Dutch Police Arrest Two in $400,000 NFC Relay and AI Voice Fraud Scheme
Dutch authorities have arrested two individuals suspected of defrauding over 170 victims of more than $400,000 using a sophisticated scam involving AI-generated voice messages and NFC relay attacks.
Dutch police have apprehended two individuals in connection with a novel bank helpdesk fraud scheme that resulted in over $400,000 in losses for approximately 170 victims. The operation, which targeted individuals of all ages, leveraged a combination of artificial intelligence and NFC technology to trick unsuspecting customers into divulging sensitive financial information.
The attackers initiated their scheme by contacting potential victims and playing AI-generated audio segments designed to mimic official bank communications. These recordings falsely claimed that suspicious activity had been detected on the recipient's bank account, prompting the victim to take immediate action. The AI-generated messages often instructed users to press '1' if they were not responsible for the alleged activity, after which they would be placed on hold.
During the hold period, a suspect, posing as a bank employee, would take over the call. This imposter would inform the victim that their debit card had been blocked due to the suspicious activity. To 'resolve' the issue, the victim would be instructed to download a specific application onto their smartphone and then scan their credit or debit card by holding it against the phone.
This critical step enabled the malicious application to extract the necessary data from the card's Near Field Communication (NFC) chip, which supports contactless payment functionality. The stolen card data was then relayed to an accomplice who was positioned at an ATM. This accomplice would use the illicitly obtained card information to withdraw funds directly from the victim's bank account.
The total amount defrauded in this operation reached over €380,000, which is approximately $425,600 USD. The Dutch police reported that 170 victims were affected by this elaborate scam, highlighting the broad reach and impact of the operation.
The two suspects, a 23-year-old from Vaassen and a 25-year-old from Ede, were arrested on October 6th. Investigations suggest that one suspect was responsible for developing the technical infrastructure and orchestrating the attacks, while the other played a key role in coordinating the fraudulent activities. Authorities have since taken down and seized the fraudsters' servers, along with their mobile phones and laptops, as part of the ongoing investigation. Both individuals remain in custody.
This incident underscores the growing sophistication of financial fraud, particularly the convergence of social engineering tactics with advanced technologies like AI voice generation and NFC data extraction. The use of AI to create convincing, personalized scam messages, combined with the direct compromise of payment card data, presents a significant challenge for both consumers and financial institutions. Law enforcement agencies continue to grapple with these evolving threats, emphasizing the need for increased public awareness and robust security measures to protect against such attacks.