Smooth-talking fraudsters clone contactless cards, authorize payments in just 13 minutes
- ID
- 13531
- Status
- summarized
- Published
- 12 Aug 2026, 11:05 PM
- Fetched
- 12 Aug 2026, 11:38 PM
- Provider
- The Register
- Category
- technology
- Original URL
- https://www.theregister.com/cyber-crime/2026/08/12/smooth-talking-fraudsters-clone-contactless-cards-authorize-payments-in-just-13-minutes/5286808
- Source URL
- https://www.theregister.com/headlines.atom
Summary
- Score
- 6.5
- Created
- 12 Aug 2026, 11:42 PM
- Tags
- Audience
- developerssaas_founders
What happened
Group-IB detailed a fraud campaign called WindRelay that combines a phone-based social engineering attack with two Android malware strains—SpyNote (a RAT leaked in 2016) and WindRelay (NFC relay malware discovered August 2025)—to clone contactless card transactions in as little as 13 minutes. The attacker poses as bank helpdesk, gets the victim to install SpyNote, which silently deploys WindRelay, then tricks the victim into tapping their card on their NFC phone and entering a PIN. WindRelay captures the live EMV APDU exchange and relays it to an attacker-controlled POS terminal or ATM, completing a genuine card-terminal handshake that authorizes fraudulent payments.
Why it matters
If you build or operate payment, fintech, or banking apps in Malaysia—where contactless card and e-wallet usage is near-universal—this attack shows that contactless EMV is not a trust boundary you can rely on when the cardholder's own device is compromised. Fintech teams should evaluate whether their fraud detection can flag relay-style transactions characterized by unusual POS-to-cardholder geolocation or timing gaps, and whether customer-facing flows that instruct users to tap cards on phones create teachable moments for social engineering awareness.
Discussion angle
For builders in Malaysian fintech: does your transaction monitoring have heuristics to detect NFC relay fraud—e.g., a card-present authorization where the POS terminal location doesn't match the cardholder's likely location—or are you relying on EMV contactless being inherently secure?