AI Bank Calls Enabled $425K NFC ATM Theft

Dutch police arrested two suspects accused of using AI-generated bank fraud calls to steal more than €380,000 from 170 victims. The callers falsely warned of suspicious account activity, then posed as bank employees and persuaded victims to download an app and tap their debit card to their phone, enabling cash withdrawals.

Key findings

• AI-generated audio claimed there was suspicious activity on a victim's bank account.
• Victims were instructed to press '1' if they did not recognize the activity, then were placed on hold.
• A live caller impersonated a bank employee, said the debit card was blocked, and requested that the victim download an application and scan the card against the phone.
• The app captured NFC chip data from the debit card and relayed it to an accomplice waiting at an ATM.
• The alleged scheme stole over €380,000 (about $425,600) from 170 victims.

Who’s being targeted

• Commonly targeted roles: All employees, Finance and accounting staff, Employees with corporate payment cards, Customer-facing financial-services staff.
• Affected industries: Banking and financial services, Consumers and retail banking customers.
• Attack channels: vishing.
• Impersonated: Victim's bank and a bank employee.

Awareness takeaways

• Do not install an app or scan/tap your payment card because of an unexpected phone call; end the call and contact the bank using the number on the card or its official app.
• Treat urgent automated fraud alerts as unverified until you independently contact the bank; pressing a keypad option can route you directly to a scammer.
• Warn employees that convincing or AI-generated audio is not proof that a caller is legitimate; use trusted, independent verification for account-security requests.

Red flags to watch for

• An unsolicited caller asks the recipient to install an application.
• The caller asks the recipient to tap or scan a payment card against a phone.
• The initial automated alert creates urgency and routes the recipient to an unverified person.