Dutch NFC Extraction Scheme Drained €380k via AI Voice Calls and Phone-Based Card Skimming

The operation combined vishing with a mobile app that extracted contactless payment data from debit cards. Victims received AI-voiced calls impersonating banks, were instructed to press 1, then transferred to a live operator who directed them to download an app and tap their card to the phone. Extracted data enabled immediate ATM withdrawals by a second actor. Servers, phones, and laptops were seized, shutting down the infrastructure.

Police statements and victim counts establish the €380,000 loss across 170 accounts spanning all age groups. The scheme relied on social engineering to bypass card-present verification rather than true real-time NFC relay. No evidence of widespread card issuer tokenization failures appears in the arrest details, indicating the weakness was user action combined with app permissions on Android devices.

This pattern matches prior European vishing campaigns that escalated to device-based skimming once call volume scaled. The 23-year-old suspect's role in building the backend suggests reusable tooling now available to other operators. Contactless limits and ATM PIN requirements provided insufficient friction once PAN and expiry data were obtained.

Next steps include forensic review of seized servers for additional phone numbers or victim lists. Banks should accelerate rollout of transaction alerts tied to NFC taps and restrict app-based card scanning permissions. Expect copycat operations within 60-90 days absent coordinated Europol takedowns.