Dutch banks (not named; the cases were reported to police through the Electronic Crimes Task Force) · AI used against the institution · severity 3 of 5
According to Dutch police, a criminal group used artificial intelligence to produce dozens of recorded phone messages in different voices, impersonating banks and companies, that warned of suspicious activity on the victim's account; those who pressed '1' were put through to a fake bank employee who talked them into installing an app and scanning their debit card, relaying the card's NFC chip data to an accomplice waiting at a cash machine. In the three weeks that Rotterdam's cybercrime team watched the group's servers, police said about 170 victims across the Netherlands lost some €380,000. Dutch banks had reported the new form of bank-helpdesk fraud through the Electronic Crimes Task Force in mid-September 2026; two men, aged 23 and 25, were arrested on 6 October 2026 and remain in custody. No bank is named in the reports.
Record last reviewed Oct 31, 2026 · Markdown
Date
Sep 2026 · disclosed Oct 20, 2026
Institution
Dutch banks (not named; the cases were reported to police through the Electronic Crimes Task Force)
Country
Netherlands
AI system
AI-generated voice recordings played in automated phone calls impersonating banks and companies, according to Dutch police
AI?
Described as AI by the institution or regulator
The institution, a regulator or a court called the system AI.
Category
Status
Reported
Severity
3 of 5
Impact
About €380,000 in three weeks of monitoring, per police · ≈ $425,600 · About 170 victims of all ages across the Netherlands, per police; individual withdrawals ran to thousands of euros.
What happened?
Rotterdam police said the investigation began in mid-September 2026, when Dutch banks told the Electronic Crimes Task Force, a partnership of banks, police and prosecutors, that they were seeing victims of a new form of bank-helpdesk fraud. Victims received a phone call that played a recorded message. According to the police statement, the fraudsters had used artificial intelligence to make dozens of different audio fragments with different voices, banks, companies and scenarios; the voice pointed to suspicious activity on the victim's account and asked them to press '1' if they were not responsible, after which hold music played and a supposed bank employee came on the line.[1][2]
The fake employee followed a script and pressured victims to act quickly to block their debit card, police said. Victims were told to download an app and hold their bank card against their phone. The app forwarded the data from the card's NFC chip, the technology behind contactless payments, to an app on a second phone held by a cash-out accomplice already waiting at an ATM or payment terminal, who withdrew thousands of euros without the victim noticing. Police said they had not encountered the technical method before.[1][2][3]
Within days of the task-force meeting the cybercrime team had sight of the group's digital infrastructure and mapped its structure: a technician and a coordinator ran the technology and the fake calls and directed the cash-out 'pinners'. In the roughly three weeks the servers were monitored, police counted about 170 victims of all ages from across the Netherlands, dozens of them in their twenties and thirties, with losses of about €380,000 (about $425,600, SecurityWeek reported).[1][2][3]
On 6 October 2026 police arrested a 23-year-old man from Vaassen, suspected of building the technology and directing the others, and a 25-year-old man from Ede, suspected of coordinating the group. The servers were taken offline and seized along with phones and laptops. NL Times reported that a Rotterdam court's pretrial detention chamber ruled on 20 October that both men must stay in custody for at least another 90 days. Police published the case on 20 October 2026.[1][2][3]
When did it happen?
- Sep 2026
Dutch banks report a new form of bank-helpdesk fraud to police through the Electronic Crimes Task Force; Rotterdam's cybercrime team opens an investigation.[1][2]
- Oct 6, 2026
Two suspects, 23 and 25, are arrested; the group's servers are taken offline and seized.[1][3]
- Oct 20, 2026
A Rotterdam court's pretrial detention chamber keeps both suspects in custody for at least another 90 days, NL Times reports.[2]
- Oct 20, 2026
Police publish the case: about 170 victims and some €380,000 in losses in three weeks of monitoring.[1][2]
What was the impact?
- Financial: About €380,000 in three weeks of monitoring, per police · ≈ $425,600[1][2][3]
- Customers: About 170 victims of all ages across the Netherlands, per police; individual withdrawals ran to thousands of euros.[1][2][3]
Severity 3 of 5: Material harm with a criminal case: about €380,000 taken from some 170 customers across several banks in three weeks, per police, with two arrests; losses per victim were in the thousands of euros and no systemic effect was reported.
How did Dutch banks (not named; the cases were reported to police through the Electronic Crimes Task Force) respond?
No public statement found as of 2026-10-31 from any individual bank. Police said the banks reported the fraud through the Electronic Crimes Task Force and praised the cooperation with the banks in stopping the group.[1]
What was the outcome, and did regulators act?
Criminal case pending: two suspects in custody for at least a further 90 days from 20 October 2026, the group's servers offline and seized, and the data under examination, according to police. No reimbursement figures and no regulatory action involving a bank have been reported.[1][2]
How was AI used in the Dutch bank-helpdesk fraud?
According to Rotterdam police, the group used artificial intelligence to generate dozens of recorded voice messages in different voices and for different banks, companies and scenarios. The recordings warned of suspicious account activity and routed anyone who pressed '1' to a human posing as a bank employee.
Which banks were affected by the Dutch AI robocall and NFC relay fraud?
No bank is named. Police said Dutch banks reported the new fraud form through the Electronic Crimes Task Force in mid-September 2026, and the recordings impersonated several banks; the roughly 170 victims came from across the Netherlands.
How much was lost in the Dutch NFC relay fraud?
Police said about €380,000 was taken from some 170 victims during the roughly three weeks they monitored the group's servers; SecurityWeek put the figure at about $425,600. Totals before or after that window have not been published.
When AI goes wrong at a bank, the next morning's brief says so.
when one of these regulators moves, the next morning's brief says so · six sourced stories · 7 am PT · free
plus every regulation, bank and agent page update, the morning after · leave any morning