Dutch police announced on October 26 the arrest of two men over a fraud scheme that combined AI-generated bank helpdesk calls with an app that read victims’ bank cards over NFC. Rotterdam police arrested a 23-year-old from Vaassen and a 25-year-old from Ede on October 6, and both remain in custody.
Police say the scheme cost 170 victims in the Netherlands more than EUR 380,000 in about three weeks. One report put the loss at over $400,000, while another gave EUR 380,000, about $425,600.
How the AI-Voiced Calls Led Victims to Install the App
Victims received AI-generated recorded calls impersonating banks, companies and other scenarios. The message asked them to press 1 if they did not recognize “suspicious activity.” They were then connected to a person posing as a bank employee, who said the card was blocked and told them to install an app and hold the card to the phone.
NFC Chip Data Relayed to an Accomplice at an ATM
The app read the card’s NFC chip and relayed the data to an accomplice waiting at an ATM, who could then withdraw cash. Victims were of all ages, with dozens in their twenties and thirties.
Vaassen and Ede Suspects Split Technology and Coordination Roles
Police suspect the 23-year-old from Vaassen built the technology and directed the group. They suspect the 25-year-old from Ede acted as coordinator. Investigators seized phones and laptops during the arrests.
How Banks Triggered the Investigation
The case began in mid-September when banks reported the fraud through the Electronic Crimes Task Force. Police identified the infrastructure within days and monitored the servers before taking them offline. The investigation continues.
Dutch Police Warn No Bank Will Ask Customers to Scan Cards
Police warn that no bank will ask customers to scan a card with an app. The scheme’s relay approach bypasses PINs and passwords by moving card data to the ATM in real time, and the AI-voiced calls allowed the group to contact large numbers of people with automated messages before routing those who responded to a human operator.
Reports Differ on Size of the EUR 380,000 Fraud Losses
The two outlets differ on the currency and size of the losses, but both describe losses in the range of EUR 380,000, and the police figures cited place the total over that amount across the 170 victims over roughly three weeks.
The investigation remains open, and police have not said whether more suspects are being sought or whether the seized servers point to additional victims beyond the 170 counted so far.
Timeline of the Dutch Investigation
The case moved quickly. Banks reported the fraud in mid-September through the Electronic Crimes Task Force. Within days, police identified the infrastructure behind it and monitored the servers. On October 6, Rotterdam police arrested the two suspects, took the servers offline and seized phones and laptops. The announcement followed on October 26.
The scale of the losses over the three weeks is the main measure of impact. A total of 170 victims lost more than EUR 380,000, about $425,600, according to police figures reported by Dutch media. Victims included people of all ages, with dozens in their twenties and thirties.
The method combined two techniques. The AI-generated recorded calls scaled up the first contact, and the NFC app turned a phone into a card reader that passed card data to a person at an ATM. The report describes the result as relay-style card theft that bypasses PINs and passwords.
Police said the older of the two suspects, the 25-year-old from Ede, was the coordinator, while the 23-year-old from Vaassen is suspected of having built the technology and directed the group. Both remain in custody and the investigation continues.
