Dutch authorities have arrested two men, aged 23 and 25, over a card-fraud scheme that took more than EUR 380,000, roughly $425,600, from 170 victims. The pair were detained on October 6 in Vaassen and Ede. Police took their servers, phones and laptops offline.
The sequence starts with a call. A recording built with AI-generated audio impersonates banks and companies, tells the recipient there is suspicious account activity, and asks them to press 1 if they were not responsible. The victim is then put on hold.
Whoever takes the handoff then presents themselves as bank staff, insists the debit card is now blocked, and walks the caller through installing an app while touching the card to the handset. The app reads the contactless chip.
A runner stood at the cash machine
Card data moved instantly to a third person with the same app installed, standing at an ATM and ready to withdraw. The victim keeps possession of the physical card throughout, so nothing looks stolen at the household level.
Investigators say the younger suspect probably built the infrastructure and directed the operation, while the older one coordinated it. Both remain in custody.
The pattern deserves attention from banks and fraud teams because the theft needs no physical compromise and no malware on the victim’s device beyond a voluntarily installed app. Because the extorted data is the chip’s own contactless payload, detection should focus on sudden card-present withdrawals far from the customer’s location minutes after a call, plus app installs from outside official stores prompted during inbound calls.
Customer guidance stays simple: no bank will ask you to hold a card against your phone mid-call.
