Russia's Ministry of Digital Development demands 3-year user data storage and IP locks for virtual PBX to stop scammers

The Russian Ministry of Digital Development has drafted a sweeping third package of anti-fraud regulations, setting its sights on tightening the screws across the entire telecommunications sector. Sites and apps will soon be legally required to archive user registration, authorization, and account deletion histories for a full three years, ready to hand over to security forces upon request.

Virtual PBX services are facing an equally strict digital border wall, with platforms restricted strictly to operating via local IP addresses. Hosting providers must funnel their resources exclusively through domestic infrastructure and register their network addresses in a centralized government registry, effectively grounding cloud-based telephony.

Telecom operators are not escaping the bureaucratic net either, facing a strict ban on displaying personal data of recipients or their relatives inside text message blasts. At the same time, carriers must stockpile subscriber IP addresses and port details tied to the exact second a service contract was signed, alongside funneling stolen numbers and unauthorized access credentials directly into the State Information System 'Antifraud'.

Industry heavyweights and telecom associations are already pointing out major operational headaches, noting that tracking personal data in routine text alerts is practically impossible when bills, balances, and tariff names constantly change. Meanwhile, privacy experts highlight how folding illegally obtained data into state registries conveniently bypasses standard legal hurdles regarding user consent revocation.

Bureaucracy has officially found a way to weaponize scammer databases while simultaneously turning every routine text message into a potential compliance nightmare. When fighting cybercrime requires rewriting the laws of physics and data privacy, the administrative paper trail always grows longer than the actual code.