autumn 2026. This means it is still a draft proposal, not an adopted law.

“Antifraud” refers to a set of legislative and technical measures aimed at combating phone and online fraud, ranging from restrictions on SIM cards and financial transfers to stricter user identification requirements. This is the third package under the “Antifraud” label. The first was adopted in 2025; the second (“Antifraud 2.0”), which included children’s SIM cards, limits on the number of bank cards per person, and a registry of device IMEI codes, was passed by the State Duma on June 9, 2026. It came into force on June 26, 2026, while provisions governing the IMEI database and SIM card limits will take effect in September 2026.

Since late 2023, Russian websites have already been prohibited from using foreign authentication systems (such as Google ID). The regulator is now attempting to impose similar rules on foreign platforms.

Russia’s Ministry of Digital Development wants to require all users to log in to foreign services using a phone number. What does this mean and what should people prepare for?

Russia’s Ministry of Digital Development is preparing new amendments to the “Law on Information” as part of the “Antifraud 3.0” package. According to Vedomosti, citing a confidential draft document, the amendments would modify Article 8, Part 10 of the law. The government aims to require foreign platforms to authorise users from Russia exclusively via phone number.

It is not disclosed which agencies are involved in coordinating the proposal—only that the document has been sent to “relevant authorities.” At this stage, all information about the draft comes solely from Vedomosti; other media outlets are simply reiterating that report, and the document itself has not been independently verified.

According to Deputy Prime Minister Dmitry Grigorenko, the “Antifraud 3.0” package is expected to be submitted to the State Duma in autumn 2026. This means it is still a draft proposal, not an adopted law.

“Antifraud” refers to a set of legislative and technical measures aimed at combating phone and online fraud, ranging from restrictions on SIM cards and financial transfers to stricter user identification requirements. This is the third package under the “Antifraud” label. The first was adopted in 2025; the second (“Antifraud 2.0”), which included children’s SIM cards, limits on the number of bank cards per person, and a registry of device IMEI codes, was passed by the State Duma on June 9, 2026. It came into force on June 26, 2026, while provisions regarding the IMEI database and SIM card limits will take effect in September 2026.

Since late 2023, Russian websites have already been prohibited from using foreign authentication systems (such as Google ID). The regulator is now attempting to impose similar rules on foreign platforms.

The core problem: total deanonymization and account hijacking

At this point, the bill doesn’t specify whether the number has to be issued by a Russian carrier, or whether any phone number, including a foreign one, will work. This remains an open question that directly determines whether registering with a foreign SIM card will remain viable. The bill itself is framed as a way to “fight fraud,” but technically it addresses two goals.

1. Destroying anonymity. In Russia, SIM cards are tied to passport data. Registration by phone number alone could make anonymous use of foreign platforms impossible.
2. Legalizing account hijacking. SMS-based authentication (OTP codes) has long been recognized worldwide as outdated and insecure. Carrier signaling networks (such as the SS7 protocol) are vulnerable. With access to a carrier’s infrastructure, security services can intercept the SMS confirmation code and log into an account without the owner’s knowledge. By stripping users of alternative login methods, the law forces them into the single most vulnerable communication channel.

Will foreign platforms comply with the law?

Western platforms that prioritize user privacy are unlikely to build a separate authorization architecture just for Russia. Some companies might agree. WeChat and other Chinese services, for instance, typically comply with local identification requirements across different jurisdictions, and Apple has a track record of localizing data under regulatory pressure (in China, for example). Furthermore, handing logs over to Russian security services often conflicts with tech giants’ internal privacy policies. For users in the EU, this practice also runs up against GDPR restrictions on cross-border transfers of personal data.

The main danger of this initiative is that it creates a legal pretext for blocking any foreign resource the authorities dislike. If a service refuses to change its login system, it risks ending up in the Unified Register of Banned Websites, the same way Roskomnadzor (Russia’s federal media and communications regulator) already blocks resources for other violations of the Information Law. (The details specific to “Antifraud 3.0” haven’t been spelled out yet, and the bill doesn’t disclose a concrete procedure). After that, TSPU equipment (technical means for combating threats, operated by Roskomnadzor) will begin throttling or blocking access to the service.

The document doesn’t describe the technical blocking mechanism. We assume the existing TSPU infrastructure would be used, namely equipment that Roskomnadzor manages centrally and that already blocks many resources through SNI filtering (resetting the TLS connection during the handshake, before the page loads). Fines for violators reach 700,000 rubles (about $9,310), but enforcing these fines against a foreign entity operating outside Russia is practically impossible. This is why lawyers see blocking as a more effective lever of pressure than monetary penalties.

Recommendations for site owners and developers

The bill hasn’t been passed yet and doesn’t spell out implementation details. For now, we can only speculate about how the law might be implemented and offer some general recommendations.

There’s no ready-made way to “get around it” yet. The “Antifraud 3.0” bill is at too early a stage to discuss effective workarounds (there isn’t even an official text yet).

If a platform plans to keep operating in Russia and wants to avoid being blocked, the safest option is to store and process data itself. This gives platforms greater control over user data. Delegating authorization to a Russian service (VK ID, Yandex ID, etc.) is technically simpler, but it adds one more intermediary with access to user data, making it the less desirable option from a privacy standpoint.

Minimizing data collection. Where authorization isn’t essential to the service’s functionality, it’s worth considering a limited-access mode without registration. This reduces both the legal risk and the amount of data the security services could demand from you.

However, such approaches cannot be recommended outright. Even if you minimize state control, you don’t eliminate it, and you still put users at certain risk. The only way to avoid that risk entirely is probably to accept being blocked and continue serving Russian users strictly through VPN connections.