170 victims, €380,000 in three weeks: how to spot Dutch bank helpdesk scams and what to do if you are hit (October 2026)

The English-language news site IamExpat has reported on a new twist on an old Dutch problem: bank helpdesk fraud. Victims received an automated call with an AI-generated voice, were put through to a fake bank employee, and were talked into installing an app and holding their bank card against their phone. The app relayed the card's contactless (NFC) data to an accomplice standing at a cash machine.

The Rotterdam police cybercrime team linked about 170 victims and €380,000 in losses to a single network in just three weeks. The victims lived all over the country and ranged from their twenties to their eighties. The idea that only older people fall for phone scams does not survive this case.

This article combines IamExpat's report with the police announcement on politie.nl, the latest figures from the Dutch Banking Association (NVB) and the national Fraudehelpdesk, recent rulings by the financial complaints body Kifid, and coverage from other English-language outlets for internationals. It sets out which impersonation scams are common in the Netherlands, how to spot them, what to do — in what order — if you are hit, and when the bank has to pay.

1. What happened: AI voices and a card-reading app

The four steps

According to the police, the scam ran in four stages.

It began with a call playing a recording made with AI: there was suspicious activity on your account, and you should press 1 if you did not recognise it. The network used dozens of recordings, with different voices, different banks and companies, and different scenarios.

After pressing 1 and some hold music, the victim reached a "bank employee" working from a fixed script. The caller built pressure — your card must be blocked right now — and then asked the victim to download an app and hold the card against the back of the phone to "block" it.

The app blocked nothing. It read the card's NFC chip and sent the data to a second app on an accomplice's phone. That accomplice, known in Dutch as a pinner (a money mule who withdraws cash), was already waiting at a cash machine or payment terminal and withdrew thousands of euros before the victim noticed.

The case in numbers

The key figures from the police announcement and the media coverage are below.

That works out at roughly €2,200 per victim on average (our own calculation). The police said it took less than four weeks from the first signal to the arrests, and credited close cooperation with the banks.

Where the reports differ

The coverage does not agree on every detail. The police statement and NL Times describe the 23-year-old as the technical mastermind and the 25-year-old as the coordinator of the cash mules. IamExpat's article reverses the two roles. This article follows the police.

2. How common is bank helpdesk fraud?

The banks' figures: higher losses, fewer victims

In Dutch this scam is called bankhelpdeskfraude — fraud in which criminals pose as your bank's helpdesk or fraud team. The Dutch Banking Association (Nederlandse Vereniging van Banken, NVB) publishes its members' figures every year.

According to the NVB's statement of 28 April 2026, bank helpdesk fraud cost customers €25.8 million in 2025, up by just over €3 million on the year before. The number of victims fell by 14% to just under 5,900. Fewer people are being caught, but each case costs more.

In the same statement the banks called on Meta, TikTok and Google to remove fake ads and websites faster. On their own side, they pointed to lower default daily transfer limits and a four-hour wait before a limit can be raised.

The Fraudehelpdesk's figures: losses doubled in early 2026

The second big data source is the Fraudehelpdesk, the national helpline for fraud. It counts reports from anyone, by phone or online, whether or not money was lost.

Its review of 2025 shows 101,734 reports (up 60%), 15,116 people who actually lost money (up 65%) and about €68.5 million in reported losses (up 30%). Helpdesk fraud was the most reported type among private individuals, with 17,264 reports; investment fraud caused the largest losses, at €34.1 million.

For the first half of 2026, reports of bank helpdesk fraud dropped from 4,570 to 2,944 — but the number of people who lost money rose from 92 to 230, and losses from about €1.5 million to €3.1 million.

The same release shows phishing reports rising fivefold, from 2,776 to 15,106. Fake Booking.com messages on WhatsApp quoting real reservation details were a big driver; the Fraudehelpdesk believes leaked data is making messages more convincing.

Why the numbers do not match

Put side by side, the two sets of figures look contradictory. They are not; they measure different things.

Many victims tell their bank but never call the helpline, so the banks' loss figure is higher. The helpline's report count is higher because it includes attempts that cost nothing.

There are smaller inconsistencies within the Fraudehelpdesk's own material, too. Its 2025 loss total appears as €68.49 million in the table and "nearly €69 million" in the text, and the first-half 2026 figure for energy scams is €496,096 in the text but €495,797 in the table. This article uses the table values.

3. A map of impersonation scams in the Netherlands

Six common patterns

The NFC relay is new, but the opening — a call from "your bank" — is not. Drawing on police warnings, public bodies and outlets for internationals, these are the patterns you are most likely to meet.

All of them combine two ingredients the police say are always present: trust (the caller claims to be someone you know or knows details about you) and pressure (you must act now).

Bank helpdesk fraud and spoofing

The classic version: someone from the bank's "fraud department" calls to say your account is under attack and your money must be moved to a "safe account". In 2023, NL Times reported a Limburg case in which about 150 people lost €1.6 million this way. In March 2026, DutchNews reported eight arrests in a €1.7 million case in which victims were persuaded to install "virus scanner" and remote-access software that let the fraudsters see their bank and crypto accounts.

What makes these calls convincing is spoofing: faking the number shown on your screen, whether it is your bank's real customer service line or an ordinary Dutch mobile number starting with 06. DutchReview has reported automated English-language calls claiming your citizen service number (BSN) is being misused, followed by a transfer to a "police officer". The number on your screen is not proof of who is calling.

"Hoi mam": the family-in-need scam

The message usually starts "Hoi mam" or "Hoi pap" — hi mum, hi dad. The sender says their phone broke and this is their new number, their banking app does not work yet, and could you please pay an urgent bill for them. There is always a reason they cannot talk on the phone.

In spring 2020, IamExpat reported that reports to the Fraudehelpdesk jumped from about 6,500 a month to around 15,000 in April, mostly WhatsApp fraud. The figures are old, but the scam is still in circulation and works in any language. ACCESS advises calling the person on their usual number and recognising their voice before paying anything.

Fake payment links on Marktplaats

If you sell something on Marktplaats, the Dutch second-hand marketplace, a "buyer" may ask you to click a link to receive their payment or to verify yourself with a one-cent transfer. The link imitates Tikkie (a popular Dutch payment-request app) or your bank, and the login details you enter are used to empty your account.

ACCESS notes that these scammers almost always move the conversation to WhatsApp first. According to NL Times, this kind of fraud fell by 76.5% between January 2021 and December 2022, partly because Marktplaats started checking the links sent through its chat.

Fake DigiD and tax messages

Messages pretending to come from the Belastingdienst (the Dutch Tax and Customs Administration) or asking you to log in with DigiD (the government login) are another staple. The Belastingdienst states plainly that it never sends payment requests by email, SMS, WhatsApp or phone, and publishes examples of fake messages.

Its change of bank account numbers on 1 May 2026 gave scammers a fresh storyline. DutchReview has warned about fake "new account" messages. Always check account numbers against the list on the Belastingdienst website.

Card collection and "hybrid" scams

In its review of 2025 the Fraudehelpdesk highlighted scams that start online or by phone and continue in person: fake bank staff who come to collect your card, fake police officers who come to "safeguard" valuables. Xpat.nl also warns never to give your PIN to anyone, even someone claiming to be from the police or the bank.

4. How to spot a scam: learn what real banks never do

What a real bank does — and does not do

Scam scripts change every month. It is more reliable to remember what a real bank will never do. The table brings together advice from the police, the NVB and the banks.

If anything in the right-hand column happens, you can hang up, however plausible the story sounds. A genuine bank employee will not mind you calling back.

Hang up and call back

The single most effective habit is to hang up and call a number you looked up yourself — on the back of your card, on the bank's official website or inside its official app. Do not use the "call back" function, and do not use a number from an SMS.

Some banks now offer a way to check a caller. With ING's "Check het Gesprek", you enter your phone number during a call and ING's systems confirm whether one of its employees is actually calling you. The NVB recommends using such "check your call" features where your bank has one. Not every bank does, so calling back remains the default.

The Fraudehelpdesk's three steps

In its 2026 half-year release, the Fraudehelpdesk boiled its advice down to three steps.

Every successful scam relies on taking away your thinking time. All three steps are about getting it back.

Emails and texts

Sender names and logos are trivial to copy. Focus on two things: does the message want you to click a link, and does it threaten you with a deadline?

The Expatica banking guide notes that fraudsters increasingly use WhatsApp, email and SMS to pose as bank staff and obtain security codes. A padlock in the address bar only means the connection is encrypted; fake sites have one too.

You can forward a suspicious email to the Fraudehelpdesk at valse-email@fraudehelpdesk.nl to have it checked. In 2025 it received more than 522,000 fake emails this way.

5. What to do if you have been scammed

The first hour

Act as soon as you realise what has happened. This sequence follows the police guidance and the advice reported by IamExpat.

1. Call your bank's fraud or emergency line. Find the number on your card or the official website. Ask them to block your card and account, stop pending payments and check what has actually left your account. For ING, the "Alarmlijn" is 020 22 888 00
2. Change your passwords for online banking, email and your computer, ideally from a different device. Do not do this while the scammer may still be watching your screen
3. Deal with remote-access software carefully. If you were made to install AnyDesk or TeamViewer, the police advise removing it only after your login details are secure. Do not wipe or reinstall your computer until you have reported and the digital traces have been secured
4. Save the evidence: call logs, texts, WhatsApp chats, transaction details. The police note that the scammer's account number usually appears in the transaction description on your statement, often with the real account holder's name
5. Report it to the police (aangifte)
6. Contact the Fraudehelpdesk for advice

Reporting to the police (aangifte)

An aangifte is an official police report — the formal complaint that starts an investigation and that banks ask for. The police list of report forms includes a dedicated form for "Bankhelpdeskfraude (telefonische oplichting)".

If the scammer came to your home, you cannot report online; call to make an appointment instead. If you are new and do not have DigiD yet, simply call 0900-8844.

Most victims never report

According to a Fraudehelpdesk release from February 2026, more than 67% of people targeted by fraud in their private lives did not file a police report. Typical reasons were "I thought it was pointless" and "I didn't know how".

A 2025 pilot that handed callers straight to a police officer was rolled out nationwide in early 2026; 40% of those helped said they would not have reported otherwise.

The Fraudehelpdesk

The Fraudehelpdesk can be reached on 088-786 73 72 and through its website. It does not replace a police report, but it helps you work out what happened, what to say to whom, and when to involve the police or the Juridisch Loket (the free legal advice service).

6. Will the bank pay? Authorised versus unauthorised

The key question: who moved the money?

Dutch law draws a sharp line between payments you authorised and payments you did not. Under the Dutch Civil Code (Burgerlijk Wetboek, Book 7, articles 528 and 529), the bank must in principle refund an unauthorised payment immediately. The exceptions are fraud by the customer, or intentional or grossly negligent breach of the customer's security obligations.

April 2026: Kifid raises the bar for "gross negligence"

Kifid (Klachteninstituut Financiële Dienstverlening) is the out-of-court complaints body for banks, insurers and other financial firms. In April 2026 its Appeals Committee ruled on a case brought against bunq, decision CvB 2026-0022.

According to Kifid and banken.nl, the customer had clicked a phishing link that appeared to come from her bank. That evening a "bank employee" persuaded her to share her six-digit security code. The fraudster linked his own device to her account and moved more than €50,000 to a crypto platform and a Spanish account in about an hour.

The committee held that gross negligence requires that the customer was actually aware of the risk of helpdesk fraud and followed the instructions anyway. Because victims usually believe they are speaking to their real bank, that will rarely be the case. The bank's regular fraud warnings did not, on their own, change that.

This is a clear shift from the committee's stricter position in February 2025 (CvB 2025-0012). bunq had to pay €35,367. The full loss was €50,849, but the customer had not appealed the reduction ordered at the earlier stage, so the committee could not award the rest.

June 2026: a different outcome when you transfer the money yourself

A ruling reported by NL Times in June went the other way. Two victims were told by a fake bank employee to install screen-sharing software (Quickview), raised their daily limit and made three transfers themselves, losing €59,000 in total.

SNS blocked the first payment and called to check, but the victims — following the fraudster's script — said it was for a camper van, and the payment went through. The committee found that the payments were made with the customers' consent and that the bank had no evidence it knew about the fraud, so it had not breached its duty of care.

Goodwill payments (coulance)

Even when the law does not oblige them, banks often pay something on a goodwill basis, known in Dutch as coulance. According to the NVB, just over 45% of private customers' bank helpdesk fraud losses were reimbursed in 2025.

The percentage varies by bank and by case. Do not assume you will get it back; first limit the damage.

Where does the NFC relay scam fit?

In the case described above, the victims did not transfer anything themselves; the criminals withdrew the cash. That puts it closer to the "unauthorised" side of the line, where a refund is the starting point.

It could be assessed differently if, for example, a victim typed their PIN into the fake app or carried on after a clear warning. This article is general information, not legal advice. In practice: explain exactly what happened to your bank, and if you disagree with the answer, take it to Kifid.

Taking a complaint to Kifid

You must first complain to your bank. If you disagree with its final answer, Kifid's rules give you three months from the bank's final written position (if the bank pointed out that deadline), or one year from when you first complained to the bank, or otherwise a reasonable period. A March 2026 decision (GC 2026-0219) shows Kifid will refuse complaints filed long after these limits.

What may change: the EU Payment Services Regulation

In November 2025 the EU Council and Parliament reached a provisional deal on a new Payment Services Regulation (PSR). According to a Taylor Wessing analysis, it includes a right to a refund when a fraudster impersonates your own bank or its staff and tricks you into making a payment, provided you report it to the police and inform your bank.

The final text and start date were not settled at the time of writing. Once it applies, the current rule that "authorised means no duty to refund" could change for exactly the scam described in this article.

Separately, since 1 July 2026 the Dutch financial intelligence unit FIU-Nederland can order banks to pause suspicious transactions for up to five working days, or ten at the request of a foreign FIU (DutchReview, bijzonderstrafrecht.nl). This is an anti-money-laundering power, not a scam refund — but expect scammers to imitate "your payment has been held" messages, too.

7. Special situations for internationals

You arrived recently and have no DigiD

Newcomers are attractive targets: unfamiliar with Dutch bank procedures, often not fluent in Dutch, and waiting for DigiD. The practical points are simple. Save your bank's fraud line in your phone on day one, and know that you can report to the police without DigiD by calling 0900-8844.

You bank with a non-Dutch bank

Many internationals keep an account with a bank or e-money institution licensed in another EU country. The core protections for unauthorised payments come from EU rules and apply across the EU, but the complaints route may differ: a bank licensed elsewhere may point you to its home country's dispute body rather than Kifid. Check your bank's terms and its complaints page now, before you need them.

You are house-hunting or a student

Housing scams follow the same logic. The Hague International Centre's Smart Checks advise never paying before you have seen the property and signed a contract, and reporting to the police and the Fraudehelpdesk if you are scammed.

8. Explaining it to visiting relatives and older family members

Three sentences are better than a lecture

When parents or relatives come to stay, they may answer your landline or your door while you are at work. Long explanations will not stick. Three short sentences will.

Many countries have their own versions of these scams — fake police, fake bank staff, a grandchild in trouble. Starting from the version your relatives know from home makes the Dutch version easier to recognise.

Practical precautions during a visit

• Tell them they do not need to answer unknown numbers
• Do not lend them your bank card, and do not install your banking app on their phone
• Agree a family code word for real emergencies
• After they go home, ask them to check any "your child in the Netherlands needs money" call by ringing your usual number

For visitors arriving from outside the EU, see our separate article on fake ETIAS websites, which covers the EES border registration and fake application sites.

9. Common mistakes and misconceptions

What people get wrong

These are the assumptions that come up again and again.

The "they knew my details" point matters. The Fraudehelpdesk says callers increasingly report that scammers knew a striking amount of personal information. DutchReview has reported that data stolen from telecom provider Odido is still fuelling phishing months after the breach.

Lowering your daily transfer limit to what you actually need is one of the cheapest protections there is.

10. Three fictional cases

The people below are fictional, used to show how the advice applies in different situations.

• Case A: two months after arriving, an engineer installs an "ING" app from an SMS link; the next morning €800 is gone. No DigiD yet, so the police report goes through 0900-8844. The app stays on the phone until the police have seen it.
• Case B: a visiting father, alone at home, starts a transfer from his daughter's phone after an English-language call from "her bank". She stops it, still informs the bank, and gives him the three sentences in his own language.
• Case C: a freelancer selling a sofa on Marktplaats opens a "delivery confirmation" link on WhatsApp but notices the wrong web address before logging in. She changes her password and tells her bank anyway.

11. What not to do

These actions make things worse.

Being scammed is not a sign of carelessness: these scams are designed to switch off your judgement with trust and pressure.

12. Checklist

Things you can do today:

• Saved your bank's fraud line in your phone contacts
• Lowered your daily transfer limit to what you need
• Turned on two-step verification in WhatsApp
• Checked whether your bank has a "verify this call" feature
• Agreed a family code word
• Told visiting relatives they can hang up on "the bank" or "the police"
• Applied for DigiD, so you can report online
• Noted the Fraudehelpdesk number (088-786 73 72)
• Found your bank's complaints page and dispute body
• Learned where to forward fake emails (valse-email@fraudehelpdesk.nl)

13. Summary

• The new scam: an AI-voiced robocall, a fake bank employee, a card tapped on a phone and cash withdrawn at an ATM — 170 victims and €380,000 in three weeks
• Bank helpdesk fraud cost €25.8 million in 2025, with just under 5,900 victims (NVB): fewer victims, bigger losses each
• Banks never ask you to install an app, tap your card or share your PIN. Hang up and call back on a number you looked up
• If hit: bank, passwords and evidence, police report, Fraudehelpdesk — in that order
• Unauthorised payments must in principle be refunded in full; since April 2026 Kifid rarely accepts "gross negligence" in helpdesk fraud
• Transfers you made yourself are generally not covered by law; goodwill payments covered just over 45% of losses in 2025, and the EU's new PSR may change this
• Give visiting relatives three sentences: hang up, cards and PINs mean scam, call me before paying

Sources

Police, public bodies and industry

• Twee verdachten aangehouden in onderzoek naar nieuwe vorm van bankhelpdeskfraude — politie.nl: the method, scale, arrests, custody, and advice from the police and NVB
• Ik ben slachtoffer van telefonische helpdeskfraude (bank) — politie.nl: steps for victims, how to report, 0900-8844
• Alle aangifte- en meldformulieren — politie.nl: police report forms
• Twee aanhoudingen in onderzoek naar grootschalige bankhelpdeskfraude — politie.nl: a separate March 2026 case
• Banken roepen socialmediaplatforms op meer te doen aan online fraudebestrijding — NVB: 2025 losses, victims, reimbursement rate and conditions
• Een terugblik op 2025 — Fraudehelpdesk: 2025 reports and losses, rankings by type, contact details
• Persbericht jaarcijfers 2025 — Fraudehelpdesk: 2025 annual figures release
• Persbericht halfjaarcijfers 2026 — Fraudehelpdesk: first-half 2026 figures by type, three steps
• Persbericht samenwerking politie — Fraudehelpdesk: reporting rates and the police pilot
• Commissie van Beroep legt de lat voor 'grof nalatig' hoger — Kifid: CvB 2026-0022 and the Civil Code articles
• Uitspraak Commissie van Beroep 2026-0022 — Kifid: the full ruling
• Uitspraak Geschillencommissie 2026-0219 — Kifid: complaint deadlines under article 7.1 of Kifid's rules
• Voorbeelden van valse berichten — Belastingdienst: examples of fake tax messages

Media for internationals and news

• Bank card scam in the Netherlands cons 170 victims out of 380.000 euros — IamExpat: the starting point for this article
• Massive spike in WhatsApp fraud this spring — IamExpat: the 2020 WhatsApp fraud surge and advice
• Police arrest two suspects in AI-powered bank fraud — NL Times: case figures and suspects' roles
• Dutch banks don't have to compensate customers who fall for helpdesk scams — NL Times: the June Kifid ruling
• Eight arrested in bank help desk scam after 150 people lost €1.6 million — NL Times: the 2023 Limburg "safe account" case
• Scammers use AI voice cloning to target thousands — NL Times: 9,793 suspicious-call reports in Q1 2025
• Over 75% drop in fraud with Marktplaats payment requests — NL Times: decline in fake payment-link fraud
• Eight arrested in €1.7 million bank help-desk fraud probe — DutchNews: remote-access software case
• Busy phone could indicate fraudsters are busy too, say banks — DutchNews: banks say 75% of scam payments happen while the victim is on the phone
• Thousands of Dutchies targeted by phishing calls — DutchReview: English-language fake police calls about BSN misuse
• Dutch tax office switches banks — DutchReview: the Belastingdienst's account change and scam risk
• Major changes rolling out across the Netherlands from July 1 — DutchReview: FIU transaction holds
• Stolen Odido data is still fuelling phishing scams — DutchReview: data leaks and phishing
• How can I avoid scams? — ACCESS: family-in-need messages and calling back
• Scam via Marktplaats and WhatsApp — ACCESS: how the fake payment-link scam works
• Banking in the Netherlands — Expatica: phishing by fake bank staff
• Smart Checks — The Hague International Centre: housing scams and where to report
• Burglaries - How to Avoid Them — Xpat.nl: never give your PIN to anyone claiming to be police or bank
• FIU-Nederland krijgt opschortingsbevoegdheid — bijzonderstrafrecht.nl: legal basis and duration of FIU holds
• EU lawmakers strike a deal on payments reforms — Taylor Wessing: the PSR provisional agreement and impersonation refunds
• Kifid legt lat hoger voor 'grove nalatigheid' bij bankhelpdeskfraude — banken.nl: facts and amounts in the April ruling

All sources were checked on 27 October 2026. Refund standards and bank procedures change, so if you are affected, check the latest guidance from your bank, the police and the Fraudehelpdesk. This article is general information, not legal advice.

Original article

Bank card scam in the Netherlands cons 170 victims out of 380.000 euros — IamExpat