As contactless payments become an integral part of daily life, a disturbing scam called “ghost tapping” has been known to exploit the convenience it promises.
Ghost bugging is a fraud method that targets the “tap and pay” feature found on cards and mobile wallets. It involves the use of near field communication (NFC) technology, which allows a card or phone to exchange data with a payment terminal at very close range.
The Better Business Bureau (BBB), a nonprofit organization that helps consumers learn whether a business is trustworthy, warned that it had recently received numerous reports of such scams. [1].
One person told BBB Scam Tracker what he experienced: “One person goes door to door. [location redacted] Claiming to sell chocolate on behalf of [redacted] supporting students with special needs. To get people to pay by card, it says it can only accept tap-to-pay payments. It then debits large amounts from the card without allowing the cardholder to see the amount. “He bought my mother for 537 dollars… Another victim for 1100 dollars… He often changes neighborhoods to avoid getting caught.”
Unlike older scams that required a physical swipe or a tampered reader, ghost wiretapping can be carried out without leaving the cardholder’s wallet or phone.
Scammers have various approaches:
-
They can hit or walk past someone with a hidden reader in a crowded place, triggering a payment from the victim’s touch-enabled device.
-
They may pose as salesmen, charity collectors, or door-to-door salesmen, insisting on cash payment and then charging much more than the buyer expects.
-
In more sophisticated schemes, fraudsters trick victims into entering card details into phishing apps or links, add them to mobile wallets they control, and then make unauthorized tap-to-pay purchases even without a physical card.
In Missouri, local station KY3 News reported that a scammer was walking around with a “tap machine” and approaching people to swipe their cards from their wallets or wallets. One person claimed to have lost $100 [2].
Trend: Are you richer than you think? Here they are 5 clear signs you’re well above the average American’s wealth
There were approximately 17.9 billion contactless transactions and approximately 300 million contactless-enabled cards in circulation in the U.S. in 2023, according to Clearly Payments [3]. Fraudsters manipulate contactless payment features that consumers prefer to obtain information.
“Once a fraudster has obtained your credit card information and successfully added it to their device’s wallet, they can shop with tap at brick-and-mortar stores—no physical card, PIN or ID required,” said LifeLock General Manager Ian Bednowitz.
Since there’s no need for a physical card or PIN in most cases, ghost wiretapping can be fast, discreet, and difficult to detect. Scammers often charge small amounts initially to prevent bank alerts from being triggered, then escalate. Scams are especially dangerous at crowded events such as festivals, public transport stations and busy markets; here crashing or distraction can facilitate the attack.
“This is a digital fraud with real-world consequences. Victims may never lose their card, or even know it has been compromised, until charges appear on their statement. And because the fraud uses legitimate mobile wallet infrastructure, it may be harder for banks and consumers to distinguish between authorized and fraudulent activity,” Bednowitz warned.
The US currently has limited restrictions on contactless payment amounts compared to some other countries, making tapping widely accessible and therefore more vulnerable.
Consumers should be wary of subtle red flags that may indicate ghost listening.
A good tip is to be wary of sellers who insist you “just tap” without showing the total amount or providing a receipt. Another warning sign is detecting small or odd “test” charges on your account after being in crowded venues.
Here are more tips:
-
Use an RFID-blocking wallet or card case: RFID-blocking wallets can help prevent fraudsters from accessing payment data wirelessly via Near Field Communication (NFC) technology.
-
Always verify seller details before touching: Check the vendor name and amount at the payment terminal before paying, especially at flea markets or festivals where fake vendor stands may be set up.
-
Enable real-time transaction alerts: Banks recommend setting up instant push notifications for all card activity.
-
Review your statements regularly: Check your transaction history regularly for small, unusual charges that may indicate stolen card credentials were tested.
-
If you are a victim, report it immediately and take action: The Federal Trade Commission recommends that you immediately contact your bank to freeze the compromised card and submit a report to ReportFraud.ftc.gov.
As tap-and-pay becomes more common, it’s best to be vigilant and verify every transaction. Don’t let the speed of contactless payments be your downfall.
Join over 200,000 readers and get Moneywise’s best stories and exclusive interviews first; Clear information compiled and presented weekly. Subscribe now.
We rely only on vetted sources and reliable third-party reports. For details, see editorial ethics and rules.
Better Business Bureau (1); KY3 News (2); Explicit Payments (3)
This article was first published on: moneywise.com under the title: Better Business Bureau issues warning about ‘ghost wiretapping’ scams. What Americans need to know to protect themselves
This article provides information only and should not be construed as advice. It is provided without any warranty.
