NFC Relay Scam Took €380,000 From About 170 Bank Customers in Three Weeks

About 170 people held their bank card against their own phone and lost €380,000 in three weeks. Dozens were in their 20s and 30s. An app sent the chip to an ATM. Czechia, Russia, Italy and Brazil saw it first.

The call began with a recorded voice, made with AI. A phone rang somewhere in the Netherlands, and the message said there was suspicious activity on the bank account. The message asked for a 1 on the keypad if that activity was unfamiliar. Those who pressed 1 heard music for a while, and then someone came on the line who said they worked for the bank.

That person had a story ready. The bank card had to be blocked, and it had to happen quickly, before more money disappeared. To block it, the customer had to download an app and hold the card against the phone so the app could scan it.

The scammers had made dozens of different audio fragments with AI, with different voices, banks, companies and scenarios, ready for whoever picked up. The victims came from across the country and were of all ages, the police say, with dozens of people in their twenties and thirties among them.

While the card was held against the phone, an accomplice with the same app stood at a cash machine somewhere else, waiting. The police call this person the pinner. Thousands of euros came out of those machines while the people on the phone still believed they were blocking their card.

The cybercrime team of the Rotterdam police counted about 170 victims and €380,000 in damage on the group’s servers, over three weeks. The case began in mid-September 2026, when Dutch banks reported a new form of bank helpdesk fraud through the Electronic Crimes Task Force, where banks, the police and the Public Prosecution Service work together. Ruben van Well of the cybercrime team said the police had not come across this technical method before. He described the scammer in this case as a convincing caller who comes across as very professional.

A bank card has a small chip inside it that can talk by radio, but only over a very short distance. That is NFC, near field communication, and it is what makes contactless payment work. When a card is held against a payment terminal or a cash machine, the machine sends the chip a series of short commands and the chip answers each one. Those commands and answers are called APDUs. The chip answers any reader held close to it, and a phone with NFC can be that reader.

The app the victims installed read the card the way a payment terminal would, and then it did one more thing. It sent the card’s answers over the internet to a second phone.

That second phone was in the pinner’s hand at the cash machine, and it presented itself to the machine as the victim’s card. When the machine sent a command, that command traveled over the internet to the victim’s phone and on to the card. The card’s answer traveled back the same way to the machine. This is called NFC relay, and the card never left the victim’s hand. The chip makes a new one-time security code for each contactless payment, so the card has to answer live, at the moment of the withdrawal. That is why the pinner stood at the machine at the same time.

The chip alone does not get cash out of a Dutch machine. Contactless withdrawal at Geldmaat, the Dutch cash machine network, has been possible since October 3, 2023, and the PIN still has to be typed in at the machine. So the pinner needed the PIN as well.

The Dutch police have not said how the scammers got the PIN in this case. Their warning does name it: a bank will never ask you to download an app, hold your bank card against your phone, or give your PIN. In earlier cases of this trick in other countries, the PIN came from the victim. The app asked for it, or the caller did, as part of what was presented as a check.

The trick was first found in Czechia. From November 2023, a group there used fake banking apps to steal the login details of customers of three Czech banks, and in March 2024 it added a second app for the card. Victims got a text message about a tax refund with a link to the fake banking app. After they logged in, someone called them posing as their bank, said their account had been compromised, and sent a link to that second app. It asked for their client number, date of birth and PIN, and then told them to hold their card against the phone until it was recognized. Their phones did not have to be rooted. Because the victims had already typed their banking login into the fake app, the attackers could also change the withdrawal limits on their accounts. When a cash withdrawal failed, they could still move the money to other bank accounts.

ESET, the security company that found the malware and named it NGate, published its analysis in August 2024. The malware was built on NFCGate, a research tool made by students at the Technical University of Darmstadt in Germany. In March 2024, Czech police arrested a 22-year-old who had been taking money out of cash machines in Prague. He had 160,000 Czech koruna on him, more than €6,000, and the police said that money came from only the last three victims.

After that, NFC relay spread to other countries, and the same company measured more than 35 times as many NFC attacks in the first half of 2025 as in the second half of 2024. In the six months after that, its numbers went up by another 87 percent.

In Russia, police detained the developer and the main administrator of one of these tools in December 2025. The preliminary damage was more than 200 million rubles. Victims there were told to hold their card against their phone and type their PIN for a fake authorization.

In Italy, bank customers were hit by SuperCard X, which the security company Cleafy exposed in April 2025. It was run by Chinese-speaking criminals who rented the tool out to others.

By October 2025, the mobile security company Zimperium had counted more than 760 malicious apps of this kind, found since April 2024, with more than 70 command servers and download sites behind them. About 20 banks and other institutions had been impersonated, in countries including Russia, Poland, Czechia, Slovakia and Brazil.

In April 2026, ESET described a new version of NGate in Brazil, active since around November 2025 and hidden inside HandyPay, a legitimate app for relaying NFC payments. Victims got it through a fake lottery website and a fake Google Play page for an app that promised to protect their card. It steals the PIN and sends it to the attackers, and the researchers found signs that the malicious code was written with help from generative AI.

A month later, the company behind the SuperCard X research described two more families. DevilNFC came from Spanish-speaking criminals and impersonated a Spanish bank. NFCMultiPay was built by a Portuguese-speaking developer, most likely in Brazil. Both collect the card’s PIN as a fixed step, and both showed signs of code written with AI. After the first tap, DevilNFC asks for the PIN and sends it in plain text, together with the name of the bank and the victim’s IP address, to the attackers’ server and to a Telegram bot. Then it shows a fake verification error, so the victim holds the card against the phone for another 10 seconds and the relay gets more time. The company’s conclusion was that local groups have stopped buying these tools from Chinese-speaking sellers and now build their own.

A related method works with card details that were already stolen. ThreatFabric named it Ghost Tap in November 2024. The stolen card is loaded into Apple Pay or Google Pay on one phone, and its NFC signal is relayed to helpers who pay with it in shops. The person running it can sit in a different country. The same researchers explain why a bank has trouble spotting it. The payments appear to come from the same device, a single payment can stay below the amount that triggers a check, and the phone with the stolen card on it can be in airplane mode. In August 2025, Recorded Future reported that Chinese-speaking groups use this for cash machine withdrawals and for buying jewelry and phones, which they sell for cash through Telegram channels. Some of these groups work only within China, Singapore, Malaysia, Thailand and the Philippines, and the researchers wrote that these campaigns can be run on a global scale. In Singapore the method became widely known through high-profile arrests.

Bank helpdesk fraud itself is not new in the Netherlands. In 2025 it hit slightly fewer than 5,900 people and cost €25.8 million, according to the yearly fraud figures of the Dutch banks. A little over 45 percent of that damage to private customers was paid back by the banks as a goodwill gesture. This one group made about 170 victims in three weeks.

On October 15, 2026, the Court of Justice of the European Union ruled on a phishing case from Poland. A bank customer had lost about €700 after entering her login details on a fake copy of her bank’s website. Her bank refused to pay it back, because it said she had been grossly negligent. The court ruled that a bank has to refund an unauthorized payment immediately, at the latest by the end of the business day after it noticed or was told about the payment. The customer has to report it without undue delay. The only exception is when the bank has reasonable grounds to suspect fraud by the customer and reports those grounds to the authorities. A bank that believes the customer was grossly negligent can try to get the money back afterwards.

The police advice:

• → A bank never asks you to download an app, hold your bank card against your phone, or give your PIN
• → When a call does not feel right, hang up and look at the number that called you
• → Do not install apps from a link in a text message or a WhatsApp message
• → In case of doubt, call your bank yourself on the number from its own website
• → After it happened, contact your bank at once to check whether money was taken and to block the account or stop transactions if needed, report it to the police, and keep the messages as evidence

On October 6, the police arrested two men. According to the police, a technician and a coordinator were responsible for the technology and for sending out the fake calls. A 23-year-old from Vaassen is suspected of handling the technical side of the fraud and directing others. A 25-year-old from Ede is suspected of a coordinating role. The police took the group’s servers offline and are going through that data, along with the phones and laptops they seized. On October 20, the court decided that both men stay in custody for another 90 days while they wait for their trial. Neither of them has been convicted, and the police have not said whether AI played any part in building the app.

The Rotterdam investigator also said that pinners are easy to replace.

In Czechia in early 2024, it started with a text message about a tax refund. In the Netherlands in September 2026, it started with an AI voice. The step that got the money out stayed the same: a bank card held against a phone.

In a lab on your own laptop, you can clone a login page and watch what a victim types into it. My Ethical Hacking Complete Course Zero to Expert takes you there step by step: reconnaissance, scanning, exploitation and traffic analysis, hands-on, from your first day with no Linux or hacking background.

→ Join my complete ethical hacking course

Hacking is not a hobby but a way of life.

Sources:

Dutch Police | ESET | Cleafy