Trusted Contact: Strengthening Data Security on Russia’s Gosuslugi Platform

Digital Governance

The Gosuslugi portal — Russia’s national platform for public services — has launched a new security feature called Trusted Contact. The feature allows users to designate a close person who can receive a confirmation code when a password reset is attempted, without being given access to the account itself.

Each user can appoint one trusted contact, while each contact can serve up to five users. To qualify, the contact must be a Russian citizen over 18 years old with a verified Gosuslugi account, an active passport record, and a valid phone number. The feature can be activated or deactivated at any time.

All users aged 14 and older can enable the new feature in the “Security” section of their Gosuslugi personal account. Once a user enters the phone number and name of the trusted contact, the person receives an invitation that must be accepted before activation.

This system adds a new layer of protection against unauthorized password changes. By reducing successful account takeover attempts, Gosuslugi aims to enhance public trust and establish a precedent for “social security” mechanisms within national digital services.

Anticipating Future Enhancements

The current implementation is only the beginning. Future updates could introduce multiple trusted contacts, or even trust-level classes — for instance, one contact authorized only to confirm password changes, and another with broader recovery rights. The addition of analytics on hacking attempts and trusted-contact interventions could further strengthen the platform’s cyber defense ecosystem.

“Digital hygiene in Russia is still developing. Many people start thinking about security only after they face a problem. It’s important to teach from childhood that information shared online can be stolen. We, for our part, are doing everything possible to ensure the safety of the digital environment.”

Dmitry Grigorenko

Deputy Prime Minister and Head of the Russian Government Office

Integration with internal security agencies or fraud detection systems is also being explored. Automated blocking of suspicious activity would mark another step toward comprehensive national cybersecurity.

Moreover, the concept of a trusted intermediary may attract interest from other countries seeking to reinforce their own e-government systems. Its adaptation for international platforms seems entirely feasible.

Proven Technology

The trusted-contact approach is already well known in the banking sector and among private IT service providers, where it serves as a final verification step during account recovery. Gosuslugi’s adoption of this principle brings that reliability to a national level.

The initiative was first announced in May, when the Ministry of Digital Development confirmed that the feature would be introduced in the third quarter of the year. Given the persistent problem of phishing and account fraud involving government portals, this measure appears both timely and strategic. Media outlets have repeatedly reported on fake Gosuslugi pages and malicious recovery attempts — this feature aims to close that vulnerability.

A Step Forward in Digital Safety

“Trusted Contact” represents an evolutionary step in the protection of citizens’ data and online identities. It is especially valuable when account owners come under direct attack — ensuring a verified, human checkpoint before any password can be changed. Over time, the Ministry may refine eligibility criteria for trusted contacts or extend their role in account security workflows.

In the long term, Gosuslugi may integrate trusted contacts with incident management systems or publish anonymized data on their effectiveness. Such practices could become benchmarks for other nations developing digital government ecosystems. For the developers, the main task now is to monitor real-world usage and ensure that the new feature enhances — not complicates — user security.