The application has become part of the daily lives of millions of people, and along with this, two categories of claims have accumulated around it, that is, real risks that are worth knowing about, and rumors that regularly spread across the internet. Let's look at both, and start with how it works in general, since most practical conclusions follow from this.

What the Application Does and Does Not Do

Diia does not store your documents in its memory, but displays data from state registers. That is, access depends on the operation of the registers and the availability of the internet, while the documents themselves are not physically stored on your phone. The first practical conclusion follows from this. The application is a convenient tool for daily use, but it is not your own archive, so copies of important documents should be kept separately, and I wrote about this in the material about a digital archive. The second conclusion concerns security. The weak point here is not the application itself, but the phone and the person, since the majority of real incidents occur through social engineering rather than through a technical hack.

The Main Rule

The application should be installed exclusively from the App Store or Google Play. This wording comes from the service's official team, and it appeared after a specific incident. In June 2026, scammers created a website with a domain similar to the official address of the state portal and offered visitors to install a supposedly updated application directly through the browser. The vector was atypical, since instead of the usual message with a link, they used a fake website with a plausible address. The practical rule is simple. No government service asks you to install something through a browser or via a third-party link, and any such offer means an attempt to install malicious software on your phone.

The Most Dangerous Scheme

Manipulations around the electronic signature deserve special attention, since their consequences are the most difficult to reverse. The mechanics look like this. Under the pretext of identity verification or application confirmation, a person is directed to a fake biometric verification page, after completing which a loan is issued in their name. The particular insidiousness lies in the fact that the person really does go through the procedure, that is, looks into the camera and confirms their identity, they simply do it not where they think they are doing it. Because of this, it is worth remembering several things. Complete biometric verification only in the application itself, which you opened yourself, and not through a link sent to you by anyone.

Never undergo such a verification at the request of an interlocutor in a messenger, even if they claim to represent a bank, financial company, or government institution. If you are asked to confirm your identity for something that you did not initiate yourself, it is fraud regardless of the explanations.

Fake Bots and Channels

Messengers have now become the main field for phishing, and the scheme here is standard. Scammers create channels and bots with the names of well-known companies, adding words such as official, bot, or promo to them, after which they try to obtain an SMS code or card details from a person. Here it is useful to remember a principle that always works. Legitimate financial institutions never ask for one-time passwords through messengers. The same principle applies to government services, since a confirmation code exists precisely to confirm that you are personally performing the action, and therefore a request to tell it to someone means an attempt to log in instead of you.

About the Rumors

A telling example was the spread of false information about supposedly sending summonses through the application, and the ministry stated that the source of this information turned out to be a fake website not connected with government authorities. The mechanism here is the same as in any information manipulation, that is, the claim is launched from a resource that looks official, after which it spreads through messengers without any mention of the source. Practical protection consists in checking the primary source, and I wrote separately about how to do this in a material about recognizing fakes. For government services, the rule is simple, since official information is published on government websites in the gov.ua zone and in official channels of government agencies, and not on resources with similar names.

Application Security Is Phone Security

Since the application is protected by a code or biometrics, access to it means access to your phone, and vice versa. Therefore, basic things matter more than any settings inside the service. Set a strong screen lock code, since without it biometrics are not a full-fledged protection. Do not give your unlocked phone to other people. Do not install applications from unknown sources, since malicious software with the appropriate permissions can intercept what is happening on the screen. Update the system, because updates are what close vulnerabilities through which infection is possible. Enable the device-finding function in advance, and I wrote separately about the full procedure for what to do when you lose your phone.

How to Check Whether a Loan Has Been Issued in Your Name

Since the main purpose of the described schemes is precisely this, checking has practical value.

You can find out about an unauthorized loan in your name through the Ukrainian Bureau of Credit Histories, where the corresponding service is available. It is worth carrying out such a check after any suspicious incident, as well as periodically, since a person usually learns about an issued loan with a delay, when calls about the debt begin. If a loan is actually discovered, an application to the police and a written appeal to the financial institution itself are required, and the recorded fact of fraud with a specific date is your main argument.

What Official Services Never Do

  1. Do not ask you to install an application via a link from a message.
  2. Do not ask you to tell them an SMS code.
  3. Do not ask you to undergo biometric verification via a link in a messenger.
  4. Do not demand immediate action under the threat of losing payments, documents, or access.
  5. Do not write to you first from private accounts in messengers.
  6. Do not ask you to transfer money to any account for verification or unblocking.


Sources: Cyber Police Department of the National Police of Ukraine, Ministry of Digital Transformation, Speka publications, Judicial and Legal Newspaper, Ukrainian Bureau of Credit Histories