How Donations Can Be Detected When Crossing the Border and How to Protect Yourself

There have been known cases where people were detained for directly donating or attempting to donate using Belarusian bank cards. This method is the easiest for security forces to track.

Banking apps and crypto wallets

Belarusian security forces use the Russian “Mobile Forensic Expert” program. It allows for automatic scanning and analysis of banking applications — even those of foreign banks.

The program extracts the entire payment history from bank databases: exact time, amount, currency, recipient's account/card number, and payment purpose (comment). These fields can reveal words like “donation,” “help,” “charity,” “fundraiser,” or the names of foundations and initiatives.

Even if the banking application itself is deleted, hidden, or password-protected on the phone, the system notification databases (Notification Center on iOS or Notification Listener on Android) often retain the text of all push notifications about successful fund debits, including the amount and service/recipient.

The Russian software can also search for deleted entries in banking application databases (.wal, .journal). This means that even if data was deleted (for example, if you destroyed a card or made a donation with a single-use one), there's a chance it can be recovered.

“Mobile Forensic Expert” can similarly analyze accounts on crypto exchanges and in mobile crypto wallets. The scheme is exactly the same as with banking applications.

If the history on the phone itself has been cleared, but authorization tokens or passwords remain, the tool can connect directly to the servers or web versions of certain services and crypto exchanges (e.g., Binance) to download the complete transaction history.

A pre-prepared list of bank accounts, card numbers, or crypto addresses (e.g., official details of support funds, crowdfunding campaigns, or organizations) can be uploaded to the program. The software will automatically scan all financial applications on the device and highlight matches.

This suggests that security forces use this capability, among other things, to find donations from foreign cards made by people living abroad. Extracting this information takes minutes.

Typically, people are not immediately detained for crypto donations — matching a crypto wallet to an organization requires additional time, and there are so many fundraising efforts that it's unrealistic to blacklist them all. However, a match can eventually be made, as the wallets of those collecting funds usually do not change.

However, there's another method. There is a known case where the major exchange Binance handed over data on donations made by six Russian citizens in support of Ukraine to security forces. As a result, Russian citizen Yuri Belenky, who had permanently resided in Bulgaria since 2015, was sentenced to a long term.

The file Binance provided to the Russian Investigative Committee contained a detailed account history from the moment of registration, including the full transaction history. He himself was unaware of this.

Conversations with others

In one of the cases known to us, the person's phone was completely clean.

However, a conversation about a donation was found on a computer where Telegram was installed.

It's possible that “Mobile Forensic Expert” also assisted security forces in this instance. It can scan conversations for keywords, find donations through screenshots, recognize voices, and search for account numbers and crypto wallet addresses in correspondence.

If a dialogue or individual messages about donations were deleted, the program attempts to retrieve them from unallocated memory and SQLite databases before they are overwritten by other information.

When you make a donation, you typically receive a notification of a successful donation or a thank-you email to the address linked to the payment. Security forces have methods to analyze such information, and such a message can certainly serve as evidence in court.

How to protect yourself

“You should cross the border with a feature phone. You can take photos with loved ones using their phones, and they can send you the pictures later. You can manage for a couple of weeks without a smartphone. Is it worth the risk?

Or with an old smartphone containing a dozen essential numbers and no messengers,” suggests an interviewee who has suffered due to donations.

Representatives of the “Cyberbeaver” initiative state that it's impossible to fully protect oneself from persecution for donations simply by wiping a phone or choosing the “right” device.

“In the case of donations, the device itself is not always the primary risk. It's usually possible — and even necessary — to clear data from a phone, but deleting information about donations isn't always that simple. And if payment data exists with a Belarusian bank, there's little you can do.

When it comes to donations, the first questions to ask yourself before traveling aren't about your phone model. Which card did you use for donations and how? Were any payments made from a Belarusian card? Could the charitable organization to which you transferred money have been subjected to a data leak?

During a border inspection, the main threat might not be the specialized software available to security forces, but rather the ordinary human factor — if you are asked to unlock your phone and find and show specific information, no one can guarantee who will do what with it in that particular situation.”

The representatives of “Cyberbeaver” say that it is most difficult to extract data from modern devices with up-to-date security updates, such as the latest iPhone models on fresh iOS and Google Pixel. Older models that no longer receive updates and budget Android smartphones are more vulnerable. However, it's impossible to guarantee that a specific model cannot be hacked.

“Neither Cellebrite nor 'Mobile Forensic Expert' can recover deleted data if the deletion was done well in advance, and not just an hour before inspection. Therefore, we recommend thoroughly cleaning your devices beforehand or taking 'clean' ones when crossing the border,” say the representatives of “Cyberbeaver.”

Here is the checklist for inspection that they propose:

• Banking apps and messages — transaction history, SMS and push notifications about debits, emails with receipts, screenshots of transfers in the gallery;
• Crypto wallets, if donations were made through them — apps, seed phrases in notes or photos;
• Subscriptions and correspondence — fund channels, chats with volunteers, thank-you messages for donations, and emails from initiatives.