Two men have been arrested in Rotterdam over a banking scam that combined AI-generated phone calls, a counterfeit banking application and near-field communication (NFC) technology to defraud some 170 victims of about €380,000, Dutch police say in an account relayed by Security Affairs.
The case is notable less for any single component than for the sequence in which they were chained together — a progression that neutralises most of the safeguards everyday bank customers are told to rely on.
The attack chain, step by step
1. The lure: an AI-cloned voice. Victims received a phone call that appeared to come from their bank. The voice on the line — reproduced with synthetic audio — warned of suspicious activity on the account and urged immediate action. Caller ID and vocal familiarity, the two signals most people instinctively trust, were both attacker-controlled.
2. The payload: a rogue banking app. To "secure" the account, the caller instructed the victim to install an application. How that app reached victims — official store or outside link — was not specified in the reported police account.
3. The exfiltration: an NFC read. The critical step. Victims were told to hold their payment card against their phone. The app read the card's contactless data locally through the handset's NFC reader — a direct skim rather than a relayed transaction — converting a gesture consumers perform dozens of times a week at shop terminals into a data-harvesting operation. What happened to the captured data downstream was not detailed in the released material. On the reported figures, total losses of €380,000 across 170 victims amount to roughly €2,200 per victim.
4. The cash-out. Once card data was in hand, the offenders moved quickly, with losses accumulating across the victim pool before the investigation closed in on them.
Why defenders should care
The scheme's key feature for security operations teams is what it does not trigger: no bank-side malware to signature-scan for, and no stolen login credential surfacing in a credential-stuffing attempt. The theft occurs at card-read time, before any transaction hits the fraud-detection engine — so by the time an alert fires, the data has already left the victim's possession.
The voice-cloning layer functions as a multiplier rather than a new fraud class: it makes a pretext that once required a confident human operator cheap to run at scale. Organisations serving card-holders anywhere face structurally identical exposure.
A practical checklist
Two defensive rules follow directly from the mechanics described in the reporting:
- Hang up, then call back. Dial the number printed on the back of your card or on official bank correspondence — never a number supplied by the caller.
- Never install an application at an inbound caller's request. No legitimate bank will ask a customer to sideload software or tap a card against a phone to "verify" an account.
Standard consumer and institutional hygiene applies beyond those two: treat caller ID and voice as unverifiable signals; enable out-of-band transaction confirmation; set low contactless spend limits; and push customers toward callback verification for any account-change request.
The investigation remains ongoing, and Dutch authorities have not indicated whether further suspects or a wider network are involved.
據Security Affairs轉述的荷蘭警方說法，鹿特丹拘捕兩名男子，涉及一宗結合AI生成電話、假冒銀行應用程式及近距離無線通訊（NFC）技術的銀行詐騙案，約170名受害人合共損失約38萬歐元。
此案的關鍵並不在於任何單一環節，而在於各環節的串連順序——這一連串步驟足以令一般銀行客戶被教導依賴的大部分保安措施形同虛設。
攻擊鏈逐步拆解
第一步：誘餌——AI克隆語音。 受害人接獲看似來自其銀行的來電。電話中的聲音以合成音頻重製，警告帳戶有可疑活動，催促即時處理。來電顯示及聲音熟悉度——兩項人們本能上最信任的訊號——均由攻擊者完全掌控。
第二步：載荷——惡意銀行應用程式。 為「保障」帳戶，來電者指示受害人安裝一款應用程式。該應用程式如何送達受害人——透過官方商店抑或外部連結——在已報道的警方案情中未有說明。
第三步：數據外洩——NFC讀取。 關鍵一步。受害人被要求將付款卡貼近手機。應用程式透過手機的NFC閱讀器，在本機讀取付款卡的非接觸式數據——直接盜取而非轉接交易——將消費者每週在商店終端機使用幾十次的動作，轉化為數據收割行動。已擷取數據其後的去向，在已公布的資料中未有詳述。根據報道的數據，170名受害人合共損失38萬歐元，平均每名受害人約損失2,200歐元。
第四步：套現。 一旦取得卡片數據，不法分子迅速行動，在調查人員收網之前，損失已於受害人之間不斷擴大。
防禦方為何要關注
對保安營運團隊而言，此騙局的關鍵特徵在於它不會觸發甚麼：銀行端沒有可供特徵碼掃描的惡意軟件，亦沒有被盜登入憑證在 credential stuffing（撞庫）中現形。竊取行為發生於讀取付款卡之時，遠在任何交易進入詐騙偵測引擎之前——因此當警報響起時，數據早已脫離受害人控制。
語音克隆這一層充當倍增器的角色，而非全新的詐騙類別：它令過去需要一名自信的人工操作員才能完成的藉口，變得可以廉價大規模執行。各地服務持卡人的機構，面對的風險在結構上完全一致。
實用清單
根據報道所述的攻擊機制，可直接引申出兩項防禦規則：
- 先掛線，再自行回電。 撥打印於付款卡背面或銀行官方通訊上的電話號碼——切勿使用來電者提供的號碼。
- 切勿應來電者要求安裝應用程式。 沒有合法銀行會要求客戶側載（sideload）軟件，或將付款卡貼近手機以「驗證」帳戶。
除上述兩項外，消費者及金融機構一般應採取的保安措施同樣適用：將來電顯示及語音視為無法核實的訊號；啟用out-of-band交易確認；設定低額非接觸式消費限額；並要求客戶在任何帳戶資料更改請求時進行回電核實。
調查仍在進行中，荷蘭當局未有透露是否有更多嫌疑人或更廣泛的犯罪網絡牽涉其中。