584/69 Tuesday, October 27, 2026
Dutch police have announced the arrest of two suspects linked to a financial fraud scheme that used NFC relay techniques together with phone-based impersonation of bank employees. The scheme reportedly affected 170 victims and resulted in losses of more than EUR 380,000, or approximately USD 425,600. The suspects allegedly used Artificial Intelligence (AI)-generated voices to warn victims that suspicious transactions had been detected on their bank accounts and instructed them to press 1 if they had not authorized the transaction. Victims were then transferred to an accomplice posing as a bank employee.
Investigators found that after the call was transferred, the suspects told victims that their bank cards had been blocked and instructed them to download an application onto their smartphones. The victims were then asked to place their bank cards against their phones so that the cards could be scanned using Near Field Communication (NFC), the technology commonly used for contactless payments. The malicious application relayed communications from the card’s NFC chip to an accomplice positioned near an ATM with another device, allowing the attackers to use the relayed card data to withdraw money from the victims’ accounts. The technique combined telephone-based social engineering with NFC relay attacks, enabling the attackers to perform transactions while the victims were physically located elsewhere.
Dutch police said the two suspects were arrested on October 6, 2026. They included a 23-year-old man from Vaassen, who is suspected of developing the fraud infrastructure and planning the attacks, and a 25-year-old man from Ede, who allegedly played a coordinating role. Authorities also shut down and seized the server used in the operation and confiscated mobile phones and laptops belonging to the suspects as evidence. Both suspects remain in custody while the investigation continues. Users should remain cautious of calls claiming to come from bank employees, particularly those asking them to install applications or tap a bank card against a smartphone for account verification or unlocking. If suspicious activity is detected, users should contact their bank directly through official channels.
Source: https://www.securityweek.com/dutch-police-arrest-two-over-nfc-relay-attacks-that-drained-400000/