Dutch Police Arrest Two Over NFC Relay Attacks That Drained $425,000

Dutch authorities have apprehended two individuals suspected of orchestrating a sophisticated bank helpdesk fraud scheme that utilised near-field communication (NFC) relay technology to steal more than €380,000 (approximately $425,600).

The Dutch police confirmed that the operation targeted at least 170 victims across various age groups. The arrests, which took place on 6 October, involved a 23-year-old man from Vaassen and a 25-year-old man from Ede. Investigators believe the younger suspect was responsible for building the technical infrastructure, while the older suspect managed coordination.

AI-Generated Audio and Social Engineering

The fraud began with a classic social engineering tactic. The suspects contacted potential victims via phone, playing AI-generated audio clips that mimicked official bank warnings about suspicious account activity. Victims were prompted to press a number on their keypad if they did not recognise the transactions, after which they were placed on hold.

A fraudster, posing as a bank employee, would then join the call. They convinced the victim that their debit card had been compromised or blocked. To resolve the issue, victims were instructed to download a specific mobile application and scan their physical bank card by holding it against the back of their smartphone.

The Mechanics of the NFC Relay Attack

The malicious application was designed to extract data directly from the card’s NFC chip, which is used for contactless payments. This data was not merely stored but relayed in real-time to a co-conspirator waiting at an automated teller machine (ATM).

By receiving the NFC data on their own device at the ATM, the criminal could mimic the victim’s card and withdraw cash immediately while the victim was still on the phone. This method bypasses traditional security measures because the bank’s systems perceive the transaction as a legitimate contactless card presence.

Law enforcement officials have since taken the suspects’ servers offline and seized multiple laptops and mobile phones for forensic analysis. Both suspects remain in custody as the investigation continues. This case highlights the evolving nature of bank fraud, where criminals combine synthetic audio with technical exploits to bypass modern authentication methods.