As part of the presented case, RUB 35 million were stolen from the accounts of a legal entity. The money was withdrawn and cashed out through a chain of shell companies, and some of the money was withdrawn in cash at several ATMs simultaneously. The withdrawals were preceded by the deactivation of a corporate SIM card. At night, the SIM card was re-registered on a new device, which allowed the attackers to access the client bank. Due to the second authorization factor, the main version considered the involvement of the company's employees or freelancers. The investigation allowed getting the name and phone number of an IT specialist who repaired the chief accountant's personal computer shortly before the incident. According to the data provided, an Armenian citizen with a criminal record was identified. At the same time, a mobile phone shop where the contract with the operator was reissued for forged documents, as well as the name of the employee who reissued the SIM card, were identified. Within 24 hours, the nominal directors of the companies who received the remittances, were determined. The performed operations confirmed connections among all group members. A criminal case was initiated under Article 159 of the Criminal Code of the Russian Federation. Two participants in the criminal scheme were detained and the money was confiscated.