In September, NATO jets shot down a drone that entered Lithuanian airspace. According to Lithuania’s National Crisis Management Centre, similar to previous incidents, this drone crossed from Belarusian airspace. Within hours, Polish air defenses respond, and Europe briefly holds its breath. By the time officials have released their first statements, social media has already decided what happened.
For fact-checkers who cover the war in Ukraine, this sequence is painfully familiar. A real, often frightening event happens. Within hours, it’s wrapped in a false narrative built to outrun the truth. The challenge, as always, is getting there first.
When does this show up?
Disinformation about the war in Ukraine doesn’t appear at random, it recurs around specific triggers. Security incidents are one: drone incursions, sabotage, explosions, acts attributed to Russia but quickly redirected toward Ukraine in the retelling. Funding decisions are another: every time the EU, the US Congress, or a national parliament debates a new aid package, a fresh wave of claims about corruption or misused funds tends to appear. Elections are a third trigger, especially when support for Ukraine has become a live campaign issue. And underlying all of it is the steady drumbeat of the war itself, which gives Russian state media and aligned influence networks a constant supply of raw material to distort.
Why disinformers spread it
The motives are consistent even when the stories change. Some narratives aim to erode public support for continued aid to Ukraine, by suggesting the money is being stolen or squandered. Others try to reverse the roles of the war itself, casting Russia as a country under siege and forced into “defensive” action, and Ukraine (or NATO) as the true aggressor. Still others are aimed closer to home, in countries like Poland, where the goal is to fray solidarity with Ukrainian refugees and deepen distrust between citizens and their own institutions. Whatever the specific target, the throughline is the same: weaken the coalition backing Ukraine, and make the war easier for Russia to sustain.
Why it takes hold
These claims work because they rarely start from nothing. Ukraine, like any country at war, does have real corruption cases. Russia really does carry out real acts of sabotage in Europe, and real security incidents really do happen. Disinformation actors take that kernel of truth and inflate it: a legitimate corruption investigation becomes “proof” that Zelenskyy is a billionaire; a real drone incident becomes evidence that Ukraine staged an attack on its own ally. The claims feel plausible precisely because something true sits underneath them, and they’re delivered with urgency and strong emotion like fear, outrage, suspicion, which makes people less likely to pause and check.
What fact-checkers found
Demagog (Poland) warned readers what to expect after the next act of sabotage on Polish soil. Looking back at the arson attacks of 2025, the September 2025 drone incursion into Polish airspace and the November 2025 explosion on the railway line between Warsaw and Lublin, Demagog noted that such incidents are likely to happen again, and that the disinformation around them follows a familiar pattern. The warning signs: alarmist, emotionally charged language, no credible sources, appeals to “common sense”, claims that “the mainstream media is silent”, and posts that quickly shift the blame onto Ukraine. Demagog also explained why that blame can feel convincing: Russian services often recruit Ukrainian citizens to carry out sabotage, and Ukrainian intelligence has warned that such offers may target people in financial hardship. Russian propaganda then uses this to stoke anti-Ukrainian sentiment in Poland.
Pravda (Poland) looked at the broader propaganda architecture behind these individual incidents, in a piece on how Kremlin messaging casts Russia as the victim of the war it started. They describe two techniques doing most of the work: scapegoating, which pins blame for the war’s consequences on Ukraine and the West, and role reversal, which recasts the aggressor as the one under threat. Together, they found, these techniques feed a “siege fortress” narrative that justifies Russian military action as self-defense. In the Polish context, such narratives are also used to chip away at solidarity with Ukrainian refugees and trust in the state institutions supporting them.
Demagog.sk (Slovakia) took on one of the most durable myths of the entire war: that Volodymyr Zelenskyy is secretly hoarding a fortune. Their count found at least 22 separate viral claims since 2022 about Zelenskyy or his wife buying villas, yachts, jewelry, or even a former Nazi property… none of these claims are substantiated. Demagog.sk showed when to expect the next one: these stories appear more often when the EU or the US Congress is deciding on aid to Ukraine, and ahead of elections. It also described the path such a story usually takes: an unnamed journalist or “whistleblower”, then local portals, pro-Russian influencers and small social media groups. Zelenskyy’s tax filings are public, and the income they show is far below what the rumors describe.
From reactive debunking to proactive prebunking
Each article is built to inoculate readers against the next version of the same story, not just the version that already went viral. Demagog extracted the recurring signature that shows up every time: alarmist language, missing sources, appeals to “common sense” over evidence. They gave users a checklist to carry into the next incident.
Pravda identified the recurring techniques that Russian messaging reuses across dozens of different stories, from military setbacks to refugee policy. Once a reader can recognize “the aggressor recast as the victim,” they can spot it in whatever headline it shows up in next.
Demagog Slovakia laid out more than 20 near-identical claims and forecasted future stories about Zelenskyy’s wealth or corruption to recur around upcoming funding decisions.
That’s the shift from debunking to prebunking. Instead of waiting for a viral claim to land in a fact-checker’s inbox, initiatives like the EFCSN’s Prebunking at Scale, built with Full Fact and Maldita, and drawing on more than 50 partner organizations monitoring TikTok, Instagram, and YouTube Shorts, work to surface these patterns before they peak, so audiences already know what a fabricated sabotage narrative, a role-reversal claim, or a Zelenskyy-wealth hoax looks like before it lands in their feed.
Debunking corrects the record after the harm is done. Prebunking tries to make sure the harm never fully takes hold by teaching readers to recognize the shape of a false narrative the moment it starts to form.
Stay tuned for the next impact story, where we explore how monitoring and prebunking can help fact-checkers get ahead of the next misinformation wave.
About Prebunking at Scale
The fact-checks and prebunks in this story were created by EFCSN members as part of Prebunking at Scale. The project aims to enhance public resilience against dis- and misinformation by proactively addressing emerging false claims and narratives before they gain widespread traction. It uses an AI-powered monitoring and analysis system to alert fact-checkers to rising and viral narratives, allowing them to create and publish prebunking materials before harmful beliefs take hold.
