The digital hunt for the Russians smuggling EU cars
By Madeleine Cuckson, Aleksandr Atasuntsev & Joel Schülin
Published on November 7, 2025
"Today I want to tell you how we transfer [the car] to you," the man tells the thousands of users on the Russian social media channel. In a one-minute video, he outlines how his company imports luxury cars from Germany to Russia despite European Union sanctions.
A blurred out screengrab from the video posted on Telegram
The social media channel this video appears on is one of dozens of Russian-language groups claiming to help Russians skirt sanctions and import luxury goods. They are open and easily accessible - publicly flouting the EU sanctions to thousands of followers. But while the schemes are often real the video is not - in fact it is created with AI using footage of a real business owner without his knowledge.
A joint investigation by Airwars and IStories tracked thousands of images and videos on Russian Telegram channels advertising sanctioned cars from the EU.
What started as an attempt to identify the smugglers and patterns behind the multimillion euro schemes merged into a deeper mystery - one of stolen identities, crypto trading, paid actors, and AI-altered media. With Russian citizens being scammed in complex schemes initially linked to Germany and Belarus but later pointing towards Ukraine, the investigation shows how new technologies may be supercharging the virtual front of the war in Europe's east.
EU smuggling routes
After Russia's full-scale invasion of Ukraine in 2022, the EU imposed some of the strictest sanctions in its history - aimed at crippling the Russian economy and stifling the war effort. In response, Moscow has developed ways to skirt them and limit the impact on its citizens.
Chief among these has been establishing new trade routes, but smuggling across the EU's borders has also grown. Millions of euros of goods registered as transiting through Russia have reportedly been sold in the Russian market, including many luxury goods - allowing wealthy Russians to maintain high-end lifestyles.
In the car market, World Bank data shows an almost 10-fold increase in Chinese declared car exports to Russia since 2022, sanctions expert Ian Matthews said, but there remains a continued demand in Russia for "predominantly-Western luxury vehicles. Much of this demand will be met through smuggling or circumvention."
Germany has been a hub - with high-end cars typically exported via Poland and Lithuania into Belarus and other nations neighbouring Russia, before crossing the border. On Telegram, a social media platform and messaging app popular in Russia, dozens of channels advertise luxury goods from the EU. This investigation sought to use open source reporting to catch them at it - tracking the trade in real time.
A typical post on a Russian-language Telegram channel advertising cars from the EU
We began by monitoring at scale - reviewing footage from a number of Russian-language channels claiming to import cars from the EU. Typically these posts feature multiple images, and sometimes videos, of a single car in a lot, along with full specifications.
We analysed hundreds of posts - looking for clues in the pictures to help geolocate them. We found dozens across Germany, Lithuania and Estonia.
Dealership Locations
Transit Locations
Buyer Locations
Map showing dealership, transit and buyer locations geolocated by the investigative team through open source research
To go deeper into the trade, the investigations team focussed on one of the biggest channels - Automobiles from Europe! With more than 15,000 members, in the past year it has posted more than 650 cars reportedly for sale from across the EU, with an advertised cost of more than 11 million euro.
Over several months we tracked every post on the channel - seeking to understand patterns in how the company operated, where they brought the cars from and how they skirted sanctions. The team also spoke with smugglers, sanctions experts and traders.
We tracked cars advertised on the channel to dealerships in Germany. But the posts did not come consistently from one dealership or even one region, with the images located around the country.
Map of Russian Telegram posts advertising cars geolocated in Germany. Most of those advertised are sanctioned under EU rules which prohibit sale of cars with engines larger than 1.9 litres, all hybrid and electric cars and those valued over 50,000 euro.
Seeking further confirmation of exactly how the channel operates, we scoured the postings looking for Vehicle Identification Numbers (VINs). VIN codes are unique to each car and allow cross-border tracking. They are typically visible under a car's hood, on the dashboard or in the driver's side door. In most posts these codes were not visible or too poor quality to read. In three, however, we identified the VIN code.
VIN number of a BMW 520 found in one of the telegram posts advertising cars
Russian databases of imported cars have leaked in recent years, so we cross-checked them with these lists - hoping to track exactly where a German car ended up in Russia. Yet none of the three VIN codes appeared in the searches, raising concerns about whether the advertised cars were all being delivered.
The channel also frequently posts videos of clients who have received their cars - mostly thanking the channel for the speedy delivery and quality of the vehicle.
The team geolocated these clients all over Russia, from Moscow to Novosibirsk as well as two in occupied Ukrainian territory. In one video a man stands outside the Donbas Arena, in another a man is outside the entrance sign to Luhansk - two regions of Ukraine under full Russian control.
Map of 'customers' in Russia who claimed to have bought cars from the Telegram channel 'Automobiles from Europe!'
In many cases, the sales appeared to be clear evidence of the sanctions avoidance scheme. But who were these customers?
We began tracing the 'buyers.' Using facial recognition tools, we matched three to their social media accounts. We messaged them, pretending to be new customers looking for advice on buying cars through the scheme.
One denied all knowledge of the video. A second woman turned out to be a small-time influencer who advertises paid content online. Her delivery in the video was robotic, suggesting she was reading from a script.
A third, called Natalia, said it wasn't her and hung up, though her WhatsApp photo matched her profile on the VK Russian social network. The video of the car she was sitting in - a Mazda CX-5 - included the number plate, allowing us to search it in Russian leaked data. It showed Natalia had owned the car since 2018. Increasingly the evidence of satisfied customers seemed suspect, raising the likelihood of paid promotion.
A Telegram post showing 'Natalia' thanking the owner of the channel for delivering her car. Records showed the car appeared to be purchased years prior.
"That's not me"
Then, in summer 2025 the channel posted a video that appeared to be a key clue. It showed a man in a blue jumper in a non-descript office talking directly into the camera. In a little over a minute he talks through how the car smuggling scheme works - who the contract is paid to, where the car comes from and how they get it to Moscow. He reassures potential customers that upon purchase they will receive an inspection report and an official document confirming the car was tested at a certified center in Germany.
For the first time, the scheme had a face.
In the video the man didn't identify himself, but by putting the footage through facial recognition software we identified him as a car trader based in central Russia - more than 2,500 miles from the nearest European Union country. We have chosen not to name him.
For a month we dug deep into the channel and the man's other businesses. In early October we messaged him pretending to be interested in buying a car from Germany. "I don't do that," he said. Figuring he may have been spooked as we were contacting him on his personal number, we sent him the video of him describing the scheme. What happened next shocked us.
He called our reporter, furious. "This isn't me. I am going to sue them."
He was insistent the footage was faked. He didn't know the Telegram channel but thought the fake could be a plan to use his credibility in order to be trusted - as he is relatively well known in the legitimate car trading business in Russia.
We sent the footage to A.I. experts who confirmed the film was manipulated. The channel had taken the original footage - filmed in his office six years earlier - and put fake audio on top, with his lips artificially altered to match the script. We eventually found the original footage - promotional material for his company - and confirmed that a calendar in the background said 2018-19.
Top: A calendar in the original footage showed the year 2018-19 but was too blurry to easily spot in the later AI-powered Telegram post
Bottom: Synchronising the mouth movements from the two videos illustrates the subtle changes through AI manipulation
AI-powered scams?
With the businessman not involved, we tried to understand how much of the channel's content was real - and how much AI was feeding into it.
The channel names two managers, supposedly called Ksenia and Konstantin, each with a personal Russian phone number listed. Potential buyers are invited to reach out. They, at least, were real people - though likely fake names.
We started with Konstantin. Posing as a buyer interested in a car posted on the channel that we had geolocated to Germany, we messaged him on Telegram. He was direct and pretty blunt. The car, he told us, had already "left Germany" and was now "at the border of Lithuania and Belarus." When we asked to visit the site in person, or get more photos, he ended the conversation.
The number he used was also dubious. When we ran it through a leaked Russian database, it appeared to be registered to a man with an Armenian name - suggesting Konstantin's account had been bought or reassigned.
Next, we contacted Ksenia. She explained how the business worked: "Even cars under sanctions can pass the border," she said, "you just pay the taxes at the border, and we only make money from commission - that's why the cars are so cheap." Those 'taxes,' she added, allowed them to move cars that would otherwise be banned - those with above 1.9 litre engines, high-value or hybrid and electric models.
'Ksenia's' Whatsapp picture was a stock image of a woman driving an Audi
She told us the crossing used was the Šalčininkai-Benyakoni checkpoint between Lithuania and Belarus, one of two routes still open for commercial traffic. When we pressed for a meeting at the site she told us it has a "guard and is locked." Then she claimed to have fallen ill.
We reached out to Ksenia a second time from a different number, posing as a different buyer. She claimed that the man in the deepfaked promotional video was the company's deputy director. Soon after, she sent over a contract template for us to review before choosing a car and signing a real contract.
It listed a company naming a director 'Lyudmila' and giving a company address in Smolensk, near the Belarusian border. On paper, it looked legitimate. Ksenia claimed that Lyudmila was the company's director.
Russian corporate records for that company showed it was registered in October 2022. Its founder - a man named Sergey - is a Belarusian national doing business in Russia. When we reached him through a leaked personal number, he said the firm only dealt in spare parts, not cars. He denied any involvement with Automobiles from Europe. "It's a scam," he said flatly. "Let’s see this through to the end and file a report for fraud".
The Ukraine connection?
We eventually discovered a Russian online forum post warning users about the channel Automobiles from Europe, including screenshots of reviews from people claiming they had been scammed.
We contacted several victims through their reviews. One man, Aleksandr, agreed to speak. In March 2025, his wife Veronika signed a contract to purchase a Hyundai Tucson. They shared with our reporter screenshots of the contract, a report they filed with the Russian police, a recording of their conversation with the channel manager, and many faked documents - including from a German car salesman and from a Belarus customs office.
Aleksandr said they negotiated the agreement with Konstantin but transferred money to two accounts belonging to men named Dmitry and Nikita. When the car didn't arrive, they called Konstantin repeatedly. He ignored them, insisting they still owed a "border fee" to move the vehicle across Europe. The couple say they lost more than two million rubles (21,500 euro).
The couple then messaged Dmitry and Nikita on Telegram - with both denying knowledge of the deal. Eventually Nikita admitted he had been paid 50 euro to open a bank account and hand over its details to someone else.
Finally the couple called 'Konstantin' and secretly recorded it - with Aleksandr pressing him on where the payments were going.
Where did you get the data for those invoices?
Good people who are located on the territory and help us.
On the territory of what?
I won't say, it's a secret.
Eventually, Konstantin claimed there was a line in the contract they signed about it being a 'charity payment.' "Some kind of fundraising campaign is taking place across the whole territory of Russia," he told them.
The man spoke Russian with hints of a Ukrainian accent - and at points used Ukrainian words, prompting Aleksandr to ask where he was. He refused to say. We sent the recording to several native Ukrainian speakers, who confirmed there was a strong likelihood the man spoke Ukrainian.
The 'fundraising campaign' he referenced may refer to funding for the Ukrainian military. Ukraine has become a hub for telephone and cyber scammers - including scamming Russian men out of thousands of euros via dating apps. The scam centres allegedly put money they make into funding Ukraine’s military.
In a last attempt to get answers, Aleksandr and his wife say they submitted fake paperwork to Konstantin - documents which, when opened, would reveal where they were accessed from by showing the IP address. The location was sometimes in the Moscow region and other times in Ukraine.
Blocked…
Seeking to understand the potential Ukrainian connection to the scam, one of our researchers called Ksenia speaking Ukrainian - pretending we were couriers with a package for her. She didn't hang up but replied in Russian, "I haven't ordered anything."
In Russia, answering a Ukrainian call is unusual and very risky. Yet she continued talking, commenting that it was "very funny" someone had given us her details. While she never spoke Ukrainian, she understood what was being said and responded. While Russian and Ukrainian have similarities, very few Russians learn Ukrainian or would fully understand a conversation.
Finally, we contacted the channel manager Ksenia again from a new number, and asked to buy an Audi A6 - a model banned under EU sanctions.
She replied, and days later she sent a draft contract which listed the same company as the previous contract template we received with Lyudmila named as the director. Soon after, we received an invoice.
It named a woman called Alina as the 'broker' at the Belarus-Russia border, the person to whom we were told to transfer the money. The first amount due was just over 6,000 euro of a total cost of 54,000 euro (around five million rubles).
When we asked for proof that the car existed, a photo arrived within an hour, supposedly showing the Audi at customs. There was no evidence it was at the border or that it was taken that day. Another image followed, this time a Belarus border customs document.
Alina's contact details included a bank account and a crypto wallet. The wallet turned out to be brand new and empty.
We contacted Alina - who was alarmed. Her boyfriend took the phone and admitted he had set up the bank account in Alina's name. He said people send him requests anonymously and he takes a small cut and transfers them the money in crypto.
Eventually, we contacted Ksenia and Konstantin directly, revealing we were journalists and inviting them to speak anonymously. Both immediately blocked us. Telegram did not respond to a request for comment.
As the Ukraine war nears its fourth year, critics say the EU sanctions aimed to cripple Russia's war economy have failed to achieve their goals - with the Russian economy redesigned to limit the impact. But the sanctions have helped create the conditions for smugglers - and seemingly for scamsters - to thrive.
During this investigation, Airwars researchers worked with the Starling Lab for Data Integrity - co-anchored at Stanford and USC - in a pilot project focussed on digital preservation of online material to the highest standards.
Throughout the process our researchers systematically marked Telegram posts and web pages for preservation to defend against their disappearance from the Internet. The team at the Starling Lab then created an ad-hoc pipeline to preserve these resources without slowing down or hampering the investigation process.
The entire Telegram channel, as well as each link in the story, was crawled and preserved using state-of-the-art forensic web capture. Timestamped and notarised versions of the resulting more than 7,500 capsules are being retained. As part of its remit, the Starling Lab aims to inform legal and investigative practices as to the value of web archives, collected in various ways, so they might be used as evidence with the greatest possible confidence and reliability.
