Dutch police have arrested two men suspected of operating a sophisticated bank-fraud scheme that used NFC relay attacks to steal more than €380,000, approximately $425,600, from 170 victims. The suspects allegedly combined AI-generated robocalls, fake bank employees, and malicious mobile applications to trick people into exposing their contactless debit-card data. The arrests highlight how criminals are adapting near-field communication technology, which is designed for convenient tap-to-pay transactions, into a tool for remote account theft.
According to Dutch authorities, the scam began with automated calls that used AI-generated audio to impersonate banks, companies, or other trusted organizations. Victims were told that suspicious activity had been detected on their accounts and were asked to press “1” if they were not responsible. Once the victim responded, the call was transferred to a suspect posing as a bank employee, who claimed that the person’s debit card had been blocked and needed verification.
The fraudsters then instructed victims to download an application and hold their debit card against their phone. Rather than simply verifying the card, the app extracted data from the card’s NFC chip, which supports contactless payments. That information was relayed in real time to an accomplice waiting at an ATM, who used it to withdraw money from the victim’s bank account. This technique is known as an NFC relay attack because it effectively extends the card’s contactless signal across a distance.
Police arrested a 23-year-old man from Vaassen and a 25-year-old man from Ede on October 6. Investigators believe the younger suspect likely built the technical infrastructure behind the operation and orchestrated the attacks, while the second suspect played a coordinating role. Authorities also took the criminals’ servers offline and seized them, along with phones and laptops believed to be connected to the scheme. Both men remain in custody while the investigation continues.
The case is a warning that a phone call claiming to be from a bank should never be treated as proof of identity. Genuine banks generally do not ask customers to install unknown apps, scan their cards against a phone, or share one-time codes. Consumers can reduce their risk by hanging up and calling their bank using the number on the official website or card, avoiding app downloads from unsolicited calls, and treating any request to tap a payment card on a phone as a major red flag.