Bank fraud: Erste customers targeted for HUF 7bn

According to Erste Bank, fraudsters tried to obtain money from its customers on nearly 21,000 occasions in the first half of 2026, targeting a total of almost HUF 7 billion. Based on information provided by the bank, real-time transaction monitoring and filtering systems stopped 80–85 per cent of these attempts, meaning that approximately HUF 5.7–6 billion may have been protected, based on the rounded figures disclosed.

Besides the figures, the changing methods used by fraudsters also warrant attention. In many attacks, the goal is not to breach the bank’s IT systems, but to use pressure, deception or intimidation to persuade customers themselves to disclose the required information, install software, or initiate or authorise a transfer.

Card fraud attempts are common, but larger sums are at risk in transfers

According to Erste’s official information, 85 per cent of the fraud attempts detected in the first half of 2026 were linked to bank cards. However, 84 per cent of the targeted amount was associated with transfer fraud. This shows that card-related attempts are far more frequent, but fraudsters try to obtain substantially larger sums through transfers.

The two types of data therefore point to different risks. A series of card attacks may consist of numerous smaller, potentially automated attempts, whereas fraudsters may target a larger amount at once when using deception to induce a transfer.

According to a Világgazdaság report citing MTI, the number of attempts recorded in the first half of 2026 exceeded 60 per cent of the total number of cases in the whole of 2025. The newspaper also reported that the targeted amount was more than 80 per cent of the figure recorded for the entire previous year.

Fraudsters often seek to persuade rather than hack

According to KiberPajzs, the focus of payment fraud has shifted from technically breaching banking systems towards directly manipulating customers psychologically. This is known as social engineering, or influence based on deception.

A fraudster may pose as a bank representative, public authority employee, service provider, business partner or even an acquaintance. The story typically creates a sense of urgency: the account is supposedly at risk, a suspicious transfer must be stopped, or a “security” procedure must be completed immediately.

The purpose of this pressure is to prevent the person concerned from having time to verify the claim through a separate channel. It is a strong warning sign if the caller asks for a one-time code or password, tries to persuade the customer to install remote-access software, or requests a transfer to a supposed secure account.

Artificial intelligence can make scams faster and appear more credible

According to the National Cyber Security Institute, artificial intelligence systems capable of performing subtasks autonomously are playing an increasingly significant role in financial fraud. They can be used to automate phishing campaigns, for example, as well as certain stages of attempts to obtain passwords.

Automation allows fraudsters to create more natural-sounding, personalised messages for more targets in a short period. Spelling and grammatical errors that once served as warning signs are therefore no longer reliable indicators on their own, and messages may also incorporate publicly available personal information.

Deepfake technology may also be capable of imitating a person’s voice or likeness. As a result, a familiar voice, an apparently genuine video call or a name displayed on a phone screen does not in itself verify the caller’s identity.

In APP fraud, the victim authorises the payment

The National Cyber Security Institute has also drawn attention to the spread of Authorised Push Payment fraud, commonly known as APP fraud. In these cases, the attacker uses deception, sometimes involving manipulated audio or video, to persuade the victim to initiate or confirm the transaction themselves.

This differs from cases in which someone uses stolen bank card details without the customer’s knowledge. Because the account holder authorises the transaction in APP fraud, the system may identify it as a legitimate customer action. It is therefore important for the customer to check the amount, beneficiary and type of transaction before authorising it.

Caller ID and video images are not conclusive proof

Caller ID displayed on a phone can be manipulated, so the name or telephone number shown does not in itself prove that the bank is genuinely calling. The fraudster may also use real banking terminology, a plausible customer-service scenario and even previously obtained personal information to establish trust.

If a communication appears suspicious, it is advisable to end the conversation and then contact the bank independently through the financial institution’s official app or website, or using the telephone number printed on the bank card. Contact details dictated by the caller or a link sent in a message cannot provide independent verification.

According to Erste, the George mobile app can send an encrypted internal notification if a genuine bank employee is calling the customer during a telephone conversation. This provides an additional means of verification, but the details of the transaction displayed in the app must still be read separately before any authorisation.

Warning signs that should prompt you to stop

Fraud scenarios may differ, but several recurring elements can be identified. It may indicate a risk if the person contacting you demands an immediate decision, asks for secrecy, or claims that the money in the account can only be saved by making an urgent transfer.

• You are asked to transfer money to a “secure account”: such a request may be part of a fraud attempt, so the transaction should be verified separately using the bank’s official contact details.
• You are asked for a code, password or login details: disclosing these may allow a transaction or login to be authorised.
• You are asked to install remote-access software: such an application may provide access to the device’s screen or controls.
• You are told not to call back: an attempt to prevent independent verification is particularly suspicious.
• The authorisation notification shows different details: if the amount, beneficiary or transaction type differs, the transaction should not be confirmed.

What should you do after a suspicious call or initiated transfer?

If fraud is suspected, contact should be ended and the bank approached through its official contact channels. If the person concerned has already provided information, installed software or authorised a transaction, it is advisable to notify the financial institution immediately so that it can assess any security measures that may still be available.

Changing access credentials, temporarily blocking a card or adjusting transaction limits depends on the specific circumstances and the bank’s services. This general information does not constitute personalised financial or IT security advice, so the bank’s official customer service should be consulted about the appropriate steps in a particular case.

Independent verification is the key to protection. When faced with pressure, it is advisable to stop, contact the supposed sender through a separate channel, and read all transaction details before authorising anything. Artificial intelligence can make a fraudster’s message, voice or video more convincing, but it cannot replace a return call initiated through the bank’s official contact details.