Dutch police arrest two in €380k NFC relay bank fraud

Dutch police have arrested two men over a bank-helpdesk fraud scheme that combined AI-cloned voices with a near-field communication (NFC) card-reading app to steal about €380,000 from 170 victims, NL Times and DutchNews reported. The Rotterdam-led investigation took the group's fake app and server offline and seized hundreds of thousands of euros in cryptocurrency.

How the scam worked

Victims received calls that opened with AI-generated audio — police say the group produced dozens of recordings spanning different voices, banks, and scenarios — before handing off to a caller posing as a bank employee. The "employee" told the victim their card was blocked and instructed them to install an app and hold their bank card against the phone. The app read the data from the card's NFC chip and relayed it to an app held by an accomplice, who then withdrew cash from an ATM.

The structure is a classic relay: the victim's physical card never leaves their hand, but its NFC credentials are piped in real time to a second device standing at a cash machine. AI voice synthesis is the newer ingredient, letting one operation impersonate multiple banks convincingly and at scale.

The suspects

Police arrested a 23-year-old from Vaassen and a 25-year-old from Ede in early October. According to the reporting, the 23-year-old is suspected of developing the technology and directing the group, and the 25-year-old of coordinating the operation. A Rotterdam court ordered both held for at least another 90 days while the investigation continues, and police said they are "not ruling out further arrests." (Outlets differ on the exact arrest date; the €380,000 and 170-victim figures are the police-sourced ones.)

What to do today

Banks and their customers are the exposure here, not a product to patch. Concrete steps:

1. If a caller asks you to install any app and hold your card to your phone, hang up. No bank asks for that; it is the relay step itself.
2. Treat an unexpected "your card is blocked" call as hostile regardless of how the voice sounds — synthetic audio now mimics bank scripts and multiple institutions.
3. Fraud teams: watch for ATM cash-outs shortly after a contactless-provisioning or wallet-add event tied to an inbound support call, and flag the pattern for staff training.
4. Report suspected helpdesk fraud to your bank and, in the Netherlands, to the police — timely reports fed this investigation.

Context

The arrests land as European police increasingly chase NFC relay crews: the technique moved from research demos to organized cash-out operations over the past two years, and prosecutors now treat the app developers and ATM runners as one conspiracy. What is new is the production-line use of generative audio to script the social-engineering front end — the same capability security teams are bracing for in phishing now showing up in voice fraud, where there is no email header to inspect and the victim is the only control.