A Dutch police investigation has revealed how AI-generated phone messages, a convincing fake bank helpdesk and a malicious app allegedly helped a criminal network target around 170 people.
Imagine receiving a call warning that someone may be using your bank account. A recorded message tells you to press a number if you do not recognise the activity. You follow the instruction, hear hold music and are connected to someone claiming to work for your bank.
The person sounds professional. They explain that your bank card may be at risk and tell you how to protect it.
Then comes the request: download an app and hold your bank card against your phone.
If you believe you are speaking to your bank, the instruction might sound like part of a security check. But Dutch police say that, in a recently investigated fraud scheme, this step allegedly helped criminals relay data from victims’ contactless bank cards to accomplices waiting at cash machines or payment terminals.
During three weeks of monitoring the group’s servers, investigators identified around 170 victims and estimated losses of approximately €380,000.
Rotterdam police announced the investigation on October 21, 2026. Two men had been arrested on October 6 and were suspected of playing technical and coordinating roles. They have not been convicted in the case.
The investigation highlights a disturbing combination: AI-generated recordings, pressure over the phone and an app that turned a familiar device, the smartphone, into part of the alleged fraud.
How banks helped uncover the scheme
The investigation began in mid-September 2026, when Dutch banks reported cases of a new form of bank-helpdesk fraud through the Electronic Crimes Task Force (ECTF). The partnership brings banks, police and prosecutors together to share information and tackle financial and digital crime.
According to the Dutch National Police, investigators identified the group’s digital infrastructure within days of consulting with the task force. They then monitored the associated servers to understand how the operation worked and identify the people involved.
The investigation revealed a coordinated process rather than a series of unrelated phone calls. Police described a suspected technical operator and a coordinator who helped organise the operation, alongside accomplices positioned to withdraw money.
That structure matters. The person speaking to a victim may be only one part of a wider operation. Other participants may be responsible for the technology, arranging calls or collecting money.
During the three weeks in which investigators had visibility into the servers, police identified approximately 170 victims and estimated financial damage of €380,000. The victims came from across the Netherlands and included dozens of people in their twenties and thirties.
These are figures reported by investigators, not a final court-established total. They describe the victims and losses identified during the investigation period.
How the fake bank calls allegedly worked
According to police, the operation used dozens of audio recordings created with artificial intelligence. The recordings featured different voices, banks, companies and scenarios.
A call began with a warning about suspicious activity on the recipient’s bank account. The recording instructed the person to press a number if they did not recognise the activity. After doing so, the victim heard hold music and was connected to someone posing as a bank employee.
The supposed employee then followed a prepared script. Victims were told that they needed to act quickly to block their bank cards and were instructed to download an app and scan their cards by holding them against their phones.
The request was presented as a way to protect the victim’s money. In reality, police say, the process helped the alleged criminals carry out unauthorised withdrawals.
The sequence was central to the deception. The recording created concern, the fake helpdesk offered an apparent solution, and the demand to act quickly left less time for the victim to question the instructions.
What AI did, and what the evidence does not show
AI-generated audio was a confirmed part of the operation described by Dutch police. It allowed the suspected criminals to prepare multiple recordings using different voices and scenarios.
That is a meaningful finding, but it is important to describe it accurately. The police account does not establish that the suspects cloned a particular bank employee’s voice or used a live AI system to speak with victims in real time. It describes AI-generated audio recordings.
The difference matters because a report should explain what investigators found, not extend the finding into a more dramatic claim.
The warning for consumers remains clear: a convincing voice, a familiar company name or a polished phone menu cannot prove that a caller represents a bank. The safest response is to verify the situation independently rather than relying on how genuine the call sounds.
The fake app made the bank card part of the alleged fraud
The most unusual element of the investigation was what victims were persuaded to do after the call.
Police say victims were instructed to download an app and hold their bank cards against their phones. The app could then relay data from the card’s near-field communication (NFC) chip to another app used by an accomplice.
NFC is the short-range wireless technology used in contactless payments. A compatible phone can communicate with a card’s chip when the two are held close together.
According to investigators, an accomplice using the second app was waiting at a cash machine or payment terminal. The relayed card data helped the operation carry out withdrawals while victims were unaware of what was happening.
This is not the same as proving that the criminals permanently copied every part of a bank card. The police account describes the temporary relay of NFC-chip data, but does not explain every technical step involved in authorising each withdrawal. It would be misleading to fill those gaps with assumptions.
What investigators do report is the broader sequence: victims were deceived into installing an app and scanning their cards; data from the NFC chip was relayed to an accomplice; and the operation was associated with unauthorised cash withdrawals.
Police described the technical method as one they had not previously encountered in their investigations. That does not prove it was the first use of the technique anywhere in the world.
For consumers, the important point is simpler than the technology: an unexpected caller asking you to install an app or scan your bank card as a security measure is a serious warning sign.
Why the deception could work
This case illustrates how a scam can combine technical tools with familiar human reactions.
First, the caller appeared to represent an institution people trust with their money. Second, the warning created pressure by suggesting that an account or card was in danger. Third, the caller presented an unfamiliar action as the solution to the problem.
How a routine call becomes a risky decision
Four stages explain how trust can be turned into an opportunity for fraud.
Borrowed trust
The caller appears to represent your bank.
Urgency
A warning makes immediate action feel necessary.
False solution
An unfamiliar action is presented as protection.
Risk of loss
Following the instructions can expose your money or card.
That combination can make a risky request feel like a routine security procedure.
The Dutch National Police highlighted both trust and pressure in its account of the case. Personal details can also make a caller seem credible, but knowing someone’s name, bank or other information does not prove that the caller is genuine.
Ruben van Well of Rotterdam’s cybercrime team described the change in how this type of fraud can appear to victims. In a statement published by Dutch police, he said: “No longer a fraudster at the door, but a convincing caller who comes across as extremely professional.” This is an English translation of his Dutch statement.
The lesson is not that every professional-sounding caller is suspicious. It is that professionalism, caller ID and a convincing explanation are not substitutes for independent verification.
If an unsolicited caller asks you to install software, disclose a PIN, share a security code or carry out an unfamiliar card operation, stop. End the call and contact your bank using details you obtain independently.
Two arrests, with the investigation continuing
On October 6, 2026, police arrested two men in connection with the investigation: a 23-year-old from Vaassen and a 25-year-old from Ede.
Two suspected roles. One wider operation.
Police say the investigation targeted people suspected of helping organise and operate the alleged fraud.
Alleged technical role
23-year-old man
From Vaassen. Suspected of handling the technical side and directing other participants.
Alleged coordination role
25-year-old man
From Ede. Suspected of coordinating activities within the alleged criminal operation.
Investigation timeline
Police arrest both men in connection with the investigation.
Servers are taken offline; investigators examine server data, phones and laptops.
The court’s detention chamber orders at least another 90 days in custody.
Source: Dutch National Police — investigation update, 21 October 2026.
Investigators suspect the younger man of handling the technical side of the operation and directing other participants. The older man is suspected of having a coordinating role.
Police took the group’s servers offline and seized the suspects’ phones and laptops for examination. On October 20, a pretrial detention chamber at the Rotterdam court decided that both men would remain in custody for at least another 90 days while the case continued.
These are procedural developments, not a finding of guilt. The men remain suspects, and the roles attributed to them are allegations that have not been established by a conviction.
The investigation also focused on the people believed to be organising the wider operation, rather than only on accomplices making withdrawals. Police said people carrying out cash withdrawals can be replaced relatively easily, while identifying those responsible for crucial parts of a criminal network can disrupt the operation more effectively.
The Dutch Banking Association also highlighted the value of cooperation. Marco Doeland, its security team lead, said in the police report that the case showed how important it was for banks, police and prosecutors to bring their information, expertise and powers together quickly. He said this cooperation helped identify the new fraud method early and allowed investigators to act against the people behind it.
The point is practical: when banks share reports of a new pattern quickly with investigators, authorities may be able to connect cases and examine the infrastructure linking them.
How to protect yourself from a fake bank helpdesk
You do not need to understand NFC technology to recognise the most important warning signs.
Pause before you act. Know what to do.
STOP THE SCAM
Six rules to remember
ACT QUICKLY
If you’ve followed their instructions
Report the incident and ask about blocking cards, accounts or pending payments.
Tell the bank which app you installed and what access you granted. Follow its security advice.
Keep messages, call details, screenshots and transaction records.
Contact your local police or official fraud-reporting service.
1. Never install an app because an unexpected caller tells you to.
A caller may claim that an app will block a card, check for fraud or secure an account. End the call and contact your bank through its official app, website or a number you find independently.
2. Never scan your bank card at a caller’s request.
In this investigation, police say scanning the card was a central part of the alleged fraud. Do not treat an unexpected request to hold your card against your phone as a legitimate security check.
3. Never reveal your PIN, password or security codes.
Dutch banking guidance says banks do not ask customers to disclose their PINs, passwords or other security codes. Do not give these details to a caller or enter them into an app at their direction.
4. Do not rely on caller ID.
A displayed number is not conclusive proof of identity. If someone claims to be from your bank, hang up and initiate contact yourself using trusted contact details.
5. Take urgency as a reason to pause.
Scammers want people to react before they have time to check the facts. You can end a call and verify a claim even if the caller insists that the situation is urgent.
6. Ask someone you trust if you feel pressured or confused.
A second person can help you think through an unexpected request. There is no need to feel embarrassed about checking whether a call is genuine.
These precautions are consistent with the consumer guidance published by Veilig Bankieren, the Dutch banking industry’s fraud-awareness resource.
What to do if you have already followed the instructions
If you downloaded the app, scanned your card or believe money has been taken, act promptly.
Contact your bank using its official contact details. Explain exactly what happened and ask it to block the card or account if necessary, investigate unfamiliar transactions and stop any payments that can still be stopped.
Tell the bank which app you installed and whether you granted it permissions. Follow its advice on securing your device and accounts. Deleting the app may be appropriate, but do not assume that removing it alone resolves every possible risk.
Check your transactions and preserve relevant evidence, including call details, messages, the app’s name, screenshots and transaction records. Report the incident to your local police or fraud-reporting service.
If you are in the Netherlands, the Dutch National Police provides guidance for victims of telephone bank-helpdesk fraud. If you live elsewhere, contact your own bank and local law-enforcement service; reporting procedures and consumer protections vary by country.
Do not wait until you understand the technical method. The immediate priorities are to limit further losses and give the bank and investigators useful information.
The bigger lesson: AI did not replace the human deception
It would be easy to describe this case only as an AI-powered bank scam. AI-generated recordings were part of the reported operation, but the technology alone does not explain why the scheme worked.
The alleged criminals combined prepared audio with a trusted institution’s identity, a warning designed to create urgency and an app that victims were persuaded to use themselves. The phone call shaped the victim’s decision; the app helped turn that decision into an opportunity for the alleged fraud.
That distinction matters because people cannot reliably determine whether every recording is AI-generated simply by listening to it. A stronger defence is to follow safe procedures regardless of how convincing a caller sounds.
If someone unexpectedly calls claiming to protect your money but asks you to install an unfamiliar app, scan your card or reveal a PIN, do not follow the instructions. Hang up and contact your bank independently.
The investigation also shows the value of coordinated reporting. Banks raised the alarm through the Electronic Crimes Task Force, investigators examined the group’s digital infrastructure, and police took the associated servers offline and arrested two suspects. The case is continuing, and the allegations against the men have yet to be decided by a court.
For anyone who uses a bank card and smartphone, the practical takeaway is clear: a caller who says your money is at risk should never be allowed to dictate how you secure it. Verify the claim independently before doing anything.
Sources and editorial note
Primary reporting, supporting coverage and consumer guidance used in this article.
Two suspects arrested in investigation into a new form of bank-helpdesk fraud
Dutch National Police. Includes statements from Rotterdam cybercrime team representative Ruben van Well and Dutch Banking Association security team lead Marco Doeland.
Police arrest two suspects in AI-powered bank fraud that cost victims €380,000
NL Times. Additional reporting on the arrests and estimated financial losses.
Rotterdam police arrest AI scammers over €400k thefts
DutchNews.nl. Further coverage of the investigation and reported losses.
Consumer guidance on bank-helpdesk fraud
Veilig Bankieren. Guidance from the Dutch banking industry’s fraud-awareness resource.
Community discussion
Join the conversation
0 comments
Be the first to join in
There are no comments yet. Sign in to start a thoughtful discussion.
Sign in to comment
Join the conversation with your Secritic account. Comments are available to signed-in readers.