Criminals force customers to scan payment cards using malicious software
PrivatBank has recorded an increase in NFC Relay attacks where fraudsters steal client funds. Criminals trick victims into tapping their bank cards against their smartphones and entering PIN codes to gain remote access to their accounts. This was reported by RBC-Ukraine (Анна Рижук), according to the portal PromPolitInform.
According to the financial institution, this year has been marked by the spread of one of the most technically complex fraudulent schemes. Nataliia Fihol, Head of the Fraud Management Department at PrivatBank, explains that the method involves using specialized malware that allows criminals to remotely scan payment instrument data.
The criminal mechanism usually begins with a phone call during which fraudsters simulate a need to update the banking app or undergo a security check. The victim is persuaded to download a third-party file via a messenger or visit a suspicious website to install unknown software.
After the software is installed, the cardholder is asked to perform a critical manipulation—tapping the physical card against the smartphone screen and confirming with a PIN code. Using the captured NFC signal, fraudsters instantly withdraw cash from ATMs or make purchases at retail stores.
Protection against digital threats
The bank emphasizes that financial institution representatives never ask customers to scan cards with a phone or download files from unknown sources. The only safe way to install software is to use official app stores, such as the App Store or Google Play.
National Bank statistics demonstrate that criminals are gradually changing their tactics. In 2025, the total number of illicit transactions in Ukraine decreased by 5%, amounting to 256,000 cases. At the same time, the total amount of damages increased by 24%, reaching 1.4 billion UAH.
The average loss per successful transaction grew by 30% to 5,536 UAH. This indicates that criminal groups are focusing on more sophisticated engineering approaches, such as NFC Relay, which allow them to steal significantly larger sums per attack compared to mass phishing.
Photo: RBC-Ukraine
Read also: US dollar and euro exchange rates fall in banks on September 2
