We look at what is behind the new initiative to make confirmation of “significant actions” on the internet mandatory, why it is coming back for the third time in a year, and what is wrong with it from the perspective of the people who design these authentication systems.

Summary

On July 6, 2026, the Russian edition of Forbes reported that the Ministry of Digital Development (Mintsifry) was proposing to include a provision in the third package of anti-fraud measures that would make it mandatory to authenticate “significant actions” on the internet via SMS or via Max (the messenger created with the involvement of a state-affiliated company). Forbes cited its sources in the IT and telecom industries. The ministry has denied this.

• This is not the first attempt. The same provision was pushed in the second anti-fraud package in winter. It was removed before the second reading after objections from almost the entire business community. So, now we’re talking about the third attempt.
• The wording has changed. Last time, the text listed authentication via Max and SMS. This “and” caused conflicting interpretations. Now it is “or”. Still, there are only two allowed authentication methods.
• Nobody knows what “significant actions” are. No document contains any criteria. It could be anything, from logging into an account to transferring money.
• The status is a discussion, not a law. Mintsifry said it was not considering any measures like this but confirmed that it was working on the third package.

In essence, the debate has long moved beyond fighting fraud. The dispute is about who decides the ways of online authentication: you, any service, or a law which is focused on a single governmental messenger.

What’s happening

Three sources in the IT/telecom industry told the Russian Forbes about the provision. According to one of them, this measure was already discussed during preparation of the second package but did not make it into the final version.

The Russian Ministry of Digital Development responded that “no such measure is under consideration,” adding that the third package “is being coordinated with the relevant agencies and the industry” and that all initiatives “are developed with a balance between security and user rights in mind.” The wording is vague. The statement denies this specific provision but does not deny that the package is being prepared and that its contents may change.

For comparison, Mintsifry announced the third package itself back in April 2026. In late May, Ivan Lebedev, the deputy head of the ministry, said that the document was discussed with law enforcement, banks, and telecom operators.

In other words, “not under consideration” means “not stipulated in the text yet” rather than “will not happen.” This pattern (deny in the moment, add later) is common for Russian lawmakers.

The three packages of anti-fraud measures

The provision under discussion is just one link in a chain of restrictive rules.

• The first package was adopted in 2025, with its main provisions taking effect in September 2025. It included the labeling of calls from organizations, a ban on government agencies and banks contacting clients through foreign messengers, and more than thirty other measures.
• The second package (“Anti-Fraud 2.0”) passed its first reading on February 10, 2026. It was adopted in its second and third readings on June 9, 2026, and was signed at the end of June. It included compensations for victims, labeling of international calls and a self-imposed opt-out from receiving them, a general IMEI database, a limit on the number of credit cards per holder, pre-trial blocking of websites which host malware, and a ban on hosting for VPNs.
• It was from the second package that three contested provisions were removed before the second reading: authentication of “significant actions” via Max, mandatory registration on “significant resources” exclusively with Russian email services, and opening accounts tied to an INN (Russian taxpayer ID).
• The third package was announced in April 2026 and is has not been introduced publicly yet. The confirmation of “significant actions” is now under discussion. It’s an attempt to bring back the very provision that was beaten back six months ago.

The first attempt happened between December 2025 and February 2026. The second was in March – April, and the third is happening now. Each time the wording changes slightly, but the core idea remains: to narrow the list of legal confirmation methods down to SMS and Max.

Authentication methods: from weakest to strongest

Briefly, here is how the methods differ from one another.

• SMS codes. This is the weakest of the common methods. Vulnerable to interception at the network level (the SS7 protocol), to SIM swapping, and to plain phishing, where victims are tricked into entering data on fake pages. In the current edition of the digital identity guidelines from NIST, the US standards institute (SP 800-63B-4, approved on May 30, 2025), one-time codes delivered by SMS or phone call over the public telephone network are classified as restricted. Service providers may still us them but must warn customers about the risks, offer an alternative, and have a migration plan. The world is gradually moving away from SMS.
• Push confirmation in the service’s own app. This is more reliable than SMS. The confirmation is tied to a specific app on a specific device, and the code does not travel over the network through open telecommunication channels.
• TOTP (a one-time code from an authenticator app). An open global standard described in the RFC 6238 specification. The code is generated on the device from a shared secret and the current time. Nothing is sent over the network, so there is nothing to intercept. This method is independent of any vendor or platform.
• Hardware keys (FIDO2/WebAuthn, passkeys) and biometrics. The top tier of security. They are phishing-resistant by design: the key cryptographically verifies that it is responding to the correct, legitimate site.

Technical breakdown

Let’s get to the heart of the proposed changes. The initiative has three technical flaws, and each one alone would be enough to raise serious concern.

Flaw #1. The law legalizes the weak and bans the strong

If the provision is adopted in the form under discussion, the matrix looks like this.

Confirmation method	Reliability	Status under the initiative
SMS code	Low (SS7 vulnerabilities, SIM swap, phishing)	Permitted
Code in Max	Non-open source, never independently audited, government controlled	Permitted
Push in the service’s own app	Better than SMS	Under question
TOTP (RFC 6238)	High, open standard	De facto squeezed out
Hardware key / passkey	Maximum, phishing-resistant	De facto squeezed out
Biometrics	High	De facto squeezed out

The government proposes keeping two options that are weak in terms of reliability and effectively shutting out the strong ones. Regulation in this configuration runs against engineering logic. Stanislav Seleznev, a digital security expert at the Net Freedoms Project, highlights the open two-factor authentication standard RFC 6238 TOTP. It is not tied to any vendor or platform and remains one of the most widespread and reliable standards in the world. Abandoning it in favor of a proprietary solution requires serious justification. However, no such justification has been provided so far. The programming code of Max is closed and we knew nothing about it, the expert noted: neither how it worked nor how reliable the app itself was.

The financial market shares the same concerns. Denis Kalemberg, CEO of SafeTech, noted that the mandatory Max scheme contradicted the current requirements of the Central Bank of Russia, which called for cryptographic tools to protect transactions. Roman Prokhorov, head of the board of the Financial Innovations association, pointed out that the fraudsters’ primary tool was social engineering, which let them “work” with a victim using scams for days. Increasing the number of authentication channels will not help against this kind of attack. If a user is psychologically manipulated by the attack scenario, they will authenticate the transaction again and again. Therefore, the core problem is that the person is tricked into using these channels in the first place.

Flaw #2. One of the two permitted channels is not permitted everywhere

On the evening of June 3, 2026, Max disappeared from the App Store. Apple attributed the removal to sanctions. iPhone owners are now unable to download the app. Those who had already installed it discovered that notifications stopped working. Maksut Shadaev, the head of Mintsifry, stated:

“Apple has cut off access to the national messenger for more than 20 million users at once.”

That is at least a quarter of Max’s entire audience.

Why did notifications stop coming? On iOS, pushes are delivered through the APNs service using a token that the system issues when the app is installed from App Store. As soon as the app disappears from the store, iOS revokes the token, and Max’s server can no longer “wake up” the app on the device. Messages still get delivered, but silently. This is exactly what Max’s press service advised users: “Check the app manually from time to time so as not to miss any important messages.”

The government proposed building a nationwide system for confirming legally significant actions on a channel that does not exactly work reliably on Apple devices. This is exactly what banks from the National Financial Market Council (NSFR) warned about back in March 2026. As NSFR head Andrei Yemelin put it, mandatory dependence on a single messenger creates a “single point of failure”: any serious technical malfunction or computer incident, such as a DDoS attack on the national messenger, could “halt all legally binding online activity in the country for an indefinite time, including banking operations and transactions.” In June this scenario partially came true even before any law was passed; the point of failure just turned out to be Apple’s decision rather than a DdoS attack.

Seleznev added that push messages were better than SMS, but only if they actually worked – yet the Max messenger could not receive pushes on any Apple devices. There is a partial workaround: one can use the web version at web.max.ru and add it to their Home screen via Safari. It can deliver notifications using PWA technology (the apps of Sber, VTB, and Alfa-Bank operate the same way after being blocked from the App Store). However, this partial workaround via PWA is a far cry from a “reliable channel for nationwide legally binding actions”.

Flaw #3. Max messenger raises concerns

A second authentication factor makes sense only when the channel itself can be trusted. With Max messenger, that is a major weak point.

Max has got no end-to-end encryption and is not open source. Regular chats in Max do not use E2EE. Technically, the server owner has access to the content. The source code is closed, and no independent audit has been announced. There is no way to verify how the confirmation codes are implemented or what the app does beyond what it stated claims.

TLS validation that can be switched off. In mid-May 2026, a researcher nicknamed zarazaexe investigated the app’s APK and (among other things) described the ability to disable TLS validation, meaning the verification of the authenticity of the server certificate the client connects to. Combined with the other functions found (such as harvesting the list of installed apps and contacts, taking screenshots, and covert audio recording), the researcher summarized it as a combination of “hand over everything in memory, and don’t check the certificate of whoever is asking for it.” The fact that certificate verification can be disabled in an app promoted as the national instrument for confirming operations is a direct threat to the very idea of second factor, opening the door to adversary-in-the-middle attacks.

A VPN detection module. On March 5, 2026, a researcher nicknamed runetfreedom published a breakdown of Max’s APK (version 26.4.3) on Habr (a major Russian tech blogging platform). Reverse engineering showed that the app asynchronously obtained the user’s external IP from several sources (the list is shuffled on every launch: half Russian, half foreign). At the same time, it checked the availability of Telegram, WhatsApp, and Google via ping and port 443, and sent the result to a server with a flag indicating an active VPN connection. The multiple IP sources exist precisely to catch users with split routing who do not send their Russian traffic through the tunnel. The module’s traffic is mixed with the main traffic in a closed binary protocol, so it cannot be filtered out without breaking the messenger. According to the researcher, the module itself can be switched on and off remotely from the server, including selectively for specific accounts. Max’s press service denied any surveillance, explaining the requests as WebRTC operations and push checks. However, that did not resolve the underlying questions: why WebRTC would need to ping gosuslugi.ru over ICMP, and why hide “harmless” data in a closed binary protocol.

A weak spot in the authentication itself. Max is tied to a phone number. If the user has not set a cloud password (an additional factor), the protection rests entirely on a single SMS code, which Is susceptible to interception through phishing or SIM swapping. Meanwhile, Max has already become a target for numerous attacks. These include the popular social engineering scenario “you’ve received a code, now read it out to us”, as well as the Mamont trojan. The latter targets Android devices, requesting access to read SMS and notifications and to intercept one-time codes. Building mandatory confirmation of critical operations on a channel that is itself being actively compromised into is a questionable decision.

One detail deserves separate acknowledgment: the confirmation of Gosuslugi (the government services portal) codes via Max does have one sensible feature. The “Confirmation codes” chatbot asks control questions before issuing a code, creating a psychological barrier against reading the code out to a scammer. While the idea is reasonable, it does not cancel out the security flaws listed above, nor does it turn a closed messenger without E2EE and with disableable TLS validation into a reliable foundation for a nationwide system.

What business says

It is interesting not only who objects but also who stays silent.

(Against, publicly.)Artyom Sokolov, president of the Russian Association of Internet Trade Companies (AKIT): even if an alternative is provided (SMS or Max rather than both channels at once), it still does not solve the problem completely. Back in April 2026, during work on the second package, AKIT estimated the cost to business of the mandatory messaging at hundreds of billions of rubles (several billion US dollars) and pointed out that the scheme discriminated against users without a Russian phone number, users in roaming, users in areas with poor coverage, and users who do not have Max installed.

(Against, with restraint.)The RVB group (the merged Wildberries & Russ company, which runs online retail and outdoor advertising) called the initiative in its proposed configuration excessive. These platforms already run a multi-layered system for checking suspicious activity and analyzing risks. Mandatory code delivery “will not lead to a proportional increase in the level of security, but will significantly increase operating costs,” which will ultimately be passed on to end users through higher prices.

(Silent.)The VK holding, online retailer Ozon, Yandex, and VTB bank declined to comment. The Central Bank of Russia, the Sber group (the bank and its related services), and Gazprombank did not respond to Forbes’ questions. The silence is also a signal: after the banks’ March letter against mandatory Max, few are willing to argue with the initiative publicly.

According to a Forbes source, the provision was excluded from the second package at the time precisely because the entire business community opposed it, except for VK (whose subsidiary developed Max) and the telecom operators. The lineup of interests has not changed since.

Signals from the authorities have pointed in different directions. Anton Gorelkin, first deputy chair of the State Duma’s committee on information policy, called the media reports about this initiative an artificial attempt to create a negative backdrop around the national messenger and stated that confirmation of significant actions via Max would not happen. In his words, market participants also opposed the idea. At the same time, he formulated a principle that served as an argument against the initiative:

“Every user should have the right to choose how a given platform requests an access code: via SMS, via the national (or any other) messenger, via a push notification, or via a TOTP generator app.”

Global practice

No developed country requires using a single, closed proprietary messenger.

• United States: In the current edition of its digital identity guidelines (SP 800-63B-4, 2025), the standards institute NIST introduced for the first time a category of “limited” authentication methods and placed SMS and phone-based one-time codes in it. The regulator does not mandate a specific app; instead, it sets requirements for strength and pushes the industry toward authenticator apps, hardware keys, and passkeys.
• European Union. The PSD2 directive and the Strong Customer Authentication (SCA) standard require at least two independent factors from different categories (knowledge, possession, inherence) for electronic payments. The method is not tied to a single governmental channel: banks compete on implementations, ranging from pushes in their own apps to hardware code generators.
• The general principle. In open ecosystems, the regulator describes what the outcome should be (resistance to interception and phishing) rather than dictating a specific tool. Locking an entire country onto one channel is a distinct model characteristic of regimes pursuing “digital sovereignty,” not a global norm.

The arguments in favor of the initiatives sound unconvincing even on purely technical grounds: the task of fighting fraud is solved not by narrowing the list of allowed channels, but by the quality of identification and by risk-based transaction analysis, which Russian platforms already apply.

Recommendations for developers

A caveat up front: we do not know the exact mechanism of this initiative because it is currently described as an intention, and media publications contain no details about authentication methods, types of services, or devices. When more details become known, we will provide more comprehensive recommendations. If you build a service with a Russian audience (a web application, a mobile app, a platform with user accounts), the provision under discussion hits not the interface but the authentication architecture. Right now, we are talking about preparation and risk reduction, not emergency action. But it is worth creating some room to maneuver.

1. Take inventory of your confirmation points: Make a list of all actions that currently require a second factor: logins, password changes, device linking, and critical operations. These will be the first to fall under the definition of “significant actions” if implemented. While there are no clear criteria yet, consider any action that changes account status or moves money as a candidate.
2. Do not tie authentication to a single channel at the design stage: An architecture where the second factor is hard-wired to one delivery method is fragile under any regulation. Keep an abstraction layer over the code delivery provider so that adding or replacing a channel does not require rewriting core backend logic.
3. Keep strong factors as your foundation, not as an option: TOTP (RFC 6238), WebAuthn/passkeys, and push notifications in your own app are what ensure real protection. If regulation forces you to add SMS or Max as an option, let it be exactly that: an addition on top of a strong factor, not a replacement. Do not decrease the overall level of protection for the sake of formal compliance, unless a legal provision directly prohibits such flexibility.
4. Build in risk-based logic:The system itself should determine the required level of confirmation from a combination of contextual factors (device fingerprint, geolocation, user behavior, transaction amount). This is what modern anti-fraud is. This approach is both more effective against social engineering and more flexible for future requirements.
5. Check the scenarios for users outside the Max perimeter. Users without a Russian phone number, users in roaming, users with Apple devices without the app installed, in areas with poor coverage – none of them should lose access if one of the channels is unavailable. Test the degradation in advance: what happens when a push notification in Max does not arrive.
6. Follow the text, not the retellings. Until the bill is published, any deadlines and texts are stories and not the law. The key triggers: the appearance of criteria for “significant actions” and the list that the government is supposed to approve. We will update this analysis when an official document appears.

For those who design 2FA specifically: do not throw away open standards. If any law requires you to support SMS or Max tomorrow, that is no reason to remove TOTP and passkeys today. On the contrary, they will become your way to preserve a decent level of security for those users who care about protection rather than a formal checkbox.

Incidentally, the ban on logging into Russian websites through foreign services (Google, Apple) has been stipulated in the Russian legislation since December 2023 under law No. 406-FZ. Starting July 7, 2026, fines for website owners were introduced for non-compliance. We covered that story in detail. The initiative about Max and SMS comes from the same family of measures fencing off user identification.

If there is any way at all to avoid using Max, recommend that your clients avoid it. Explain to them that the messenger:

• is controlled by a government-connected business,
• is insecure and non-transparent,
• can and will share information with interested security services.

Conclusion

Formally, all of this is presented as “taking care of citizens’ safety”. In practice, the initiative proposes narrowing the list of confirmation methods to two options: SMS, which the world is gradually abandoning, and a proprietary messenger that over the past six months has managed to lose push notifications for a quarter of its audience, earn a reputation as a venue for mass account takeovers, and undergo code analysis that revealed disableable TLS validation and built-in VPN detection.

Publicly, almost everyone in the business community and among technical experts is against it. The only thing working in the provision’s favor is a warped logic in which the convenience of state control matters more than engineering reliability, plus the vague “significant action,” under which, with enough will, all of a user’s online activity can be swept.

For now, this is a discussion. When the same provision comes back for the third time in a single year, we are no longer talking about random initiatives; we are talking about a chosen course. We will keep watching.

This article will be updated when the official text of the third anti-fraud package appears.