Dutch Police Arrest Two Over NFC Relay Bank Fraud
Dutch police have apprehended two individuals linked to a novel bank helpdesk fraud scheme that utilized AI-generated audio and NFC relay attacks to loot more than $400,000 from victims' bank accounts.
Radwan AbdulhadiEditor and technology writer
Overview of the NFC Relay Fraud Scheme
Dutch authorities have arrested two individuals for running a sophisticated and novel type of bank helpdesk fraud scheme that resulted in more than $400,000 in financial damages. According to reporting from [SecurityWeek](https://www.securityweek.com/dutch-police-arrest-two-over-nfc-relay-attacks-that-drained-400000/), the operation targeted victims of all ages across the Netherlands.
The fraudulent operation successfully compromised the bank accounts of 170 victims, looting over €380,000, which translates to approximately $425,600. Dutch police noted that the victims spanned a wide range of ages, highlighting the broad reach of the deceptive tactics used by the perpetrators.
The Role of AI-Generated Audio in Phishing Calls
As part of the scheme, the suspects initiated contact with potential victims by placing phone calls that played AI-generated audio segments. These recordings falsely claimed that suspicious activity had been detected in the recipient’s bank account.
The AI audio segments impersonated various banks, companies, and scenarios. They instructed recipients to press '1' if they were not responsible for the alleged suspicious activity before placing them on hold, setting the stage for the next phase of the social engineering attack.
Execution of the NFC Card Scanning Attack
Following the automated audio prompt, a suspect impersonating a real bank employee took over the call. This individual claimed that the victim’s debit card had been blocked and instructed the recipient to download a malicious application.
Victims were then asked to scan their debit cards by holding them against their mobile phones. This action allowed the application to extract sensitive data directly from the card’s NFC chip, which supported contactless payments.
ATM Cash Withdrawals and Infrastructure Seizure
Once extracted, the card information was instantly transmitted to another accomplice who stood ready with a prepared application at an ATM to withdraw money from the victim’s account.
Investigators took decisive action against the cybercriminal infrastructure by taking the fraudsters' servers offline and seizing them alongside their laptops and mobile phones.
Suspect Arrests and Ongoing Investigation
The two suspects—a 23-year-old man from Vaassen and a 25-year-old man from Ede—were arrested on October 6. Authorities believe the younger suspect built the underlying infrastructure and orchestrated the attacks, while the older man assumed a coordinating role.
Both individuals remain in police custody while the investigation continues. Law enforcement agencies continue to monitor related cyber threats, noting broader international enforcement actions such as those detailed in reports like [US Arrests Two in Crackdown on North Korean IT Worker Laptop Farms](https://www.securityweek.com/us-arrests-two-in-crackdown-on-north-korean-it-worker-laptop-farms/), highlighting a persistent global focus on dismantling complex criminal networks.
Sources
- SecurityWeekDutch Police Arrest Two Over NFC Relay Attacks That Drained $400,000+ From Bank Accounts
Continue chronologically
Related stories
Revolve Data Breach Exposes Data of Over 180,000 People
Online fashion retailer Revolve discloses a data breach impacting at least 180,000 individuals after hackers accessed its e-commerce platform.
Cybersecurity Roundup: Anthropic Breach Dispute and Server Flaw
A weekly cybersecurity roundup details an Anthropic breach dispute, a critical 16-year-old UEFI server flaw, and an AI data leak at Cloudflare.
Drupal Warns of Active Exploits Against Commerce Core Flaw
Drupal urges online store owners to patch a critical Commerce Core access bypass vulnerability actively being exploited in the wild.
Capcom Discloses Data Breach Impacting Millions of Users
Japanese gaming giant Capcom has suffered a data breach exposing over 11 million email addresses and account details via unauthorized access.
