Fraudsters have launched a sophisticated phishing campaign targeting Dutch bank customers amid the imminent switch from the iDeal payment system to the new Wero platform. By exploiting public uncertainty around the transition, attackers aim to trick users into divulging sensitive banking credentials and one-time codes.
Emails disguised as official bank notifications
Victims report receiving urgent-looking emails urging them to “confirm their Wero registration” before a looming deadline. These messages feature realistic bank logos and corporate styling, making it difficult for customers to spot inconsistencies. Links embedded in the email direct recipients to a counterfeit website that mimics the authentic Wero portal.
How the scam unfolds
- Click bait: The email warns that failure to register will result in account suspension or limited access to payments.
- Forged login page: Victims are prompted to enter their existing bank username, password, and SMS verification code on the fake site.
- Credentials harvested: Once entered, the details are immediately used by criminals to log into the real online banking environment and authorize transfers.
- Funds drained: Within minutes, victims often discover that their accounts have been emptied or large sums transferred to mule accounts.
Official warnings and customer guidance
The Dutch Banking Association (NVB) and individual banks have issued alerts reminding customers that:
- They will never receive unsolicited emails asking for login details or SMS codes.
- All Wero registrations must be completed through the official app available in recognized app stores or via the legitimate Wero website (wero.nl).
- Links in emails should never be used—customers should manually type addresses into their browser.
- Any suspicious message can be reported directly to their bank’s fraud department or via the national reporting center, Meldpunt Internetoplichting.
With the planned switch-over drawing near, banks urge heightened vigilance. Customers who believe they may have fallen victim to this scam are advised to contact their bank immediately and review recent account activity for unrecognized transactions.