NFC fraud with fake banking app: thieves withdraw from ATM without your card
Czech fraudsters are exploiting NFC technology and fake applications to drain money from accounts. Police warn of calls from fake bankers.
Fake banking application transmits card data directly to ATM
The Czech Republic Police is warning of a new type of fraud in which perpetrators exploit NFC technology and malicious mobile applications to make unauthorised cash withdrawals — without ever physically holding the victim's payment card.
The fraud typically begins with a phone call. The caller identifies themselves as an employee of a bank or other trusted institution and informs the victim of alleged account compromise or a suspicious transaction. In order to create a sense of urgency, they insist on immediate action to resolve the situation.
They then convince the person called to install a special application on their mobile phone that is supposed to protect their money. In reality, it is a malicious programme. The cardholder is subsequently asked to hold their payment card against the back of their phone and in some cases to also provide their PIN.
NFC technology enables wireless communication over very short distances. Once the victim holds their card against the phone with the installed malicious application, it intercepts the card's communication and transmits it via the internet to the perpetrator's device. At that moment, they can be standing at an ATM in a completely different location and use the transmitted communication so that the ATM processes the transaction as legitimate card use. If the perpetrator also knows the PIN, they can make an unauthorised cash withdrawal.
According to policie.gov.cz, a real bank employee or police officer would never request installation of an unknown application or the holding of a payment card against a phone for the purpose of securing it.
Recommendations for protection against this type of fraud:
- Never install applications on the instruction of an unknown caller.
- Do not disclose your PIN or login details for internet banking.
- If you receive a suspicious call, end it and contact your bank yourself using the official telephone number.
If a suspicious application has already been installed or a card has already been held against a phone, it is necessary to contact your bank immediately, request that your card be blocked, and report any possible account misuse. Suspicion of fraud should also be reported to the Czech Republic Police.
In these cases, perpetrators do not physically steal the card — it is sufficient that they persuade the owner to grant them access to it through their own phone.
Source: Google News CZ — Crime (cs)