Cyber criminals have devised a sophisticated new fraud known as the NGate scam, which allows them to withdraw cash from ATMs without physically possessing a victim’s debit or credit card. The scam targets Android smartphone users by exploiting Near Field Communication (NFC) technology and social engineering tactics.

What is the NGate scam?

NGate derives its name from NFC relay technology, commonly used for tap-to-pay transactions. In this scam, fraudsters trick victims into installing a malicious Android application that secretly captures card data and PIN details, enabling criminals to withdraw money remotely.

The fraud typically begins with a text message or email impersonating a bank, warning of an urgent issue such as suspicious activity or account suspension. The message includes a link to download an app — a key red flag, as the link does not lead to Google Play Store.

How the fraud unfolds

After the victim installs the app, scammers escalate the deception by making a phone call posing as bank staff, reinforcing legitimacy. Victims are then asked to “verify” their card by placing it against the phone and entering the PIN — a process that closely mimics legitimate NFC payments.

Unbeknownst to the victim, this action relays card credentials and PIN data in real time to an accomplice standing near an ATM, allowing immediate cash withdrawal.

Why the scam is hard to detect

The NGate scam is particularly dangerous because it feels authentic. Fraudsters use official-looking logos, convincing scripts, and multi-step verification methods that mirror genuine banking security procedures. Victims often realise something is wrong only after money has been withdrawn.

How to protect yourself

Cyber experts advise users to remain alert and sceptical of any unsolicited banking messages. Banks never ask customers to install apps via external links or to share card details and PINs over phone calls or apps.

Users should:

  • Download apps only from Google Play Store
  • Never tap a card or enter a PIN on apps suggested via messages
  • Avoid clicking links in urgent or threatening messages
  • Independently contact the bank using official website numbers
  • Hang up on suspicious calls and call the bank back directly

Newer Android versions also offer call-screening and scam-detection features, which users are encouraged to enable.

Police urge caution

Law enforcement agencies have warned that such scams are on the rise and urged citizens to report suspicious messages immediately. Staying calm, verifying information, and avoiding rushed decisions remain the strongest defences against digital fraud.