Published May 22, 2026
VPN and Banking Apps: Why Sber Breaks and How to Fix It
Why Russian banking and government apps (Sber, T-Bank, Gosuslugi) break over a foreign VPN IP, and how to set up access so your bank keeps working while blocks are bypassed.
If your Sber, T-Bank, or Gosuslugi app stopped working the moment you switched on a VPN, the cause is almost always the same: the VPN routes your traffic through a foreign IP address, and Russian banks and government services block or flag that traffic as suspicious. The answer is not to toggle the VPN off every time, but to route traffic correctly β Russian traffic should go directly from your real IP, and only foreign traffic should travel through the VPN. Here is why this happens and how to set it up.
In short: Russian banking and government apps break under a VPN because they see a foreign IP and anti-fraud kicks in. The most reliable fix is a VPN with split routing, where Russian sites and apps stay on a direct connection (RU-direct) and only foreign traffic goes through the tunnel. The alternative is to manually exclude banking apps via split tunneling. A full-tunnel VPN with no exceptions will almost certainly break your bank.
Why Sber and other banks fail over a VPN
When you enable a regular VPN, all of your device's internet traffic exits through the VPN server β usually in another country. From the bank's point of view, you have suddenly "moved" from Moscow to Amsterdam or Frankfurt. For a financial app that is a serious signal, and the reaction ranges from minor glitches to a fully blocked session.
Anti-fraud and geolocation
Russian banks run anti-fraud systems that analyze where a login comes from. A sudden country change β especially when the IP belongs to a data center rather than a home ISP β is a classic sign of a compromised account. The bank may demand re-authentication, temporarily limit operations, or simply refuse to let the app load.
Direct blocking of foreign IPs
Many Russian services β both banking and government β deliberately reject connections from foreign IP addresses and known hosting-provider ranges. This is done for both security and regulatory reasons. As a result, Gosuslugi, SBP payments, the MIR Pay app, and bank dashboards often just hang or throw a network error while a foreign exit is active.
Payment gateways and SBP
Online payments are a separate pain point. Russian bank payment forms, 3-D Secure, and the Faster Payments System (SBP) frequently rely on geolocation checks. Over a foreign IP, payment confirmation may never arrive, the push with the code gets lost, and an SBP transfer fails at the final step. The user sees "payment declined" even though the money and card are perfectly fine.
The root of the conflict: why you need a VPN in Russia at all
The paradox of 2026 is that you need a VPN for the exact opposite reason. Many foreign services (some websites, AI tools, streaming, app stores) refuse to work with Russian IPs. And inside the country, since May 2026 Roskomnadzor has moved to blocking at the ASN and subnet level, making access to a range of foreign resources hard without a VPN. There is more on this in our piece on why VPNs are blocked in Russia.
The result is a classic conflict: foreign sites want you to arrive from a foreign IP, while Russian banks want you to stay on a Russian one. A full-tunnel VPN solves the first problem and breaks the second. The correct solution β split routing β was born precisely from this contradiction.
Solution 1: RU-direct split routing
The most convenient approach is to use a VPN that splits traffic by destination from the start. That is how Fiery VPN's relay architecture works: you connect over WireGuard or AmneziaWG to a hub in Moscow on a Russian IP. Traffic to Russian sites and apps stays direct β it never leaves the country, latency stays low, and banking and government apps see a Russian IP and work as usual. Only foreign traffic travels abroad through a secure server-to-server tunnel.
For the user it looks like this: the VPN stays on permanently, YouTube and blocked sites open, while Sber, T-Bank, Gosuslugi, and SBP payments keep working with no manual toggling. You never have to remember whether to switch the VPN off before paying.
Why this is safer for anti-fraud
Because the banking app connects from your real Russian regional IP, anti-fraud does not see a "move" and does not raise an alarm. This lowers the risk of false account blocks and extra identity checks. For financial services that matters far more than for ordinary browsing.
Solution 2: manual split tunneling
If your VPN does not split routes automatically, split tunneling helps β a feature that lets you specify which apps go through the VPN and which bypass it. The logic is the reverse of what you might expect: banking and government apps need to be excluded from the VPN so they go directly.
How to set it up on different platforms
- Android. Many VPN apps (including AmneziaVPN) support a per-app list where the VPN is either enabled or disabled. Add Sber, T-Bank, VTB, Gosuslugi, MIR Pay, and other financial apps to the exclusions.
- iOS. The system-level per-app split tunnel is limited, so here RU-direct routing on the server side is usually the better fix rather than manual exclusions.
- Windows / macOS. In AmneziaVPN clients and WireGuard configs you can define allowed/excluded routes (AllowedIPs), keeping Russian ranges outside the tunnel.
- Router. On Keenetic, MikroTik, and OpenWRT routing can be configured at the network level β the cleanest option for the whole home. See our VPN on a router overview.
The downside of the manual approach is maintenance: banks release new apps and add domains, so the exclusion list needs updating. For most users, server-side RU-direct routing is more convenient and reliable.
Comparison of approaches
| Criterion | Full tunnel (no exceptions) | Manual split tunneling | Fiery RU-direct |
|---|---|---|---|
| Do banks and Gosuslugi work | Usually no | Yes, if set up correctly | Yes, out of the box |
| Anti-fraud trigger risk | High | Low | Low |
| Latency for Russian sites | Higher (routed abroad) | Low | Low (direct connection) |
| Bypasses foreign-site blocks | Yes | Yes | Yes |
| Manual setup required | No | Yes, plus list upkeep | No |
| Day-to-day convenience | Low (constant toggling) | Medium | High |
Which protocol to choose in 2026
The protocol itself does not determine whether the bank sees your IP β routing does. But amid the 2026 blocks it matters that the VPN holds a stable connection at all. After Roskomnadzor's escalation in May 2026, plain WireGuard and VLESS became unstable in places, while obfuscated AmneziaWG (AWG 2.0) remains the most resilient choice. If your VPN keeps dropping, banking exclusions will not save you β the apps will suffer from an unstable network. A detailed protocol comparison is in our VPN protocols compared article.
Practical tips
- Do not try to log into your bank through a foreign IP "just to check" β extra anti-fraud triggers can lead to temporary account limits.
- If the bank already got suspicious, log in from your normal home internet (or with an RU-direct connection) and confirm the login if asked β that clears the flag.
- For SBP and MIR card payments, make sure the payment app goes directly, not through the tunnel.
- Keep an RU-direct VPN on permanently β it is more convenient and safer than flipping a switch before every banking operation.
FAQ
Why doesn't the Sber app work with a VPN?
Because the VPN routes traffic through a foreign IP, and Sber blocks or flags connections from other countries and data centers as suspicious. The fix is to keep Sber's traffic on a direct Russian connection via RU-direct routing or manual split tunneling.
Can I use Sber and a VPN at the same time?
Yes, if the VPN splits traffic: the banking app goes directly from a Russian IP while foreign sites go through the tunnel. In Fiery VPN this works by default β there is nothing extra to configure.
Is it safe to access my bank through a VPN?
An encrypted VPN itself is safe, but logging into a bank through a foreign IP raises the risk of anti-fraud triggers and temporary limits. It is safer when the bank sees your real Russian IP β that is, with RU-direct routing or with the bank excluded from the tunnel.
Do Gosuslugi and MIR Pay work over a VPN?
Under a full-tunnel VPN with a foreign exit, often no β they reject foreign IPs. Under RU-direct routing, or when added to split-tunnel exclusions, they work normally because they connect from a Russian address.
Do I need to turn off the VPN before paying by card?
With a regular VPN, yes β otherwise the payment and 3-D Secure may fail. With RU-direct routing there is no need: payment traffic already goes directly, while the VPN keeps bypassing foreign-site blocks.
Bottom line
The conflict between a VPN and Russian banks is solved not by choosing "either the internet or the bank," but by routing traffic correctly. Fiery VPN keeps Russian traffic direct (RU-direct), so Sber, T-Bank, Gosuslugi, SBP, and MIR Pay keep working while blocked foreign sites open up. You can connect and check how it behaves with your own apps through the vpn.fiery.host mini-app or the @fiery_VPN_bot Telegram bot.