Former NBU official in Fergana sentenced to 8.5 years for embezzling UZS 1.5 billion

The defendant, identified as D.I., born in 1976, maintained a long career within the NBU system from 2006 until August 2024. In his most recent role as the head of the Bankcards and Retail Operations Department for the regional branch, he supervised the management of plastic cards, ATMs, and their corresponding software infrastructure. Investigators established that he systematically manipulated his official credentials and accessed the bank’s automated information system (IABS) to siphon off funds belonging to both the financial institution and its depositors.

Exploiting the UzCard-to-Humo transition

The fraudulent scheme began taking shape in 2019 during a nationwide banking transition. Due to recurring technical glitches associated with UzCard plastic cards, commercial banks began phasing them out in favor of the Humo payment system. Branch staff were tasked with manually transferring balances from obsolete UzCards to newly issued Humo accounts.

D.I. exploited a temporary vulnerability in the software during this migration window. Utilizing his personal login credentials alongside those assigned to subordinates within his department, he authorized balance transfers through the IABS system. However, before the centralized network data could fully synchronize and log the updates, he diverted the funds into accounts under his control and withdrew the cash for personal use. Court testimonies revealed that between 2019 and 2024, the defendant progressively stole more than UZS 641 million from the accounts of 113 unsuspecting clients, masking the thefts as "unprocessed transactions" in the bank's internal ledger.

Tampering with ATMs using razor blades and glue

Beyond digital manipulation, D.I. engaged in physical theft from the bank's cash machines. When a new batch of ATMs was delivered to the branch, he secretly made duplicate copies of the outer chassis and inner safe keys, keeping them in his possession for years. Under standard operating protocols, ATM keys must exist in three copies: one held by security services, one kept at the cash desk, and a backup stored securely at a partner bank.

His illicit activities came to light in December 2024 when executive leadership established a special internal task force to audit cash balances and verify financial records across self-service devices under the "Farg’ona Amaliyot" banking services center. To prevent the coordinator from hiding discrepancies, the task force halted operations at all regional ATMs simultaneously for a comprehensive physical count.

The audit exposed seven unauthorized extractions performed by D.I. between April and December 2023 at ATMs located around the "Farg’ona Dehqon Bozori" (Fergana Farmers Market), resulting in a direct loss of UZS 845.02 million for the bank.

During the investigation, the former manager detailed his methods. He explained that he would use his administrative credentials to electronically close the ATM's operational day. He then used his duplicate keys to open the safe doors and extract cash bundles of UZS 50 million, UZS 80 million, or UZS 100 million at a time from the secure cassettes. To conceal the physical tampering from routine inspectors, he used a razor blade to cleanly slice open the security lead seals and later reattached the severed threads using superglue. Whenever a shortage was risked at one specific machine due to an upcoming individual inspection, he opened fictitious internal accounts to temporarily move balances from unverified ATMs to cover up the missing funds.

Impact on depositors

The human toll of the fraud was highlighted during the trial by a representative of one of the victims, identified as V.S. According to the testimony, the pension funds of an elderly citizen, T.Sh., were regularly deposited into her NBU UzCard.

In May 2023, upon returning to Uzbekistan from a trip to Saint Petersburg to visit her children, T.Sh. received an automated text notification indicating that UZS 14 million had been abruptly withdrawn from her balance. When she approached the bank to file a complaint, an internal review revealed that a new Humo card had been issued under her name without her consent to transfer her remaining balance of UZS 26.27 million. The transaction was left unconfirmed in the system while the perpetrator linked the account to mobile applications, eventually draining over UZS 48 million through various digital payments.

Court verdict and restitution

The Fergana City Criminal Court found D.I. guilty under Paragraph "a" of Part 4 of Article 169 (Grand theft in especially large quantities) and Paragraph "a" of Part 2 of Article 205 (Abuse of power or official authority) of the Criminal Code of Uzbekistan.

The court sentenced him to 8 years and 6 months of imprisonment, to be served in a penal colony. Additionally, he is barred from occupying materially responsible or executive positions within the banking sector for a period of 3 years following his release. The judiciary also ordered the convict to pay UZS 26.1 million in direct restitution to the victim T.Sh., and UZS 1.49 billion to cover the total material damages incurred by the National Bank of Uzbekistan.