Dutch police arrest two over AI-voiced bank helpdesk fraud using a fake NFC relay app: 170 victims, €380,000 stolen
Matéria consolidada. Reúne 2 matérias que o Tifon tinha publicado separadamente sobre a mesma história. A IA reescreveu o relatório com o que as 2 fontes trouxeram em 27/10/2026 00:02; os links antigos trazem para cá.
Rotterdam police arrested two men suspected of a new form of bank helpdesk fraud that combined AI-generated phone calls, a fake banking app and NFC relay of payment cards. The scheme allegedly drained more than €380,000 (~$425,600) from 170 victims in about three weeks (securityweek.com, securityaffairs.com). The suspects are a 23-year-old from Vaassen, suspected of building the technology and leading the group, and a 25-year-old from Ede, who coordinated the operation. They were arrested on October 6 and investigators seized their servers, phones and laptops (securityweek.com). A Rotterdam court has ordered both held for at least another 90 days, and police said they had not encountered this technical method before (securityaffairs.com).
Detalhes técnicos
- Lure: victims got automated vishing calls with AI-generated audio warning of suspicious account activity. The group produced dozens of recordings with different voices, banks, companies and scenarios. Victims were told to press 1 if they did not recognize the activity, and were then held on the line (securityaffairs.com, securityweek.com).
- Social engineering: a live operator posing as a bank employee followed a script and pressured victims to act quickly, saying their debit card was blocked (securityaffairs.com, securityweek.com).
- Payload delivery: the fake employee told victims to install a fake banking app and hold their bank card against the phone, presented as a way to secure the account (securityaffairs.com, securityweek.com).
- NFC relay: the app read the card's contactless NFC chip data and relayed it to a matching app run by an accomplice waiting at a cash machine or payment terminal. The accomplice could withdraw thousands of euros without the victim noticing (securityaffairs.com, securityweek.com).
- Investigation: the case began in mid-September, when Dutch banks reported the fraud through the Electronic Crimes Task Force (ECTF). Rotterdam's cybercrime team identified the group's digital infrastructure within days and monitored the servers to trace the operators, the calls and the cash withdrawals (securityaffairs.com).
Remediação
- Never scan a bank card with an app at a caller's request. Hang up and call the bank on the number printed on the card (securityaffairs.com).
- Do not install apps from links or instructions given during unsolicited calls (securityaffairs.com).
- Banks never ask customers to install apps or scan cards against a phone after an unsolicited call. Awareness campaigns can stress this (securityweek.com).
Relatos divergentes
- Role of the 23-year-old: securityweek.com says he "likely" built the infrastructure and orchestrated the attacks. securityaffairs.com, the later source, says he is suspected of developing the technology and leading the group. Both describe him as the technical lead, and the difference is one of certainty.
- Timeframe: securityweek.com gives only the October 6 arrest date. securityaffairs.com adds the mid-September start and the roughly three-week duration of the fraud.
Linha do tempo
-
Dutch police arrest two over AI-voiced bank-helpdesk fraud using fake NFC app; 170 victims, €380,000 lost
ler a análise desta fonte ocultar
Rotterdam police arrested two men suspected of a new form of bank-helpdesk fraud that combined AI-generated phone calls, a fake banking app and NFC card relaying. In about three weeks the scheme allegedly cost 170 victims around €380,000. A 23-year-old from Vaassen is suspected of developing the technology and leading the group, and a 25-year-old from Ede of coordinating the operation. A Rotterdam court ordered both held for at least another 90 days. Police said they had not encountered this technical method before.
Technical Details
- Victims received an automated call with an AI-generated recording warning of suspicious account activity. The group produced dozens of recordings with different voices, banks, companies and scenarios. Victims were told to press 1 if they did not recognize the activity.
- Victims were then connected to a person posing as a bank employee, who followed a script and pressured them to act quickly to block their cards.
- The fake employee told victims to install a fake banking app and hold their bank card against the phone to scan it, presented as a way to secure the account.
- The app relayed data from the card's NFC chip to an app run by an accomplice waiting at a cash machine or payment terminal, who could withdraw thousands of euros without the victim noticing.
- The case began in mid-September, when Dutch banks reported the fraud through the Electronic Crimes Task Force (ECTF). Rotterdam's cybercrime team identified the group's digital infrastructure within days and monitored the servers to trace the operators, the calls and the cash withdrawals.
Remediation
- Never scan a bank card with an app at a caller's request. Hang up and call the bank on the number printed on the card.
- Do not install apps from links or instructions given during unsolicited calls.
-
Dutch Police Arrest Two Over AI-Voice Bank Helpdesk Fraud Using NFC Relay Attacks That Stole €380,000
ler a análise desta fonte ocultar
Dutch police arrested two suspects for running a bank helpdesk fraud scheme that used NFC relay attacks to drain more than €380,000 (~$425,600) from the accounts of 170 victims. The suspects placed calls that played AI-generated audio impersonating banks and companies and claiming suspicious account activity, then asked victims to press '1' and held them on the line. A second suspect posing as a bank employee told the victim their debit card was blocked and instructed them to download an application and scan the card against their phone. The application read the card's NFC chip data and relayed it to an accomplice waiting at an ATM, who withdrew cash from the victim's account. The suspects, a 23-year-old from Vaassen and a 25-year-old from Ede, were arrested on October 6, and investigators seized their servers, phones and laptops.
Technical Details
- Lure: automated vishing calls with AI-generated audio impersonating various banks, companies and scenarios, followed by a live operator posing as a bank employee.
- Payload delivery: victims were talked into installing an application and holding their card against the phone.
- Data theft: the application extracted data from the contactless-capable NFC chip and sent it to an accomplice with the matching application at an ATM, who withdrew funds (NFC relay).
- Roles: the 23-year-old likely built the infrastructure and orchestrated the attacks; the 25-year-old played a coordinating role.
Remediation
The article gives no explicit guidance. Defenders can raise awareness that banks never ask customers to install apps or scan cards against a phone after an unsolicited call.