---
title: "PrivatBank records a rise in NFC Relay attacks: fraudsters trick victims into tapping their card against a smartphone to withdraw cash remotely"
description: "PrivatBank reported a rise in NFC Relay attacks in 2026: fraudsters trick victims into tapping their card against a smartphone and entering their PIN code, after which they withdraw cash remotely. According to the NBU, the damage from card fraud in 2025 grew by 24% to 1.4 billion UAH."
date: 2026-09-04T15:16:01.000Z
lang: en
url: https://xab.info/en/posts/privatbank-nfc-relay-attack-fraud-2026
tags: [privatbank, nfc-relay-attack, cyber-fraud, financial-crime, smartphone-security, ukraine-banking]
publisher: "XAB.info"
---

# PrivatBank records a rise in NFC Relay attacks: fraudsters trick victims into tapping their card against a smartphone to withdraw cash remotely

![PrivatBank logo and branch signage on a brick facade — the bank warns of rising NFC relay attacks and remote cash withdrawals](https://xab.info/media/2026/09/04/privatbank-nfc-relay-ataka-moshennichestvo-2026/privatbank-nfc-relay-ataka-moshennichestvo-2026-1.webp)

## 🎯 Key Points

- PrivatBank recorded a rise in NFC Relay attacks — a scheme in which the victim is forced to tap their card against a smartphone for the remote withdrawal of cash
- Fraudsters disguise themselves as an "app update" and offer to download malware from a messenger
- According to the NBU, in 2025 the damage from card fraud in Ukraine grew by 24% to 1.4 billion UAH, while the number of operations fell by 5%
- The bank reminds: never tap your card against a smartphone at the request of strangers and install apps only from the App Store / Google Play

In 2026, PrivatBank recorded a sustained increase in one of the most technically complex schemes for stealing funds — NFC Relay attacks. According to Natalia Figol, head of the bank's fraud management department, criminals remotely read payment data from customers' cards by getting the victim to tap their physical card against their own smartphone. The scheme, which the bank first identified in 2025, reached a new level of spread this year and has become a priority area for the anti-fraud service.

### Attack mechanics: from messenger to ATM

The NFC Relay attack scenario is built on a classic social engineering model. The criminal contacts the victim under the pretext of an "app update" or a "security check." The victim is then offered to download a third-party program — malware — from a messenger or an unknown website. After the app is installed, the victim is asked to perform the key manipulation: tap their physical bank card against the smartphone and enter their PIN code. At that moment, specialized software remotely reads the payment data through the phone's NFC module, after which the fraudsters instantly withdraw cash at an ATM or make payments in stores. The entire chain from the first call to the theft of funds takes only a few minutes.

### Bank's comment and security rules

"It is very important to be able to recognize such attempts. The bank never asks you to download third-party files from messengers or to tap your card against a smartphone for a 'security check' or 'scanning.' We also recommend installing software only from official sources — App Store/Google Play," Natalia Figol emphasized. PrivatBank specifically reminds customers: employees of financial institutions never ask clients to tap their card against a smartphone for "scanning" or demand the installation of third-party files. The only safe channels for downloading apps remain the official stores — App Store and Google Play.

### Statistics: fewer attacks, but greater damage

The macro indicators published by the National Bank of Ukraine for the end of 2025 confirm a strategic shift in cybercriminals' tactics. The number of illegal operations with payment cards in the country fell by 5% — to 256 thousand cases. However, the total damage from them rose by 24% — to 1.4 billion UAH, and the average "check" of a single fraudulent operation increased by 30% — to 5,536 UAH. These figures show that criminals are betting not on the volume of attacks, but on their technological complexity and effectiveness. The NFC Relay scheme fits exactly this logic, allowing large sums to be withdrawn in a single operation without attracting the attention of monitoring systems.

### Context: NFC fraud as a global trend

Attacks using NFC technology are not limited to the Ukrainian market. In parallel, law enforcement agencies in other jurisdictions are recording similar schemes: in particular, the Russian Ministry of Internal Affairs identified the theft of online bank data via the NFC module of someone else's phone, and Russian media in July 2026 reported on new ways of stealing funds via a smartphone. This indicates that NFC Relay attacks have become part of a global trend of escalating technological complexity in financial fraud, in which artificial intelligence and specialized malware allow criminals to automate even the most complex stages of an attack.

## 🔍 Fact-Check Verification

- [A new level of fraud: at PrivatBank they explained how money is stolen via NFC and a smartphone](https://www.rbc.ua/ukr/news/noviy-riven-shahraystva-privatbanku-rozpovili-1788534820.html) - Первичный источник: прямое цитирование Натальи Фиголь, описание механики NFC Relay-атаки, статистика НБУ за 2025 год. Все ключевые факты статьи соответствуют данному материалу.
- [The Ministry of Internal Affairs identified a scheme for stealing online bank data via NFC on someone else's phone](https://tass.ru/obschestvo/27884845) - Подтверждает глобальный характер NFC-мошенничества: аналогичные схемы фиксируются правоохранительными органами и в других юрисдикциях. Не содержит противоречий с основным текстом.
- [Fraudsters have come up with a new way of stealing money via a smartphone](https://www.gazeta.ru/social/news/2026/07/04/28823485.shtml) - Дополнительный контекст: июль 2026 года, новый способ кражи через смартфон. Согласуется с общей тематикой эскалации технологической сложности атак.

## ❓ FAQ

### Q: What is an NFC Relay attack and how does it work?
**A:** An NFC Relay attack is a scheme in which fraudsters force the victim to install a malicious app and tap their bank card against a smartphone. Specialized software reads the payment data remotely through the phone's NFC module, after which the criminals withdraw cash at an ATM or pay for purchases. The victim enters their PIN code in the process, which completes the cycle of theft.

### Q: How can you recognize an attempted NFC Relay attack?
**A:** The key sign is a demand to tap a physical card against a smartphone or to download an app from a messenger / unknown website. PrivatBank and other financial institutions never ask customers to perform such actions. If you receive a call offering to "update the app" via a third-party file — it is fraud.

### Q: What security measures does PrivatBank recommend?
**A:** The bank recommends: never tap your card against a smartphone at the request of strangers; do not download files from messengers; install apps exclusively from the official App Store and Google Play stores; and, upon any suspicious call, end the conversation and contact the bank yourself through official channels.

### Q: What is the scale of card fraud in Ukraine?
**A:** According to NBU data for 2025, the number of illegal operations with payment cards amounted to 256 thousand (a 5% decrease), however the total damage grew by 24% to 1.4 billion UAH, and the average size of a single operation increased by 30% to 5,536 UAH. This indicates a shift by criminals from mass attacks to complex and effective schemes.