Gosuslugi (Госуслуги) as a single point of dependency: why one account has become too important
Gosuslugi (Госуслуги) has stopped being just a portal for making a doctor's appointment or filing an application. Today one account is linked to a passport, SNILS, INN, compulsory medical insurance policy, driver's license, vehicle registration, tax history, medical record, education, the summons registry, and a digital ID for logging in to other services — from banks to the national messenger. This is convenient for the user and at the same time turns one login into a single point of failure.
The “hijacking” of such an account means not just losing access to one website, but giving an outsider or fraudster the ability to act in your name across dozens of connected systems — take out a loan, register a SIM card, sell a car, declare a change of residence, or open a legal entity. Recovery often requires an in-person visit and takes weeks.
Below is a neutral breakdown of what exactly is currently collected in one Gosuslugi account, what real scenarios happen when it is hijacked, and what built-in protection measures are available without giving up the service.
In brief
- One Gosuslugi account today is a bundle of passport data, SNILS, INN, vehicle data, medical record, taxes, summonses, and digital ID.
- Through the Gosuslugi digital ID, you can log in to banks, insurers, mobile operators, and the national messenger MAX.
- An SMS code as a second factor is the weakest option: SIM swap and number substitution are a known account hijacking scheme.
- Built-in two-factor authentication through the “Gosuslugi” app is considered more reliable than SMS.
- A complete refusal to use Gosuslugi today sharply limits access to government services, but the right not to use it exists.
What is actually linked to the account
The list of systems that receive data from the account or that the account gives access to has only expanded in recent years. It is useful to understand the scale.
Personal identifiers
Passport (series, number, date of issue), SNILS, INN, compulsory medical insurance policy, foreign passport, driver's license. In effect, this is the full set of state identifiers for an adult.
Property and transport
Vehicle registration, traffic police fines, ownership rights, real estate transactions (through integration with Rosreestr (Росреестр)), information about vessel owners and other categories of property.
Taxes and finances
Linkage with the Federal Tax Service personal account: personal income tax, property taxes, reporting for the self-employed and individual entrepreneurs. Taking into account the expansion of reporting obligations for foreign accounts and controlled foreign companies, this is the full financial profile.
Medicine and education
Electronic medical record, vaccination certificate, history of visits, prescriptions. Education documents, Unified State Exam results, diplomas.
Military registration
Linkage with the electronic summons registry. From the moment a summons appears in the registry, restrictions take effect — a ban on leaving the country, restrictions on transactions and on driving a car (see the Gosuslugi help page about the summons registry).
Digital ID and single sign-on
A Gosuslugi account works as a universal identifier: through ESIA, you can log in to banks, insurance companies, mobile operators, and the national messenger MAX (see the Gosuslugi FAQ about digital ID). One compromised password opens access to this entire network.
What account hijacking means in practice
| Scenario | What it means | What to check / do |
|---|---|---|
| A bank login through ESIA came from an unknown device | A Gosuslugi account may have been hijacked | Change the password, enable the app as 2FA, contact the bank |
| Notifications appeared about unknown applications (SNILS change, address change) | Documents are being filed in your name | Block the account through the hotline, contact an MFC |
| The SMS code for login stopped arriving | Possible SIM swap at the mobile operator | Urgently check the SIM status, switch to 2FA through the app |
| A notification arrived about a new loan or microloan | Fraudsters obtained access to identifiers | Request data from a credit bureau, file a police report, block the account |
| An electronic summons appeared without your knowledge | More often this is a real action by the military enlistment office, not hijacking | Check through the personal account, contact a lawyer |
How to check right now
In the Gosuslugi personal account there is a “Security” section with a list of devices and sessions. Check whether there are any extra ones. Enable two-factor authentication there through the “Gosuslugi” app, not through SMS — SMS can be intercepted during a SIM swap. Check which phone number and email are linked to the account: replacing contacts is a typical first step in hijacking.
At the same time, check whether your full name and date of birth are in the public Interior Ministry wanted database — this is a separate risk that exists independently of Gosuslugi and is important for anyone planning trips to Russia.
Warning signs vs false alarms
A warning sign is a login from an unfamiliar device, changes to linked contacts (phone, email), new applications you did not file, or the absence of expected SMS codes from the operator. Any of these signs is a reason to immediately change the password and enable the app as the second factor.
A false alarm is a phishing email “from Gosuslugi” asking you to follow a link and confirm data. Gosuslugi does not send such emails; all confirmation takes place inside the personal account. Do not enter an SMS code on third-party websites and do not dictate it over the phone to “support.”
What to do next
- Enable two-factor authentication through the “Gosuslugi” app, not through SMS.
- Set a PIN code in the app and enable login using the device’s biometrics (Face ID / fingerprint).
- Regularly check the list of devices and active sessions in the “Security” section.
- Do not use the same password for Gosuslugi and other services; the password should be long and unique.
- Check with your mobile operator for SIM protection against reissue (in some places there is a “ban on actions without an in-person visit” service).
- Make it a habit: for any suspicious notification, immediately check the “Action history” section instead of following a link from an email.
- If the account has already been hijacked, urgently block it through the Gosuslugi hotline and recover it through an MFC with your passport.
Disclaimer: this material is informational and is not legal advice. For a specific situation, contact a lawyer. The list of data and services linked to Gosuslugi is regularly expanding; for the current list, check the “Help” section on the portal itself.
Conclusion
Gosuslugi has become a single entry point to dozens of government and commercial systems. This removes part of everyday routine and at the same time concentrates risk: one password opens access to passport data, taxes, medical records, vehicle data, and digital ID. It is difficult to completely give up the service today, but the built-in protection measures — the app as the second factor, device control, SIM protection — remove most everyday account hijacking scenarios.