{
  "id": 673863,
  "title": "Smooth-talking fraudsters clone contactless cards, authorize payments in just 13 minutes",
  "url": "https://urgent.news/2026/08/12/smooth-talking-fraudsters-clone-contactless-cards-authorize-payments",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-08-12T15:05:00.000Z",
  "source": {
    "name": "The Register",
    "slug": "the-register",
    "url": "https://www.theregister.com/cyber-crime/2026/08/12/smooth-talking-fraudsters-clone-contactless-cards-authorize-payments-in-just-13-minutes/5286808"
  },
  "original_language": "en",
  "account": "A new cybercrime scheme utilizes social engineering and malware to clone contactless cards and make payments within just 13 minutes. The operation, identified as WindRelay, was uncovered by Group-IB and targeted European Android users. The attack relies on a social engineer tricking victims into installing SpyNote, a remote access trojan (RAT), through a convincing phone call disguised as a bank helpdesk. After installing SpyNote, the attacker installs WindRelay on the infected device, capturing live EMV APDU exchanges between the victim's payment card and the NFC-enabled smartphone. With this data, the attacker can authorize fraudulent charges using the victim's PIN. The malware can also be used to access the victim's banking app and take out loans. Group-IB observed 23 WindRelay-related samples uploaded to VirusTotal between November 2025 and July 2026, targeting victims in Czechia, Slovakia, and Slovenia, but failed to identify the attacker(s).",
  "summary": "Social engineering and malware combine to enable financial fraud before banks have time to act",
  "key_points": [
    "WindRelay scheme uses social engineering and malware to clone contactless cards.",
    "SpyNote RAT installed via convincing phone call disguised as bank helpdesk.",
    "Fraudulent charges authorized using victim's PIN within 13 minutes."
  ],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 2,
    "also_reported_by": [
      {
        "outlet": "The Register Science",
        "title": "Smooth-talking fraudsters clone contactless cards, authorize payments in just 13 minutes",
        "url": "https://urgent.news/2026/08/12/smooth-talking-fraudsters-clone-contactless-cards-authorize-payments-675547",
        "published": "2026-08-12T15:05:00.000Z"
      }
    ]
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}