A tanker cannot be in two places at once. But according to an investigation reported by the Financial Times, that is precisely what dozens of vessels in Russia's so-called shadow fleet are now pretending to do — broadcasting falsified location signals that show them loading oil at a Russian terminal while their true hulls are hundreds of miles away, or simultaneously docked in one port and steaming through open water in another. It is the latest and most brazen escalation in a sanctions war that has turned the world's oceans into a theatre of electronic deception.
The finding matters because it exposes how the infrastructure of global maritime transparency — the satellite tracking systems on which insurers, regulators, traders and port authorities rely — is being systematically subverted to keep sanctioned Russian crude flowing. As Western governments tighten the screws on Moscow's oil revenues, the fleet carrying that oil is responding not with compliance but with ever more inventive fraud.
The vessel that was in two places at once
At the heart of the FT's reporting is a technique analysts call AIS spoofing: the deliberate manipulation of the Automatic Identification System, the transponder network that large vessels are required by international maritime law to keep running throughout a voyage. Every cargo ship over a certain size continuously broadcasts its identity, position, course and speed. Receivers on shore stations and satellites pick up those signals and feed them into public tracking platforms such as MarineTraffic, creating a live map of global shipping that anyone with an internet connection can read.
Shadow fleet operators have learned to play that map like an instrument. In the cases highlighted by the FT, vessels' signals were found to place them at two contradictory locations at the same time — a physical impossibility that only becomes visible when analysts cross-reference the electronic trail against satellite radar imagery, port-call records and draught measurements. The decoy position typically shows an innocent voyage: a vessel idling at anchor, or steaming an innocuous route. The real position tells a different story — often a mid-sea rendezvous for a ship-to-ship transfer of sanctioned cargo.
The practice builds on older tricks. For years, evaders simply switched their transponders off — "going dark" — during sensitive operations. But darkness is itself a signal; a vessel that vanishes from the map for days draws suspicion. Broadcasting a false but plausible voyage is far more effective camouflage. It lets a sanctioned tanker sail in plain sight, its digital twin doing the paperwork while its steel hull does the work.
How the trick works
AIS was never designed as a security system. It is an open, unencrypted broadcast protocol built in the 1990s to prevent collisions at sea, and its data can be manipulated with equipment that costs a fraction of the value of a single oil cargo. Analysts describe several overlapping methods. The simplest is a static false position: the crew, or software on board, programmes the transponder to report coordinates that have nothing to do with the ship's real location. More sophisticated operations use shore-based equipment or third-party providers to inject fabricated signals into the data feeds that tracking platforms ingest, creating a fully fictitious voyage complete with plausible speeds and course changes.
Then there is GNSS spoofing — the manipulation of the satellite navigation signals the ship itself receives — which can confuse not only tracking databases but other vessels' bridge systems, creating genuine navigational hazards. And beyond individual vessels, entire logistics networks have been built around the deception: shell companies registering the ships, brokers specialising in mixing sanctioned cargo with legitimate loads, and intermediaries scrubbing the paperwork between one port and the next.
"What we're seeing is the industrialisation of deception," one maritime crime specialist told reporters earlier this year, describing a system in which spoofing is no longer a rogue operator's improvisation but a service bought and sold. A United Nations maritime crime report noted a 300 per cent increase in AIS anomalies in the Gulf region since 2023, suggesting the techniques perfected moving Russian oil are spreading to other sanctioned trades.
Why a tanker would clone itself
The purpose of appearing in two places at once is to break the chain of evidence that links a cargo of oil to a sanctioned origin. Under the G7 price cap regime introduced in December 2022, Western companies — above all the insurers and tanker owners who dominate the legitimate market — are barred from facilitating the transport of Russian crude sold above a capped price, and the European Union has banned its purchase outright. A buyer in Asia who wants discounted Russian oil but fears secondary sanctions needs a plausible story about where the cargo came from.
The cloned voyage provides it. While the real vessel conducts a ship-to-ship transfer in international waters — off Greece, in the Gulf of Oman, or in the Black Sea — its digital twin is shown loading legitimate-looking cargo elsewhere, or simply going about innocent business. The oil is then pumped into a non-sanctioned intermediary vessel, the paperwork is rewritten, and the crude arrives at its destination as generic fuel oil or a blended product whose Russian origins are all but untraceable.
The technique also serves a second purpose: soothing nervous buyers. Trading houses and refineries that handle Russian barrels at prices above what Western powers would like need deniability, and a clean-looking AIS track is the cheapest form of it. It is, in effect, a digital alibi for everyone in the supply chain.
A fleet built for deception
The spoofing documented by the FT is only the sharp end of a much larger operation. Since the full-scale invasion of Ukraine in 2022, Russia has assembled what analysts describe as the largest uninsured tanker fleet in the world — estimates of its size range from around 600 vessels to well over 1,000, controlling perhaps a fifth of global oil tanker capacity. Of these, roughly 287 tankers have been directly sanctioned by at least one of the United States, the United Kingdom or the European Union, according to open-source analysis.
The fleet's profile is distinctive. The vessels are old — typically 15 to 25 years, long past the age when reputable operators would have sent them to the scrapyard — and their ownership is buried beneath layers of single-ship companies registered in the Seychelles, the Marshall Islands, the UAE and other permissive jurisdictions. They hop between obscure flag registries — Gabon, the Cook Islands, Palau, Cameroon — changing names and identities with dizzying speed. The 800-foot Turba, a 26-year-old tanker caught conducting a secretive transfer off the Greek coast, had drawn regulatory ire for its age, its inspection record and its mysterious ownership before it ever made headlines.
