Ghost Tapping Preys on Credit Card Chips, Digital Wallets

The Better Business Bureau has issued a new warning about a scam targeting tap-to-pay chips in credit cards and mobile wallets.

So-called ghost tapping abuses the near-field communication (NFC) technology embedded in contactless payment chips and digital wallets, which allows devices to exchange data at very close range. The scam can happen without the victim noticing. In crowded spaces like a festival or train stations, a criminal may get close to a victim—and sometimes even bump into them—then use a wireless payment reader to access a tap-enabled card or phone without the victim realizing it.

In other instances, the criminal poses as a vendor or charity fundraiser and convinces the victim to make a small tap payment. That minor charge may not be enough to trigger fraud detection systems, so victims might not notice the theft right away.

The criminal can then use the stolen data to make additional unauthorized charges.

Widespread Operations

Even more insidious, once payment card information is stolen and loaded into mobile wallets, criminals can transfer those credentials to other phones to scale the operation. Although these scams may appear to be the work of small-time criminals, a substantial infrastructure supports them.

Recorded Future’s Insikt Group has identified organized networks that disseminate both the phones and the phishing software used in ghost-tapping fraud. Insikt also found advertisements and recruitment messages on messaging platforms, indicating a burgeoning market for goods obtained through ghost-tapping.

Protection Against the Scam

The BBB recommends that consumers use an RFID-blocking wallet or sleeve on their credit cards to help stop wireless skimming. For less than $10, these sleeves prevent others from detecting the radio signals emitted by the card’s chip.

Before tapping a card or phone, consumers should verify the merchant’s name, amount, and terminal screen to make sure everything looks correct.

The BBB also advises limiting tap-to-pay use in high-risk areas, like at a farmers market or crowded retail stored. In these cases, swiping or inserting the card is generally a safer option.

Finally, consumers should set up transaction alerts with their bank and regularly monitor their accounts. If they suspect fraud or discover unauthorized charges, they should contact their bank or card issuer immediately to report the issue and cancel the card.