Never Tap Your Card to a Caller's Phone

The call that sounds like your bank

It starts with a recorded warning: suspicious activity on your account. Press 1 if you do not recognise it, and a person who sounds exactly like a bank employee takes over and tells you to act quickly. So far, a familiar scam script. What Dutch police uncovered in October 2026 is the twist that came next: victims were told to download an app and hold their bank card against their phone.

Rotterdam police say that action let criminals copy data from the card's contactless chip and relay it to an accomplice at a cash machine, who could withdraw thousands of euros. In just three weeks, around 170 victims lost about €380,000. Two men, aged 23 and 25, were arrested on 6 October, and a Rotterdam court ordered them to remain in custody for at least another 90 days. Police described the method as one they had not encountered before.

Here is how it worked, why it fooled people of all ages, and the one request that should end the call immediately.

How the NFC scam worked, step by step

1. The AI-voiced opening. A prerecorded call warned of suspicious activity. Police say AI produced dozens of recordings with different voices, banks and scenarios, so one operation could sound like many institutions.
2. Press 1, meet the “employee”. Pressing 1 connected victims to a live caller posing as a bank employee, following a prepared script and pressing them to act fast.
3. The fake app. The caller told the victim to download an app, presented as a way to secure the account.
4. Tap the card to the phone. The victim held their card against the phone, and the app read data from its NFC chip — the technology behind ordinary contactless payments.
5. The relay. That data went to a second app run by an accomplice at an ATM, who could withdraw money without the victim realising.

Your bank will never ask you to tap your card to your phone during a call. If that request comes up, the call is not legitimate — no matter how convincing the voice sounds.

Why it worked on people of all ages

Police reporting says otherwise: victims came from across the Netherlands and included dozens of people in their twenties and thirties. Three things made this scam unusually persuasive.

First, AI recordings removed the old tell-tale signs: no robotic reading or script stumble, just a smooth, authoritative warning that could be produced at scale, in many voices, for many supposed banks. Second, urgency did the rest — “suspicious activity” plus “act now” is designed to stop you thinking and start you obeying, so an unusual instruction feels like part of the rescue, not the crime. Third, the tap itself felt harmless. Most of us tap cards daily, and holding a card to a phone does not feel like handing over money. That is why the method was so dangerous: the harm happened invisibly, at a machine somewhere else.

What police actually found

The case began in mid-September 2026, when Dutch banks reported the method through the Electronic Crimes Task Force, a partnership of banks, police and prosecutors. Within days, Rotterdam's cybercrime team had identified the operation's digital infrastructure and traced its technology, calls and withdrawals.

Police say the 23-year-old from Vaassen is suspected of developing the technology and directing other participants, while the 25-year-old from Ede is suspected of coordinating the operation. Servers were taken offline and phones and laptops seized; the allegations have not yet been tested at trial. A separate Utrecht case using the same tap-your-card instruction reportedly targeted around 27 mostly elderly victims and cost at least €250,000 — a reminder that a proven method tends to spread.

The same playbook, different endings

Fraudsters adapt the ending to whatever victims will accept. In Maryland, police warned in October 2026 about bank impostors who used spoofed caller ID, pressured residents to withdraw cash to “protect” it, then arranged a rideshare pickup to collect it. No app, no NFC — same core trick.

The same week, Bank of America warned customers never to share their banking username and password with another person or outside service, including an AI tool acting on their behalf. Different risk, same lesson: in 2026, the most dangerous thing a stranger asks for is rarely cash upfront. It is access — a login, a code, a card tap, an app install.

Real bank vs scammer: a quick check

What happens	A real bank	A scammer
First contact about fraud	May call or message, but will accept you hanging up and calling back on the number on your card	Pressures you to stay on the line and act now
Asks you to install an app	Directs you to its official app store listing, never a link or file sent during a call	Sends you to an unknown app during the call
Asks for your card, PIN or codes	Never asks for your full PIN, password or one-time code	Asks you to tap, scan, read out or enter card and code details
Asks you to move or withdraw money	Never asks you to move money to a “safe account” or hand cash to a courier	Frames withdrawal or transfer as protection

If you already tapped, installed or shared something

Do not feel embarrassed into silence — speed matters more than pride here. Act in this order:

1. Call your bank immediately on the number on your card or in its official app, tell them exactly what you did, and ask them to block the card.
2. Uninstall the app and change any passwords you entered, from a device you trust if possible.
3. Check your statements for the next few weeks, including small test transactions, and turn on transaction alerts.
4. Report it to your bank and to the police or your country's national fraud reporting service, keeping the caller's number, the app name and the call times. In the UK, that means Action Fraud; in the US, the FTC's ReportFraud service.

If money has already gone, ask your bank about its fraud process straight away. Recovery is never guaranteed, but prompt reporting gives you the best chance.

Frequently asked questions

Does this mean contactless payments are unsafe?

No. Ordinary tap-to-pay at a till you chose is a different situation from letting an unknown app read your card on a stranger's instructions. The risk in this scam was the social engineering and the rogue app, not contactless technology itself.

What if the caller ID really shows my bank's number?

Hang up anyway and call back on the number printed on your card or listed in your bank's official app. Caller ID can be faked, and a genuine bank will always accept you verifying the call this way.

Can a bank employee ever ask me to download an app during a call?

A real bank will not ask you to install an unfamiliar app mid-call to “secure” your account, and will never ask you to tap your card to your phone. If in doubt, end the call and start again through official channels.

Was anyone actually caught?

Yes — two suspects were arrested and remain in custody, and servers were taken offline. But arrests in one country do not end a method, as the Utrecht and Maryland variants show.

The one-sentence rule to remember

The next time a caller — however polished or urgent — asks you to download something, read out a code or tap your card to your phone, you already know the answer. Hang up, then call your bank yourself on a number you found yourself. In the Dutch case, that single habit would have broken every step of the scam before a single euro moved. Make it your household rule, and tell the people most likely to get the call.