"Our plans are the same as they have always been. Our firm position – not to work with the aggressor country – remains unchanged," Tetiana Chorna, Visa's country manager in Ukraine, told Ekonomichna Pravda in March 2025.
Visa and Mastercard pulled out of Russia back in spring 2022. Cards issued by Russian banks under these payment systems stopped working abroad, and Russian nationals lost the access to international payments they had been accustomed to using for everything from booking hotels and paying for Spotify or Netflix to simply paying for groceries at a supermarket checkout with a smartphone.
This gave rise to a new market. Through Telegram bots, little-known financial services offer Russians the chance to obtain a virtual Visa or Mastercard in a matter of minutes, top it up with cryptocurrency or even roubles, and become part of the global payments infrastructure once again.
Some of these services carry out almost no Know Your Customer (KYC) procedures, advertise sky-high payment limits, and explicitly offer the opportunity to pay for foreign services that are unavailable to holders of Russian-issued cards. It's not even Russian banks that are behind them, but chains of intermediaries, offshore companies and licensed financial institutions in various countries.
Ekonomichna Pravda has investigated how this market works, who issues these cards, and how Visa and Mastercard products ultimately end up in Russians' hands, even though the payment systems have officially withdrawn from the country.
A world without Apple Music, Netflix or Steam
Visa and Mastercard payment services ceased to operate in Russia on 10 March 2022. But the cards still worked within Russia because domestic payments were processed through Russia's National Payment Card System (NSPK).
In other words, the Visa or Mastercard logo was still on the physical card, but payments in Russian shops were now processed through Russia's domestic infrastructure.
Outside Russia, Russian-issued cards were now just pieces of plastic. They could no longer be used to pay in shops or withdraw cash abroad, or to buy from online retailers based in other countries.
To enable such cards to continue to be used domestically, Russian banks effectively declared them valid indefinitely. This didn't entirely fix the problem, though. Over time, the international security certificates embedded in the cards' chips began to expire, increasing the risk of technical malfunctions, security vulnerabilities and fraud.
As a result, Russia began to talk about phasing out old Mastercard and Visa cards. According to Russian media reports, the National Payment Card System plans to achieve this by putting economic pressure on banks. This will involve a phased reduction of interchange fees for cards issued under international payment systems.
The plan is expected to be implemented in two stages. The interchange rate is set to be reduced to 1% from the start of 2027, then to zero from the start of 2028. Interchange fees are a source of revenue for the bank that issued the card. If the rate is reduced to zero, banks will have little economic incentive to continue supporting old Mastercard and Visa cards.
In that case, these cards will gradually disappear from circulation, and ultimately Russians will be moved entirely to the domestic payment system, Mir.
The shift to Mir
Although Mir is widely used in Russia, demand for access to global services has not gone away. Russians still want to order products from abroad and use bank cards when travelling.
A new segment of financial services has emerged to meet this demand, consisting mainly of crypto exchanges and little-known platforms that offer virtual cards for cross-border payments.
Ekonomichna Pravda has identified around 50 such services. A significant proportion of them have emerged over the past year or two.
Most of these platforms operate in a similar way. Users obtain a foreign-issued virtual card via a website, Telegram bot or app, top it up with cryptocurrency – usually stablecoins – and receive a balance in dollars or euros.
The card can then be used to pay for online purchases, subscriptions and advertising services, or while travelling. Some platforms also offer physical cards delivered by post.
There are different cards for different purposes. Some are designed to be used with Apple Pay and Google Pay, while others are intended for specific services, subscriptions or advertising platforms. In some cases users are required to undergo KYC procedures, meaning they must verify their identity. But there are also services that explicitly state that no such verification is required.
The key feature of these cards is that they operate through international payment systems. That is what gives Russian users renewed access to the payments that became unavailable to them after Visa and Mastercard withdrew from the Russian market.
An international payment card you can get on Telegram
One of the most popular services that enables Russians to access international payment systems is called CinCin.
CinCin is heavily promoted by Russian and Russian-speaking bloggers. Back in August 2026, they included the rapper and blogger Albert Vasyliev, better known as Kyivstoner, who was later accused by the FSB of being involved in supplying drones used in attacks on Moscow.
CinCin offers virtual Mastercard and Visa cards for international payments. All interaction with users takes place via Telegram. A card can be issued within minutes, after which the user receives the full card number, expiry date, CVV and payment details.
CinCin has a near-identical counterpart, Cinazes. A preview of its website invites users to obtain a virtual Mastercard or Visa card. Cinazes is also actively promoted by Russian bloggers.
"Forget lengthy application forms and tedious checks – your virtual card will be ready in minutes. Want to travel or shop online? Get instant access to a wide range of payment options without the hassle," the website says.
The minimum amount required to create a card is around US$55 for CinCin and US$75 for Cinazes. Part of this covers the card issuance fee, with the remainder credited to the initial balance. The service also charges a 4.5% top-up fee.
Users can top up their balance via the service's internal wallet by transferring USDT on the TRC-20 network. USDT, or Tether, is a digital token known as a stablecoin. Its value is pegged to the US dollar, meaning that one USDT is generally worth around one dollar. TRC-20 is a technical standard used on the Tron network, through which these tokens can be transferred between wallets.
The process is fairly straightforward for users. The service generates a cryptocurrency address to which the user transfers USDT from their crypto wallet or exchange platform. The funds then appear in the service's internal balance and can be used to issue or top up a virtual card.
The service also offers account top-ups through Russia's Faster Payments System. This is a payment infrastructure that enables money to be transferred between banks using a phone number or QR code.
For the user, this works much like an ordinary bank transfer in roubles: the funds are credited to the balance of their account with the service and can then be spent using the virtual card.
Verification is minimal or virtually non-existent. For certain types of cards, the service requires only an email address and even accepts temporary or disposable addresses. A phone number may not be required, and during testing there was no identity verification against reliable sources of identification data.
CinCin claims that its cards can be used to make payments of up to US$50,000 per transaction, US$200,000 per day and US$2 million per month.
Transaction limits on this scale with minimal or no customer identification constitute a serious breach of the generally accepted financial monitoring standards. Essentially this means that CinCin, Cinazes and other similar services may be doing more than just giving Russians access to "prohibited" international payment systems. They could also enable anyone to conduct illicit transactions such as laundering money, financing terrorists, and trafficking weapons, drugs or people.
Through BIN partners in Asia
This gives rise to the question: how is it that services like CinCin and Cinazes are able to offer Mastercard or Visa cards?
They don't generally work with Visa or Mastercard directly. Their cards are issued by a separate issuer, known as a BIN sponsor, which is authorised to work with the relevant payment system. The service enters into an agreement with the BIN sponsor and uses its infrastructure to offer cards to users under its own brand.
According to Ekonomichna Pravda's analysis of two CinCin cards in its possession, CinCin operated through at least two such sponsors until at least autumn 2025. One card had a BIN associated with Sunrate Solutions Limited in Hong Kong, the other with Sunrate Partners UK Limited in Britain.
These findings indicate that Sunrate's card infrastructure was being used, although they do not prove that CinCin works with the company directly rather than through intermediaries.
Sunrate is an international Singapore-based fintech group that provides businesses with international payment, foreign exchange and corporate card issuance services. The company also has offices in Kuala Lumpur, Jakarta, Hong Kong, Shanghai and London.
Sunrate Partners UK Limited is an Electronic Money Institution regulated by the UK's Financial Conduct Authority (FCA), while Sunrate Solutions Limited in Hong Kong holds a Money Service Operator licence.
Sunrate says it became a Mastercard Principal Member in 2020 and obtained the equivalent status with Visa in 2021. This grants the company direct access to the payment networks and the ability to issue cards. Sunrate also issues virtual cards through its own platform and API.
Generally, the use of BIN sponsors through Asian fintech companies is common practice among services of this kind. In various platforms' terms of service, Ekonomichna Pravda repeatedly found references to Hong Kong and Singapore-based companies through which cards are issued.
Cinazes has a similar arrangement which allows users to obtain virtual cards with almost no identity checks. By examining one such card, for example, Ekonomichna Pravda was able to establish that it operates through Singapore-based fintech company UQPAY.
UQPAY provides businesses with payment infrastructure, including international money transfers, payment acceptance, foreign exchange and the issuance of physical and virtual cards. The company's status as a payment institution is confirmed by Singapore's financial regulator.
The company also says it is authorised to issue and service Visa cards. Separately, UQPAY says it is a Mastercard Principal Member for acquiring, i.e. the acceptance and processing of payments.
Why this works at all
Visa and Mastercard themselves have not entered into any agreements with CinCin or similar services, and this is where one of the main problems lies.
Payment systems do not necessarily open accounts for individual users themselves. They operate global payment networks, while cards are issued by banks and financial companies that have access to those networks. Those institutions, in turn, may work with other fintech companies, processing platforms and card programmes. The longer this chain becomes, the harder it is to determine who has ultimately obtained a card and what they are using it for.
Formally, Visa and Mastercard's withdrawal from Russia primarily means that Russian banks can no longer issue cards under these payment systems. But if, for example, a company in the UK, Hong Kong or another jurisdiction issues such a card, and an intermediary then sells it on to a Russian customer, the nature of the relationship is completely different.
Visa and Mastercard may not work with Russian banks at the level of their publicly stated policies, but their cards can still reach Russian users through third parties. It is this loophole that CinCin, Cinazes and other services are exploiting to restore Russians' access to international payments.
Ekonomichna Pravda contacted Visa and Mastercard to ask whether they were aware of the existence of services being used to circumvent these restrictions. We received the following responses.
Visa's press office said: "Visa announced the suspension of its operations in Russia on 5 March 2022, and that decision remains in effect today. Under Visa's rules, an issuer must not solicit customers or issue Visa cards outside the country in which it is licensed to conduct card-issuing activities. This rule has been in place for many years, applies across all regions and was not introduced in connection with Visa's withdrawal from Russia in 2022. All Visa products must be issued in accordance with Visa's rules and applicable law, including Know Your Customer (KYC) and anti-money laundering (AML) requirements."
Mastercard gave a similar response: "Mastercard operates in accordance with applicable laws, regulatory and sanctions requirements, and requires all participants in its network to comply with them. The use of reloadable cards on the Mastercard network without completing KYC procedures, with the exception of gift cards, is not permitted. If we identify indications of, or receive information about, such activity, we conduct a review to ensure that all parties comply with local laws as well as our rules and standards."
The issue is that the services investigated by Ekonomichna Pravda did not comply with either KYC or AML procedures. It is therefore reasonable to assume that such cards could be used not only by a hypothetical "Vanya from Uryupinsk" [an ordinary Russian citizen from a small village out in the sticks – ed.] who wants to pay for ChatGPT, but also by an organ trafficker or weapons manufacturer. The cards' limits are high enough to accommodate transactions of that kind.
Visa and Mastercard do not operate like banks. They don't issue cards to end customers or hold their money in accounts. Their core business is running the global networks through which payments are processed. The more cards are used and the more transactions pass through these networks, the more revenue the payment systems generate from various network and processing fees.
So for Visa and Mastercard, increasing transaction volumes and the number of cards in circulation is part of their business model. Of course, that does not prove that the companies benefit from the market for workaround cards or that they are knowingly allowing sanctions to be circumvented. To reach that conclusion one would require data on specific card programmes, their transaction volumes, and what the payment systems themselves knew about them.
This business model does, however, create an apparent conflict of incentives. On the one hand, Visa and Mastercard have an interest in their networks being used as extensively as possible. On the other, they are responsible for setting the rules for participants in those networks and for monitoring the associated risks.
Officially, of course, neither Visa nor Mastercard has returned to the Russian market.
But the question is: how clearly can the world's biggest payment systems see what is happening at the second, third or fourth tier of their partner networks? And what action do they take when their infrastructure ultimately ends up being used for precisely the kind of activity they publicly withdrew from in 2022?
Ihor Pylypiv, Alina Poliakova
Translated by Myroslava Zavadska
Edited by Teresa Pearce