Dutch police have arrested two suspects in a fraud case involving NFC relay attacks that allegedly led to more than $400,000 being stolen from bank accounts. According to the reported details, victims were called by the attackers, persuaded to install an app, and then instructed to scan their payment cards with their phones.

While the arrests concern consumer bank fraud, the technique is relevant for European businesses because it shows how attackers are combining social engineering with mobile payment technology to bypass traditional trust checks. Companies should view it as part of a broader pattern of digitally enabled fraud targeting people rather than only systems.

What happened

According to the report, the suspects allegedly contacted victims by phone and convinced them to take a series of actions on their mobile devices. Those actions included installing an app and scanning a bank card. The fraud reportedly relied on NFC, or near-field communication, which is the short-range wireless technology used in contactless cards and mobile payments.

An NFC relay attack generally involves transmitting card communication from one device to another so that a criminal can use card data or simulate the presence of a card elsewhere. In practice, this kind of scheme often depends on deception: the attacker needs the victim to trust the caller, install software, or perform steps that appear legitimate.

The arrests are a law-enforcement development, not a regulatory one. The available report points to an ongoing criminal investigation rather than any new legal obligation for businesses.

Why it matters for European businesses

For businesses, the significance is not limited to consumer banking. The case highlights how fraud techniques are evolving around three business-relevant risks: mobile device compromise, payment-related social engineering, and weak user awareness around app installation and card handling.

Many SMEs rely on staff using personal or company smartphones for banking, payment approvals, expense management, and authentication. If an employee in finance, procurement or administration is targeted with a convincing call, similar tactics could be used to support unauthorised transactions, account takeover attempts or compromise of payment workflows.

The incident also matters for organisations that interact with customers around payments. If fraudsters impersonate a bank, service provider or merchant, affected customers may associate the incident with the legitimate business involved, creating reputational and support costs even when the company itself was not breached.

More broadly, the case underlines that modern fraud is increasingly a blend of cyber and social engineering. Traditional perimeter security does not stop an employee or customer from voluntarily installing an app or tapping a payment card if they believe the request is genuine.

Who may be affected

• SMEs and founders whose teams use mobile devices for banking, card management or account verification.
• Finance and operations teams responsible for payments, supplier settlements and bank communication.
• E-commerce businesses that may face customer-service fallout when payment fraud tactics reference online purchases or account activity.
• IT and security teams managing mobile device policies, app installation controls and staff awareness training.
• Regulated businesses in finance, retail or other sectors where payment trust and identity verification are operationally important.

What companies should consider

• Review mobile security policies. Limit app installation on company-managed devices where possible, and make sure employees know that unsolicited callers should never guide them through installing software.
• Update fraud awareness training. Include voice-based social engineering, fake bank support calls, and requests involving payment cards, NFC or account verification steps.
• Strengthen payment verification processes. Require independent confirmation for unusual banking requests or urgent payment-related instructions, especially when they originate from phone calls.
• Check banking and finance workflows. Identify where smartphones are used for approvals, authentication or card management, and assess whether additional safeguards are needed.
• Prepare customer support responses. Businesses in retail, e-commerce or financial services should be ready to explain common fraud patterns to customers and direct them to official support channels.
• Coordinate IT and finance controls. Fraud prevention should not sit only with cybersecurity teams; finance, customer support and operations may all need clear escalation paths for suspected impersonation attempts.

For European businesses, the main lesson is practical: payment fraud is becoming more dependent on user manipulation through everyday mobile technology. Even when the immediate victims are individuals, the same methods can be adapted to target employees, business accounts and customer relationships.