Loading story…
Dutch authorities reported two separate but related forms of financial cyber-enabled fraud. In one case, three Dutch men in their twenties were sentenced to prison terms of three to seven years for running a large-scale phishing and bank helpdesk fraud operation that stole hundreds of thousands of euros. Prosecutors said the group used stolen victim data, phishing emails, fake banking sites, follow-up phone calls, cash-out teams at ATMs, mule accounts, and card collection teams to drain accounts, with the lead suspect allegedly coordinating around 100 callers and operating from luxury apartments in Rotterdam.
In a separate Dutch court case, a 34-year-old Amsterdam man was prosecuted for allegedly helping open dozens of ABN AMRO bank accounts in other peoples’ names by bypassing facial verification during remote onboarding. According to the court and prosecutors, the scheme involved replacing ID document photos with the suspect’s image and altering selfies so they matched the victim documents closely enough to defeat the bank’s face-scan checks. The activity was detected by the bank in spring 2025, and investigators reportedly found victim IDs and linked email accounts on the suspect’s phone, indicating a deliberate effort to abuse digital identity verification for account creation and likely downstream fraud.
See the reporting duties and controls this puts on the clock.
5 events from the most recent confirmed update back to the earliest known activity.
A Dutch court sentenced three men in their twenties to prison terms of three to seven years for running a large-scale phishing and fake bank helpdesk fraud operation. The court said the organized scheme laundered about €2 million and likely converted much of the stolen money into cryptocurrency.
A 34-year-old Amsterdam man appeared in court accused of helping open dozens of ABN AMRO bank accounts in other people's names by bypassing facial verification. Prosecutors requested a 2.5-year prison sentence, including six months suspended.
During the suspect's arrest in December 2025, border police found a large number of bank cards tied to accounts connected to him. Investigators also linked materials on his phone to victim IDs, related email accounts, and other evidence.
In spring 2025, ABN AMRO discovered that dozens of accounts had allegedly been opened in other people's names by manipulating ID photos and selfies to defeat facial checks in the bank's mobile app. Another fraudulent account was reportedly opened in May using a woman's identity document.
Prosecutors said one of the fraudulent ABN AMRO accounts was opened on 2025-04-08 using the identity of a Canadian man. The account was allegedly created by bypassing the bank's facial verification process with manipulated identity materials.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See what this changes for your reporting obligations and which controls it puts on the clock.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Dutch police said they dismantled an international investment fraud operation that allegedly used fake cryptocurrency trading platforms and bogus financial advisers to steal from victims worldwide. Investigators said the network had operated since at least 2021 through roughly 20 to 24 call centers in multiple countries, with more than 700 staff persuading targets to invest and then showing fictitious profits to induce additional payments. Authorities linked at least 550 fraud reports and about **$28.6 million** in reported losses to the group, while estimating victims in the Netherlands alone lost nearly **€25 million** and that tens of thousands of people may have been affected globally. Authorities made multiple arrests across several countries and identified a 46-year-old Israeli-Polish suspect as a central figure in the scheme. The suspect, described as a well-known hacker, was arrested in Poland on May 26 and extradited to the Netherlands; investigators allege he played a key technical and organizational role in helping the group conceal identities, mask call-center locations, and evade law enforcement. Dutch investigators said they traced IP addresses, financial routes, and other digital evidence to map the organization’s infrastructure, and believe the operation at one point generated more than **€100 million per month**.
Jul 18, 2026
Dutch police said their investigation into the cyberattack on telecom provider **Odido** found indications that Dutch nationals may have helped carry out the breach, which exposed personal data belonging to more than **6 million customers**. Investigators from Team High Tech Crime and the Public Prosecution Service said a Dutch-speaking man allegedly impersonated an Odido IT employee in a call to customer service shortly before the February intrusion, suggesting the attackers used **social engineering** and phishing to gain access. Authorities said the attackers accessed a compromised customer contact system used by Odido, downloaded customer records, and later distributed the stolen data publicly. Police have already taken multiple servers linked to the hacker group offline and are appealing for information from the public and people in cybercrime circles, while warning that the investigation is expected to continue for several more months.
Jul 15, 2026
Dutch police arrested a **21-year-old man from Dordrecht** suspected of selling access to **JokerOTP**, a phishing automation tool used to intercept **one-time passwords (OTPs)** and bypass multi-factor authentication. Authorities said the suspect marketed the service via **Telegram** and was found in possession of **license keys** used to provide other criminals access to the bot. JokerOTP is described as a phishing-as-a-service capability that can **automatically call victims**, impersonate legitimate security alerts, and trick targets into entering OTPs; reporting also indicates it could be configured to capture additional sensitive data such as **PINs, payment card data, and social security numbers**, and target users of services including **PayPal, Venmo, Coinbase, Amazon, and Apple**. The arrest is the **third** tied to the JokerOTP operation, following the earlier arrests of the alleged developer (April 2025) and a co-developer (August 2025); UK law enforcement previously assessed the tool was used **28,000+ times across 13 countries** and linked to **at least $10 million** in losses.
Jun 29, 2026