Rotterdam police arrested two suspects accused of a new form of bank-helpdesk fraud. The operation allegedly caused around €380,000 in losses for 170 victims in just three weeks. The suspects allegedly used AI-generated phone calls and a fake banking app to copy victims’ bank cards remotely, allowing accomplices to withdraw thousands of euros. Victims came from across the Netherlands and ranged in age; dozens were in their twenties and thirties.
The suspects are a 23-year-old man from Vaassen, in Gelderland, suspected of developing the technology used in the fraud and directing other members of the group, and a 25-year-old man from Ede, also in Gelderland, suspected of coordinating the criminal operation.
A Rotterdam court’s pretrial detention chamber ruled on Tuesday that both men must remain in custody for at least another 90 days while the investigation continues.
Victims received a phone call with a prerecorded message warning of suspicious activity on their bank accounts. The callers used artificial intelligence (AI) to produce dozens of recordings featuring different voices, banks, companies, and scenarios. Victims were asked to press 1 if they did not recognize the alleged activity. They were then connected to someone posing as a bank employee.
The supposed bank employee followed a prepared script, pressuring victims to act quickly to block their bank cards. Victims were instructed to download an app and hold their bank cards against their phones to scan them. The criminals presented this as a way to secure the accounts.
According to police, the app transmitted data from the card’s near-field communication (NFC) chip to an app used by an accomplice. NFC is the technology that enables contactless payments. A person operating the second app was ready at a cash machine or payment terminal. The accomplice could then withdraw thousands of euros without the victim realizing what was happening. Police described this technical method as one they had not encountered before.
The investigation began in mid-September, when Dutch banks reported cases of the new fraud method through the Electronic Crimes Task Force (ECTF), a partnership involving banks, police and prosecutors that shares information and expertise to tackle financial and digital crime.
Within days of consultations with the task force, Rotterdam’s cybercrime team had identified the group’s digital infrastructure. Investigators monitored the servers and mapped the operation’s structure, including the people responsible for the technology, the phone calls and the cash withdrawals.
