LIVE · cybersecurity feed
Live wire
phishing

Two arrested over credit card phishing – as the Netherlands is named Europe’s worst for payment fraud

Two individuals were arrested over a phishing operation that harvested credit card details. The arrests come as the Netherlands is named the worst country in Europe for payment fraud.

zeroday.news · 25d ago

Two young men have been arrested in the Netherlands in connection with a credit card phishing operation. Dutch police detained a 23-year-old from Zaandam and a 21-year-old from Amsterdam on June 23, 2026. Their homes were searched, and devices believed to be used in fraudulent activities, along with luxury items and a car, were seized.

Authorities allege that the suspects operated phishing websites designed to trick victims into divulging their payment card details. While the specific methods used in this case were not detailed by police, common phishing tactics in the Netherlands include fake delivery fee texts from postal services, spoofed bank websites, and malicious QR codes. Investigators suspect the arrested individuals not only used the stolen card information themselves but also supplied it to other criminals.

The arrests come as new figures from the Dutch central bank reveal a significant rise in payment fraud. In 2025, payment fraud cases in the Netherlands increased by approximately 30% to around 658,000, with total losses reaching €198 million, a 22% jump. Card payment fraud was the most prevalent category, accounting for over half a million fraudulent transactions, a more than 25% increase from the previous year. The central bank identified phishing as the primary method criminals use to obtain card details.

Data analyzed by fraud prevention firm BioCatch, using European Banking Authority information, indicates that the Netherlands now leads all countries in the European Economic Area for digital payment fraud. The cybercrime unit of the Noord-Holland division of the Dutch police is continuing its investigation and has not ruled out further arrests in connection with the phishing operation.

This incident is part of a broader trend. In a separate case on May 19, the same police unit arrested two 23-year-old men suspected of selling "phishing panels" – pre-made kits of fake bank websites – as a phishing-as-a-service. These kits were allegedly sold via social media to fraudsters across Europe.

The impact on victims remains a significant concern. Statistics from 2024 show that only 1% of fraud victims in the Netherlands recovered their money. While about half reported the crime to their bank, only a fifth reported it to the police. This suggests that the recent arrests may represent only a fraction of the overall problem.

phishingarrestfraudcybercrimenetherlands
ShareXLinkedInWhatsAppFacebook

More News

view all →
vulnerability

Coldcard Hardware Wallet Flaw Linked to $70 Million Bitcoin Theft in 41 Minutes

An attacker drained 1,196 Bitcoin addresses in 41 minutes on July 30, taking 1,082.65 BTC worth about $70.2 million at the time. Galaxy Research mapped the sweep and tied it to a firmware flaw in Coldcard, the Bitcoin-only hardware wallet made by Canadian firm Coinkite. A March 2021 firmware integration error routed seed generation to a deterministic software pseudorandom number generator (PRNG

vulnerabilitycritical

Rails patches critical Active Storage flaw with RCE potential

A critical vulnerability in the Active Storage framework can allow an unauthenticated attacker to read arbitrary files from a Rails application, and potentially escalate to remote code execution (RCE). [...]

malware

Russian Hackers Hijack Hotel Wi-Fi to Steal Microsoft 365 Tokens

Microsoft says Russian hackers hijacked hotel Wi-Fi portals to spread malware and steal Microsoft 365 tokens from travelers. Microsoft Threat Intelligence disclosed CaptiveCrunch, a campaign it attributes to Storm-2945, an operational sub-cluster of Midnight Blizzard, the Russian SVR-linked group also known as APT29 and Cozy Bear. Since early May 2026, Storm-2945 has been manipulating DNS […]

CVE-2026-48449critical

Adobe fixed a maximum-severity vulnerability flaw in Campaign Classic

Adobe fixed a maximum severity vulnerability in Campaign Classic that could let attackers run code remotely without user interaction. Adobe has addressed a critical vulnerability, tracked as CVE-2026-48449 (CVSS score of 10.0), in Adobe Campaign Classic, the company’s enterprise marketing automation platform. The flaw is caused by incorrect authorization and could allow attackers to execute […]

security

Balance Theory Raises $19 Million to Help Enterprises Manage Cybersecurity Investments

The funding round was led by SYN Ventures, with participation from existing investors DataTribe and TEDCO. The post Balance Theory Raises $19 Million to Help Enterprises Manage Cybersecurity Investments appeared first on SecurityWeek.

vulnerabilitycritical

Ruby on Rails Patches Critical Vulnerability

The flaw can be exploited by unauthenticated attackers to read arbitrary files and potentially achieve remote code execution (RCE). The post Ruby on Rails Patches Critical Vulnerability appeared first on SecurityWeek.