Dutch police say a caller's app relayed victims' card chip data to an accomplice: 170 victims, about 380,000 euros

170 victims and about 380,000 euros in three weeks: what the police figure is, and is not

The Dutch police say a criminal group took about 380,000 euros from about 170 victims during the three weeks in which investigators could see the group's servers. That is about 2,235 euros a victim (derived: 380,000 divided by 170; the police give both figures as approximate). This briefing was written from the police release itself, a Dutch page on politie.nl that the police date 21 October 2026, read in Dutch from 12:04 GMT on Monday 26 October 2026, and not from the press coverage of it. The release says two suspects were arrested on 6 October and describes the method as a new form of bank helpdesk fraud: a recorded call, a person posing as a bank employee, an app on the victim's phone, and a card held against the phone.

What the figure does not establish matters as much. It is what the police saw in a window, not the total for the scheme. The release does not say how many people were called, how many pressed 1, how many attempts failed, or when the scheme began. It does not name the app, say how the victim received it, say how a PIN reached the person at the machine, or say whether the banks have refunded anyone. SecurityWeek reported the arrests on 26 October 2026 at 7:47 AM ET (about 11:47 GMT, derived), 20 days after the arrests and five days after the police page (derived), and its page links to no police source.

This is a story about a control that is not a technical one. The police advice at the end of the release is a behavioural rule, and so is most of what the security vendors advise on this fraud type. The sections below set out what the police say, set it against what the record leaves out, check the secondary reporting against the primary, and rank what a customer and a bank fraud team can do.

How the police say the scheme worked

The release is by the Rotterdam police Team Cybercrime, with the Public Prosecution Service leading the investigation. The sequence below follows it, with the police's own wording translated from Dutch. Where the release is silent, the diagram and the text say so.

1. Signal. Mid September, Dutch banks told the Electronic Crimes Task Force, a body in which banks, police and prosecutors share signals, that they were seeing victims of a new kind of bank helpdesk fraud.
2. Sight of the servers. Within a few days the team could see the digital infrastructure of the criminal group, which the police call a criminal collaboration.
3. The call. Victims were phoned and played a sound clip. The fraudsters had used artificial intelligence to make dozens of clips with different voices, banks, companies and scenarios. The voice pointed to suspicious activity on the account and asked the victim to press 1 if they were not responsible. Hold music followed, then a supposed bank employee.
4. The script. Victims were pressured with a fixed script: act quickly, by blocking the bank card. They were told to download an app and scan the card by holding it against the phone.
5. The forward. Through the newly installed app, the criminals could temporarily send the data from the card's NFC chip, the chip used for contactless payments, to the app of a pinner (the police's word for the person at the machine). A pinner with the same app was ready at a cash or payment machine at the same time. Without the victims noticing, thousands of euros were taken.
6. The roles. A technician and a coordinator were responsible for the technology and for starting the fake calls, and they also directed the pinners.

Zoom

The police say the forwarding was done through the app. The word relay does not appear in the release. The security industry calls forwarding of this kind an NFC relay, and the section on how a relay works below uses that word, attributed to the vendors that use it.

The arrests, the roles and what the police say about tactics

On 6 October 2026 the police arrested two men: a suspect aged 23 and a suspect aged 25, ages the release prints. The 23 year old is suspected of being the technical person behind the fraud and of directing the others. The 25 year old is suspected of a coordinating role. The police took the servers offline for examination and seized the suspects' phones and laptops. On Tuesday 20 October the Rotterdam court's chambers decided that both stay in custody for at least 90 more days, pending the hearing of their case. These are suspects, not convicted people, and the release names no offence they will be charged with.

One passage is a statement of method by an investigator. Arresting pinners, the investigator says, often has little lasting effect if the aim is to prevent new victims, because pinners are easily replaced. The team chose instead to reach the top layer of the group, and says that stopped the criminals and their system. The release does not say that any pinner was arrested, found or identified, or that the person who spoke on the calls was identified. It gives the time from first signal to arrest as less than four weeks.

Stated and not stated: the record, line by line

The table sets what the police release states against what it does not. Not stated means not found in the release, which was read in full. It does not mean the information does not exist.

The numbers, with the arithmetic

Every figure here is either printed in the release or derived from figures printed in it or in SecurityWeek. Derived figures are labelled. The police give the loss and the victim count as approximate.

SecurityWeek and the police release, side by side

SecurityWeek's report is a fair summary of the release, and the differences are small. They matter because a reader who sees only the report would take several things as established that the police do not state. NL Times, the English language Dutch outlet whose report appeared on 21 October, was read as a second secondary source.

Four friendly names, and what the record shows

A comforting or alarming label is not a control. Four appear in this story.

The interests behind the sources are worth stating once each. The Dutch Banking Association, whose consumer security site is read below, speaks for banks, and its page says banks are not obliged to compensate customers who transfer money themselves. ESET, ThreatFabric and Kaspersky sell security products and publish research that supports the need for them. CERT Polska is the Polish national computer emergency team and sells nothing. None of this makes the findings wrong. It is a reason to separate what each source observed from what it recommends.

How an NFC relay works, at the level a defender needs

None of the sources below describes the Dutch case. The police name no tool and publish no sample, so any link between the Dutch group and a named family would be this site's guess, and none is made. What follows is what other published research says about the same technique, because it tells a bank or a customer what to look for.

Two points follow, and the second is inference. First, three of the four sources (ESET, Kaspersky and CERT Polska) say the app that read the card also asked the victim for the PIN. The Dutch police release does not say whether it did, so how the pinner obtained a PIN is an open question rather than a settled one. Second, a relay needs the phone, the server and the pinner to talk in real time, so any delay or distance between the card tap and the machine is, in principle, a detection point. ThreatFabric says readers should look for latency, and none of the sources shows that any Dutch machine does.

Technical details

The police published no technical artefact. The release gives no app name, package name, hash, domain, address, server detail or detection rule, and the servers' data is still being examined. The first block therefore holds only the wording the police did publish, which is what a bank's customer messaging and a call centre script can be built against. The remaining blocks are artefacts that other organisations published about other NFC relay campaigns. They are given so a defender knows what published relay malware looks like. They are not indicators of the Dutch case, and finding one on a device would not link it to this group.

vroeg het slachtoffer om op '1' te drukken als hij/zij niet zelf verantwoordelijk was voor die verdachte activiteit.
Er moest snel gehandeld worden, door de bankpas te blokkeren
Daardoor konden de daders via de net geïnstalleerde app de gegevens van de NFC-chip van de bankpas tijdelijk doorsturen naar een app van de pinner
Je bank vraagt je nooit om een app te downloaden, je bankpas tegen je telefoon te houden of je pincode te geven.

The next block is the Android service declaration CERT Polska printed from the Polish NGate sample it analysed (3 November 2025). In plain words: it registers the app with Android as a host card emulation service, so the phone's NFC stack can hand the app a reader's commands and the app can answer as if it were a payment card. A managed fleet can inventory installed apps for a service with this action that is not a known wallet. CERT Polska's own caveat is that the app can be set as a payment service.

<service android:name="rha.dev.me.nfc.hce.ApduService"
         android:permission="android.permission.BIND_NFC_SERVICE"
         android:exported="true">
  <intent-filter>
    <action android:name="android.nfc.cardemulation.action.HOST_APDU_SERVICE"/>
    <category android:name="android.intent.category.DEFAULT"/>
  </intent-filter>
  <meta-data android:name="android.nfc.cardemulation.host_apdu_service"
             android:resource="@xml/hce"/>
</service>

CERT Polska's indicator list follows, as it printed it under the heading IOC: five hexadecimal values (it does not label the hash type on the page; 32 characters each), the address and port of the server the sample contacted, and the file hosting path the sample was delivered from. This site defanged the address by putting the last dot in brackets. A defender can search proxy, DNS and flow logs for the address and path, and treat a match as a lead and not as proof of the Dutch case.

2cee3f603679ed7e5f881588b2e78ddc
701e6905e1adf78e6c59ceedd93077f3
2cb20971a972055187a5d4ddb4668cc2
b0a5051df9db33b8a1ffa71742d4cb09
bcafd5c19ffa0e963143d068c8efda92
91.84.97[.]13:5653
files[.]fm/u/yfwsanu886

The last block is what ESET printed about the 2024 Czech NGate samples (22 August 2024): the shared package name of the analysed samples, the SHA-1 fingerprint of the one developer certificate that signed all six, and three domains, already inactive at the time of writing. ESET also says NGate used port 5566 to communicate with its server to exfiltrate NFC traffic. The first two lines are an app package name and a certificate fingerprint, which a mobile device management tool can match. The domains are history.

rb.system.com
0C799950EC157BB775637FB3A033A502F211E62E
raiffeisen-cz[.]eu
app.mobil-csob-cz[.]eu
nfc.cryptomaker[.]info

What to hunt and harden, at defender level and drawn from the sources above. For a bank: signals of a card newly linked to a device and of transactions in places that cannot be reached in the time between them (ThreatFabric), and any machine logic that checks the delay of a contactless exchange (ThreatFabric's suggestion, unproven for Dutch machines). For a managed fleet: installs from outside the official store, apps that register as a payment card service, and a changed default payment app (Kaspersky). For a call centre: the exact promise in the police advice, that the bank never asks for an app, a card scan or a PIN, said by the bank first, before the fraudster says the opposite.

What the Dutch bank and police advice says, and what it leaves out

The police tell the public that the bank never asks you to download an app, to hold your bank card against your phone or to give your PIN, and to hang up if the call does not feel right. Their tips name two elements that always return, trust and pressure, and say to check the sender's number, not to press unknown links or download apps from a link in a text or messaging app, and to contact the organisation on the official number from its own website. A victim is told to contact the bank at once, ask it to check whether money has actually left the account, have the account blocked if needed, and report to the police.

The Veilig Bankieren page on bank helpdesk fraud, whose copyright line is the Dutch Banking Association's, adds that a bank never asks by phone or text for PINs, passwords or other security codes, and never asks to install software or apps on a computer, tablet or smartphone. It says banks are not obliged to compensate this type of damage because the customer moves the money, but usually do so from goodwill under conditions, the main ones being a police report, a private account and a first occurrence. The page was read on 26 October 2026 and does not mention NFC or card scanning, so it was written before this variant was reported, and whether the goodwill terms apply to a card scan that moves no transfer is not stated anywhere read.

What to do, in the order worth doing

The list is for readers worldwide: customers first, because the fraud depends on one person's reaction during one call, then the bank fraud teams that can act before the call. Items that are this site's inference rather than a source's advice are marked.

What could not be verified

• The app. Its name, its channel, its platform and any indicator are not in the release.
• The PIN. How the pinner obtained a PIN, if one was needed, is not stated. The Dutch advice lists the PIN among things a bank never asks for.
• Cash machine or shop terminal. The release says a cash or payment machine and says thousands of euros were taken. It does not separate the two.
• Voices. Whether the audio used cloned voices or synthetic speech is not stated.
• Refunds, limits, other suspects, offences, accomplices abroad. Not stated. No Dutch bank statement on card limits was found, and no statement from the Dutch Authority for Consumers and Markets on this fraud type was found.
• An English police release. None was found. The Dutch page was read in Dutch and translated by this site. The Public Prosecution Service and Europol pages were searched and no item on this case was found.
• A UK angle. No UK body's guidance on this fraud type was found, so there is no UK section.
• Time stamped. The police page was read from 12:04 GMT and read again at 12:15 GMT on Monday 26 October 2026. Custody, charges and bank statements could change within hours.

The question that exposes the gap

If a voice that sounds exactly like your bank tells a customer tonight to hold a card against a phone, which control other than that customer's own judgement, under pressure, in the middle of one call, would stop it becoming cash taken somewhere else?

Key facts