Romanian law enforcement authorities have conducted searches as part of an investigation into a criminal network involved in producing fake passports and birth certificates for residents of former Soviet states, primarily citizens of Russia.
Approximately 300 Russian nationals illegally obtained Romanian identity and citizenship documents between 2022 and 2024. Among the beneficiaries of this “shadow scheme” were Russian oligarchs, businessmen, and even criminals wanted by Russian law enforcement.
Prosecutors and police carried out searches at 17 locations — including private homes and several government buildings. According to the Romanian Prosecutor’s Office, the purpose of the investigation is to expose a criminal network that, with the help of officials from the population registration service and the Suceava County municipality, had for some time issued Romanian identity documents that falsely certified residency and artificially granted Romanian citizenship. These documents were then issued to individuals born in Russia, Moldova, and other former Soviet republics.
Romanian media report that Russian citizens were willing to pay between €15,000 and €40,000 to obtain Romanian documents. Some used the personal data of Ukrainian soldiers who were killed in the Russian–Ukrainian war. Prosecutors emphasize that beneficiaries received identity cards confirming residency in abandoned or non-existent buildings, or without the consent of the legitimate owners, based on falsified residency declarations. Moreover, the documents were issued without the physical presence of the applicants at the registration office.
Investigative journalists following the case believe that Russians most likely used cross-border networks exploiting legal loopholes and the absence of a centralized database to verify certificates of Romanian citizenship issued by Romanian consulates abroad, including those in Russia and Turkey. Around 280 Russians presented fake Romanian citizenship certificates allegedly issued by consulates abroad.
Another method of fraud involves roughly 20 confirmed cases (though their number may be far higher) in which Russians stole and used the personal data of Ukrainian soldiers killed during Russia’s full-scale invasion. By paying bribes of around €15,000 to civil servants in northern Romania’s population registration service, Russians obtained Romanian identity documents using the stolen personal data.
Romanian law enforcement carried out 93 searches in a related case involving bribery and computer forgery by public officials in Suceava County. Investigators report that in 2023–2024, around 1,700 individuals born in Russia, Moldova, and other former Soviet republics were granted fake residency in Romania. Prosecutors believe the real number could exceed 7,000.
In December 2024, it became known that Russian billionaire Sergey Lomakin — whose fortune Forbes estimates at $2 billion — applied for Moldovan citizenship using forged documents. Lomakin falsified his birth certificate to claim his mother was allegedly born in Moldova. Moldova’s Public Services Agency uncovered the forgery and rejected his application. Lomakin has close ties to the Kremlin and provides significant revenue to the Russian state through his businesses, including retail chains such as Kopeyka, Modis, Fix Price, and CentrObuv.
In April 2024, a special commission in Bulgaria revealed that after February 2022, 343 Russian applicants seeking Bulgarian citizenship had submitted falsified documents. The commission expressed deep concern about the implications of this trend and emphasized the vulnerability of the citizenship-granting system regarding individuals from a country that declared Bulgaria a “hostile state.”
We assess with high confidence that the document-processing pipeline through which Russian nationals obtain EU citizenship is operating under the supervision of Russian intelligence services. Moscow uses this mechanism to infiltrate intelligence assets into EU member states amid escalating tensions with Brussels and potential preparation for military and hybrid operations in Europe.
Given these risks, there is an urgent need for comprehensive verification of the legitimacy and authenticity of all documentation submitted by Russian nationals for EU citizenship since 2014.
- High confidence: Russian intelligence is supervising or facilitating the fraudulent document pipeline.
- Moderate confidence: Criminal networks involved may overlap with Russian organized crime used historically by FSB/GRU.
- Low confidence: The Romanian case may be part of a wider strategic infiltration plan coordinated at the Russian state level.
Indicators of Expanded Russian Infiltration Operations in the EU
- Sudden increase in Russian applications for citizenship in smaller EU states.
- Use of forged Moldovan/Bulgarian documents in Schengen border checks.
- Unexplained growth in Romanian “new residents” from ex-USSR states.
- Surge in requests for Romanian birth records or archival documents abroad.
- Appearance of identical residency addresses used by dozens of applicants.
- Growth of cross-border legal firms specializing in “citizenship assistance.”
This predicts future risks.
A Threat Actor Typology
Map which Russian groups are most likely behind this pipeline:
Threat Actors
- FSB (most likely supervisor)
- Handles diaspora, “illegals,” covert assets.
- Has history of using forged passports for infiltration (e.g., “Second Department”).
- GRU (military intelligence)
- Uses foreign identities for logistics and covert operations.
- Has precedent (Skripal attackers using fake identities).
- SVR (foreign intelligence)
- Manages long-term embedded assets (“sleepers”).
- Most likely to use EU citizenship for deep-cover operatives.
- Russian organized crime groups with state links
- Solntsevskaya
- Tambov/Malyshev
- “Thieves-in-law” networks
- Often used as cut-outs by FSB/GRU.
This clarifies operational responsibility.
Vulnerability Assessment (EU-Wide)
High Vulnerability
- Romania,
- Bulgaria,
- Slovakia,
- Cyprus,
- Greece,
- Malta,
Reasons:
- Underfunded registry systems
- High corruption exposure
- Consular weaknesses
- Large diaspora from ex-USSR states
- Incomplete digitization
Moderate Vulnerability
- Poland;
- Hungary;
- Portugal;
- Spain;
Low Vulnerability
- Scandinavia, France, Germany, Baltics (due to strong oversight)
Strategic Motives Behind Russia’s Operation
Primary Motives
- Infiltration of intelligence assets into the EU
- Creation of “clean” EU identities for covert actions
- Safe evacuation routes for Russian elites under sanctions
- Financial mobility (banking, real estate)
- Procurement channels using EU citizens to bypass export controls
- Hybrid warfare logistics (safehouses, transport, shell companies)
This ties the criminal scheme to geopolitical aims.
Scenarios (Most Likely / Most Dangerous)
Short intelligence-style matrix:
Scenario 1 — Most Likely:
Russia expands the operation into Slovakia, Czechia, and Cyprus.
Impact: moderate-high.
Scenario 2 — Most Dangerous:
Russian assets with EU citizenship conduct sabotage in NATO states.
Impact: extremely high.
Scenario 3 — Worst for EU Internal Security:
A forged-ID holder is involved in an assassination or critical-infrastructure attack.
Impact: catastrophic.
This elevates the paper to strategic warning level.
Historical Intelligence Context
Show that Russia has used forged documents for decades:
- Cold War KGB “illegals program” (deep-cover operatives using false identities).
- Assassinations abroad (Litvinenko, Skripal — GRU operatives with fraudulent passports).
- Russian mafia networks used for logistics in Europe.
- FSB involvement in document fraud in Baltic states (1990s–2000s).
This proves the current operation is not random — it is doctrinal.
Counterintelligence Recommendations Section
EU agencies should:
- Retrospective rescreening of all Russian & Belarusian citizenship claims since 2014.
- Mandatory biometric cross-checking with Ukrainian casualty databases.
- Integration of Romanian registry data into an EU-wide identity system.
- Sanctions against Romanian/Bulgarian officials involved.
- Monitoring of Russian diaspora organizations linked to consulate networks.
- Closer Europol–SIS II cooperation on document fraud.
This makes the paper actionable for decision-makers.
