"Hold your card to your phone": how the NFC relay scam works and what to do

How the scam works

So far the scam has been documented mainly in the Czech Republic, where ESET researchers first described it and police have reported a string of cases. The technique isn't tied to any country, though: anyone with a contactless card and an Android phone can be targeted. It comes in two parts. The first is a classic bank impersonation call; the second is new: the scammer doesn't need to steal the card, because the victim "lends" it through their own phone.

1. A call or a message. The caller claims to be from your bank, the central bank, the police or an investment firm. Your account has been hacked, there's a suspicious payment, or your card "needs securing". They push you to act fast.
2. The first app. Following instructions, you install an app that looks like a banking or security app, from a link sent by text, email or chat. In ESET's 2024 case the campaign started with a text about a tax refund. In cases from the Děčín district, victims typed their banking login into the app and approved two-step verification, giving the scammers access to their accounts. The scammers then had savings moved to the current account or card limits raised.
3. The second app and the card. You install an app that reads the card over NFC. The scammer tells you to turn on NFC, hold the card against the back of the phone and enter your PIN – ESET says the caller claimed the PIN needed "changing" and the card "verifying".
4. The withdrawal. The scammer stands at an ATM, often far from you, and takes out cash. Money is also moved to accounts at foreign financial firms to make it harder to trace.

In October 2025 ESET described a version in which the app imitates the Czech National Bank or the National Bank of Slovakia. According to ESET, these apps spread outside official app stores.

Why it works even though you still have your card

The fake app turns your phone into a contactless reader. When you tap your card, the app reads its chip and forwards the communication in real time over the internet to the scammer's device. Czech police compare it to a two-way tunnel between your card and the device at the ATM. To your bank, the withdrawal looks like an ordinary contactless use of your own card. If you type your PIN into the app, the scammer has it too.

ESET, which first documented the technique in August 2024 under the name NGate, says the victim's phone doesn't need to be "hacked" or rooted – only the attacker's device does. That's why it's enough for someone to install the app and follow the caller's instructions. ESET called it the first Android malware with this capability seen in the wild.

The losses are real. Czech police in the Děčín district recorded at least nine cases between December 2025 and January 2026, with losses of over 2.3 million crowns (about €90,000). In March 2024 Prague police arrested a 22-year-old who had been taking cash from ATMs, according to ESET; he was carrying 160,000 crowns (over €6,000). ESET recorded a more than 35-fold rise in NFC-related fraud in the first half of 2025, though it says the numbers are still relatively small.

How to spot it

Any one of these is enough:

• Someone wants you to hold your card to your phone. Czech police, the Czech National Bank and ESET agree: no bank or authority ever needs this. Your card belongs on a shop's payment terminal or an ATM, nowhere else.
• You're told to install an app during a call, especially from a link in a text, email or chat. Banks don't send apps over the phone.
• They want your PIN, your banking login or approval in your banking app. The Czech National Bank says its staff never ask for a PIN or login details.
• The central bank is calling. Central banks don't hold accounts for the public.
• Pressure. "We have to sort this out now or you'll lose everything." The FTC's advice applies here too: a real bank or government agency will never tell you to move money to "protect" it.

Already happened? What to do now

Do it in this order:

1. End the call and don't take further calls from "bank staff" or "police officers".
2. Call your bank on the number on your card or its website. Have the card blocked and explain what happened: tapped card, PIN entered, app installed, login details entered. The Czech National Bank and Czech police both advise contacting your bank as soon as possible.
3. Entered your login or approved a payment? Have online banking access blocked as well and ask whether outgoing transfers can still be stopped.
4. Take the phone offline (Wi-Fi and mobile data) and uninstall the fake apps. Czech police warn that scammers sometimes also use remote-access apps that can hide apps and suppress bank notifications. Don't log in to your bank from that phone until it has been checked or reset to factory settings, and change passwords from another device.
5. Report it to the police and bring your bank statement, the caller's number, call times, the name of the app and the link you downloaded it from.

If you also entered details on a fake website, continue with Entered your details on a phishing site.

How to protect yourself

• Install apps only from Google Play or the App Store, never because a caller told you to (Czech National Bank, ESET). Keep "install unknown apps" turned off on Android.
• Your PIN belongs only in an ATM or a payment terminal. Never type it into an app.
• Turn NFC off when you don't need it (ESET's advice). NFC and phone payments aren't dangerous in themselves, as Czech police point out, but it's an extra safeguard.
• Talk about it with family, especially older relatives and anyone less at home with technology. Czech police recommend this explicitly.

Where to report it

• Your bank: immediately, to block the card and online banking.
• The police: your local police or national fraud reporting service.
• UK: forward scam texts to 7726, free of charge.
• US: report fraud to the FTC at ReportFraud.ftc.gov.

The scam often follows other stories: ESET's first wave began with a fake tax refund text, and it also turns up after investment scams.