// Contents
The call opens with a recording. A calm voice reports suspicious activity on your account and asks you to press 1 if you didn’t authorize it. Then a polite “bank employee” comes on the line. Your card needs to be blocked right away, he says, so please install this app and hold the card against the back of your phone. You do. At that same moment, in another city, a young man holds his own phone up to an ATM and withdraws cash from your card, which is still sitting in your hand.
That’s the playbook Dutch police say one group ran until Rotterdam’s cybercrime team broke it up in October 2026. In the three weeks investigators watched it, they counted about 170 victims and €380,000 in losses, and they weren’t just retirees: dozens were in their twenties and thirties. The trick itself is at least two years old. What’s new is the AI-generated voices, and the question they drag behind them: who pays back someone who pressed their own card to their own phone?
A card stretched across the internet
Contactless payment runs on NFC, a radio link that works over a few centimeters. The terminal or ATM sends the card a challenge, the chip answers, and that answer tells the bank the card is genuine. Everything rests on simple physics: if the chip answers, the card must be right there.
The scam app cheats that physics. It reads the chip’s answers through the NFC antenna in the victim’s phone and forwards them, via a server, to a second phone in an accomplice’s hand. The accomplice taps that phone on an ATM, and the machine “sees” a card that is actually at the other end of the country. The card isn’t copied so much as extended: an invisible cable dozens of kilometers long runs between the chip and the cash machine.
Dutch police describe the handoff. While the victim pressed the card to the phone, a “pinner” with the same app was already waiting at an ATM or a payment terminal. (The Dutch verb pinnen means to withdraw cash, hence the name for the accomplice who collects it.) Thousands of euros went out, and the victims didn’t notice. The police statement doesn’t say how the group got PIN codes. A police spokesperson told the broadcaster RTL Nieuws that sometimes a PIN isn’t even needed, without saying which transactions he meant. In a similar Czech scheme, victims typed it straight into the app. That’s why the police keep repeating three things your bank will never ask you to do: download an app, hold your card to your phone or give your PIN.
Born in a university lab
The attack has an academic family tree. Students at the Secure Mobile Networking Lab at the Technical University of Darmstadt in Germany built NFCGate, an open-source Android app that captures, records and relays NFC signals between two devices. Its job is to help researchers stress-test contactless protocols. The project page asks people, in so many words, not to use it for malicious purposes.
Not everyone listened. In August 2024 researchers at the security firm ESET described NGate, the first known malware built on NFCGate. Customers of three Czech banks got text messages about a tax refund; victims then installed a fake banking app, entered their PIN and held their card to the phone. In March 2024 police in Prague arrested a 22-year-old who had been withdrawing cash from ATMs. He was carrying 160,000 Czech koruna (about €6,000), which police said came from just the last three victims.
After that the scheme went into mass production. In the first half of 2025 ESET logged more than 35 times as many NFC attacks as in the second half of 2024. That spring researchers in Italy found SuperCard X, the same trick sold as a subscription through Telegram channels, complete with customer support. NFCGate’s authors, meanwhile, now note on their project page that antivirus software keeps mistaking their research tool for NGate.
A voice that sounds like your bank
The Rotterdam group added one new ingredient to the old technique: the voice. The scammers used AI to produce dozens of recordings in different voices, posing as various banks and companies. What AI bought them was scale: one small group could sound like many different organizations, each with its own voice, without hiring a single voice actor. An automated call with a menu sounds like an ordinary service message, and pressing 1 doesn’t feel risky. Then a live person took over, working from a script built to create urgency.
“It’s no longer a con man at the door, but a convincing caller who comes across as extremely professional,” said Ruben van Well of the Rotterdam cybercrime team. He added that investigators had never seen this technical method before.
What makes the scheme dangerous is that it feels like protection. Your card never leaves your hands, so you think you’re keeping your account safe, notes HCC, a Dutch computer users’ club. Pressing 1, installing the app, holding up the card: every step looks like a safety measure, not a risk.
Banks spotted a spike in mid-September, and on October 6 police arrested two men: a 23-year-old suspected of masterminding the scheme and a 25-year-old suspected of coordinating it. Both are in custody; neither has been convicted.
Who pays you back
For victims, the real trouble starts after the call. The bank can say: you installed the app and you held up the card, so that’s gross negligence. Dutch banks say it more and more often. Banks reimbursed 92% of losses from fake bank helpdesk fraud in 2021 and just 48% in 2024, according to the Dutch Banking Association (NVB). In 2025 almost 5,900 victims lost nearly €26 million between them.
On October 15, 2026, the Court of Justice of the European Union stepped into that math. The trick in its case was different, but the fight was the same: the bank refused, blaming the customer’s carelessness. Case C-70/25 began in Poland. A woman was selling something on an online marketplace; a “buyer” sent her a link, supposedly to confirm the sale, and she typed her online banking login into a fake page. About €700 left her account. She reported it the next day, but the bank wouldn’t pay her back: in its view, she had only herself to blame.
The court ruled that this isn’t allowed, and flipped the order of events.
// What the EU court's ruling changes
How banks answered
- You were grossly negligent, so no refund.
- If you disagree, take us to court yourself.
How it works now
- If the customer didn’t authorize the transaction and reported it promptly, the bank refunds it by the end of the next business day.
- Later the bank can claim the money back, but it has to prove intent or gross negligence itself.
- An immediate refusal is allowed only if the bank suspects the customer of fraud and reports it to the authorities.
The court’s reasoning was plain: if banks could refuse from the start, the duty to refund immediately would be meaningless. Customers would have to go to court themselves, with all the cost and hassle. The ruling binds courts across the EU, though the Polish dispute itself will be settled by a Polish court. It applies to transactions the customer didn’t authorize, such as a stranger withdrawing cash at an ATM. If a victim follows a scammer’s instructions and moves money to a “safe account” themselves, that usually counts as an authorized payment, and an immediate refund isn’t automatic.
If the money is already gone, the ruling suggests a simple sequence. Report the unauthorized transaction to your bank right away, because the court makes prompt notice a condition of the refund. In the EU the bank then has to pay you back by the end of the next business day and can argue about your carelessness later; the judgment in case C-70/25 is the one to cite.
The NVB’s position, Dutch media report, is that the ruling changes when a refund happens, not who ultimately bears the loss. That’s partly true. But timing matters. Waiting months and suing for your own money is one thing; getting it back the next day and watching whether the bank bothers to prove you were at fault is quite another.
What counts as careless
That’s where the next fight will be. Holding your card to your phone because “the bank” asked looks naive in hindsight, but a couple of years ago almost nobody had heard of this trick. In spring 2026 Kifid, the Dutch financial complaints body, urged banks to give customers the benefit of the doubt more often, because criminals are so skilled at working their victims.
For the ATM scheme, the first step is now clear and the second isn’t. No court has answered the real question yet: is it gross negligence to trust a voice generated to sound like your bank, making a request that Dutch police had never seen in this form before?
