The emerging threat lurking within the holiday shopping rush: ghost tapping

A new NFC-based scam called “ghost tapping” lets thieves relay a victim’s mobile-wallet or contactless card data to a portable terminal from arm’s reach, executing small, discreet transactions without touching the target; scammers in Singapore reportedly stole nearly $1 million in a three-month window using the method. The risk threatens retailers, payment processors and banks by eroding consumer trust in tap-to-pay and mobile-wallet payments, increasing fraud losses and potential migration away from these payment rails. Firms are advised to harden onboarding and authentication for mobile wallets, enhance transaction monitoring for anomalous patterns (eg, rapid geographically distant charges), and accelerate consumer education and security controls (transaction alerts, PIN/biometric requirements, option to disable NFC), while recognizing ghost tapping is part of a broader uptick in mobile and AI-enabled fraud that necessitates modernization of cybersecurity defenses.

Analysis

The article describes “ghost tapping,” an NFC-based fraud technique that relays a victim’s mobile-wallet or contactless card data to a portable terminal from arm’s reach, enabling thieves to execute legitimate transactions without touching the target. Scammers exploit everyday NFC use (tap-to-pay, transit and ticketing), typically loading small charges of $1–$100 and operating in crowded places; the piece cites nearly $1 million stolen in Singapore over a recent three-month window as an illustrative loss. Ghost tapping requires an unlocked device with NFC enabled and often succeeds when transaction notifications are disabled, so attackers can discreetly route funds to accounts they control and bypass traditional skimming limitations. The threat directly affects retailers, payment providers and banks by increasing fraud losses and potentially eroding consumer trust in tap-to-pay rails, risking migration away from specific payment methods. The article recommends operational mitigations: stricter authentication when adding cards to mobile wallets, enhanced transaction monitoring for anomalous patterns (eg, geographically distant rapid charges), customer education, mandatory alerts and options to require PIN/biometric gating or disable NFC. It also frames ghost tapping as part of a broader rise in mobile and AI-enabled fraud vectors, urging firms to modernize cybersecurity toolsets and share responsibility with consumers.

Key Decisions for Investors

• Prioritize exposure to payment processors, card issuers and fintechs that disclose strong mobile-wallet onboarding controls and real-time NFC fraud detection, and consider reducing positions in firms without clear remediation plans
• Engage portfolio companies (retailers and issuers) to implement mandatory authentication for wallet provisioning, transaction alerts, PIN/biometric gating and anomalous-location monitoring or reassess downside risk
• Monitor fraud-loss metrics, customer-dispute volumes and reputational indicators over the coming quarters and be prepared to reprice or hedge positions if consumer trust erosion reduces payment volumes or increases provisions
• Favor vendors offering end-to-end fraud analytics and fraud-loss transparency, and demand timelines for modernization of cybersecurity defenses tied to management guidance