Fake Bank Pekao app uses NFC Relay to capture card data and PINs, CSIRT KNF warns
Poland's CSIRT KNF warned on 12 October of a malicious Android app posing as Bank Pekao that asks users to tap a payment card to their phone and enter a PIN. The app is not available on Google Play, and the bank says it has already been blocked.
The warning
The cybersecurity response team of Poland's financial sector, CSIRT KNF, which works within the Financial Supervision Commission (KNF), issued a warning on 12 October about a malicious application that impersonates Bank Pekao S.A. The app targets users of Android devices and is not available on Google Play. According to CSIRT KNF, it can be distributed through fake e-mails and SMS messages, messaging apps and websites that imitate the bank. In a post on the X platform, the team wrote:
The application is not available on Google Play. It may be distributed through fake e-mails and SMS messages, messaging apps and websites posing as the bank.
How the scam works
The method is called NFC Relay. NFC is normally used for contactless payments when a phone is tapped in a shop. In this scheme, the fake app asks the user to hold a payment card against the phone, supposedly to verify data or confirm identity. The app then asks for the PIN, which reaches the criminals. According to CSIRT KNF's description of the method, the fake app's identifier is passed remotely to another device, which can then be used to attempt a transaction. CSIRT KNF also published a video on social media explaining how the app behaves when a card is held to its NFC interface. One report says attacks of this type had already occurred at other banks before this case.
Bank response
Bank Pekao S.A. confirmed that it took action to block the fake app. Its spokesperson, Paweł Jurek, told Interia Biznes that the case was reported immediately:
As soon as we see on the bank's side an app that impersonates our bank, the standard procedure is to report it immediately to the relevant services so that it is blocked. That was also the case here. Thanks to good cooperation with cybersecurity experts, we managed to block this app very quickly.
The spokesperson added that customers who have doubts about an app can call the bank and ask for an explanation. Customers who installed the fake app and passed on their data should block or cancel their card. The bank also asks customers to be especially careful with links sent by SMS or e-mail.
Advice from the regulator
CSIRT KNF advises installing applications only from trusted sources and exercising particular caution with links received from unknown senders. It treats any request to hold a card to a phone "for verification" or "cancellation" as a warning sign, and recommends checking the situation through an official channel, such as calling the bank directly.
