Dutch Police Bust NFC Relay Fraud Ring That Stole €380,000 From 170 Victims

Two men have been arrested in the Netherlands after running a fraud operation that combined AI-generated voice calls with NFC card skimming to drain bank accounts across the country. Total losses came to over €380,000, roughly $425,600, spread across 170 victims.

The scheme was clever, if deeply unpleasant. Targets received phone calls featuring AI-generated audio impersonating their bank, warning of suspicious activity on their account. Press 1 if it wasn't you. Standard social engineering stuff, but with a modern twist.

Once the victim engaged, a live fraudster took over the call, posing as a bank employee. The story: your card has been blocked, we need to verify it. Download this app, hold your card against the back of your phone. Simple enough instructions that plenty of people followed.

What the app was actually doing was reading the NFC chip used for contactless payments and forwarding that data in real time to an accomplice already positioned at a cash machine. The relay attack meant the physical card never left the victim's possession, yet someone else was using it to withdraw cash simultaneously.

Police arrested a 23-year-old from Vaassen and a 25-year-old from Ede on 6 October. Investigators believe the younger suspect built and ran the technical infrastructure, while the older one handled coordination. Servers, phones, and laptops were seized, and both men remain in custody.

The NFC relay technique itself isn't entirely new in academic circles, but deploying it at scale against ordinary bank customers, wrapped in an AI voice phishing layer, marks a meaningful step up in consumer fraud sophistication. The barrier to entry for this kind of attack is dropping fast, which is the part worth worrying about.