High-Velocity Fraud Outpaces Bank Detection Windows

The speed of modern financial theft is now outpacing the ability of banks to intervene. According to reporting from The Register, a campaign discovered by Group-IB demonstrates how fraudsters can execute a full cycle of theft—from initial contact to payment authorization—in as little as 13 minutes.

The attack, dubbed WindRelay, leverages a combination of social engineering and malware to bypass traditional security. As detailed by The Register, attackers pose as bank helpdesk employees to convince Android users to install SpyNote, a remote access trojan (RAT). While maintaining the phone call, the attacker uses the RAT to install WindRelay, an NFC relay malware. By instructing the victim to tap their card on their phone and enter a PIN, the attacker captures a live EMV APDU exchange.

This captured data allows the fraudster to act as an "invisible relay," transmitting the handshake to a fraudulent merchant bank account or an ATM. Because the system perceives a genuine live handshake with a physical card, the transactions are processed as normal. Group-IB noted that attackers used this high-velocity window to hit two separate payout channels—card-present purchases and digital loans—before the victim or the bank could react.

This is not an isolated incident. The Register reports that similar NFC relay techniques, such as NGate and Ghost Tap, have emerged. Group-IB specifically noted that Ghost Tap, which utilized Chinese malware, resulted in losses exceeding $355,000 between November 2024 and August 2025. Researchers observed 23 WindRelay samples on VirusTotal between November 2025 and July 2026, with targets identified in Slovenia, Slovakia, and Czechia.