Dutch police have arrested two men accused of using AI-generated phone calls and a malicious NFC relay application to steal about €380,000 ($425,000) from 170 bank customers. Investigators said the operation impersonated bank help desks, pressured victims into “blocking” their cards and then enabled accomplices to withdraw money remotely. The arrests followed an investigation by Rotterdam’s cybercrime team under the supervision of the Dutch Public Prosecution Service. Dutch police described the case as a new form of bank-helpdesk fraud. [2]
The campaign began with a call warning the recipient about supposed suspicious activity. Police said the criminals used dozens of AI-generated audio clips featuring different voices, banks, companies and scenarios. After victims pressed a key, a supposed bank employee continued the conversation, created urgency and instructed them to install an application and hold their bank card against their phone.
That process read data from the card’s near-field communication, or NFC, chip—the technology used for contactless payments—and temporarily forwarded it to an accomplice’s application, according to investigators. A so-called “pinner” was simultaneously positioned at a cash machine or payment terminal and could withdraw thousands of euros without the victim immediately realizing what had happened. The method combines telephone social engineering with an NFC relay; police have not identified a CVE or disclosed a software vulnerability associated with the case.
The suspects, a 23-year-old man from Vaassen and a 25-year-old man from Ede, were arrested on October 6. Police suspect the younger man handled the technical infrastructure and directed other participants, while the older man coordinated the wider operation. Investigators took the servers offline and seized the suspects’ phones and laptops. A Rotterdam court’s review chamber ordered both men to remain in custody for at least another 90 days while the investigation continues. The allegations have not been tested at trial. [2]
The case illustrates why NFC-enabled payment cards can be abused without attackers physically taking possession of them, but it does not mean contactless payments themselves are defective. The immediate risk is the combination of a convincing caller, a fraudulent app and a victim persuaded to perform a card scan under pressure. The Dutch police advise customers to end unexpected “bank” calls, avoid installing apps at a caller’s request, never provide a PIN and contact their bank through an independently verified number. Anyone who may have complied should contact the bank immediately to block the account or stop transactions and report the incident to police.
