As more people use tap-to-pay technology for everyday purchases, scammers have found a new way to exploit that technology in the form of ghost tapping. While ghost tapping sounds like something out of a scary movie, it is a scam with very real consequences.
Tap-to-pay technology is designed to make payments quick and convenient. Whether you use a contactless bank or credit card or a smartphone wallet, the systems rely on near-field communication, or NFC, to send payment information when placed near a card reader. It is typically a faster, more secure way to pay, protected by layers of encryption.
Unfortunately, criminals are always looking for new ways to take advantage of consumers and have begun to use contactless payment technology to steal money and personal data.
In a ghost tapping scam, fraudsters use hidden card payment readers, fake terminals, or compromised devices to trigger an unauthorized contactless transaction. In some cases, they may try to get close enough to a person’s wallet, pocket, or handbag to read a contactless card (did someone really accidentally bump into you?).
In others, they use social engineering to trick someone into tapping their phone or card against a fake or altered payment terminal (remember those fake gas station pump credit card scanners?) Some scams may also involve loading stolen card details onto a fraudster’s digital wallet and then using them to make contactless purchases.
It is important to keep the risk in perspective. Modern contactless cards and digital wallets include multiple security protections, and a successful unauthorized “drive-by” charge from someone passing nearby may be harder than it sounds.
In many situations, the greater risk is social engineering. A scammer may pose as a vendor, charity worker, parking attendant, or fundraiser and pressure a consumer to tap a card or phone without clearly displaying the merchant name, purchase amount, or any added tip.
Consumers should treat an unexplained request to tap the same way they would treat an unfamiliar link or an unexpected request for account information: pause, verify, and walk away if something does not seem right.
The Michigan Department of the Attorney General advises consumers to read the payment screen before tapping and verify the merchant name, total charge, and any tip amount. Consumers should not allow themselves to be rushed into a transaction and should stop if the information on the terminal does not match what they expected. The Attorney General also cautions consumers to resist pressure to act immediately, particularly when a stranger creates urgency or asks for financial information.
Several warning signs suggest a tap-to-pay transaction may not be legitimate. Be especially cautious when a seller or individual:
- Pressures you to pay immediately or discourages you from reviewing the screen.
- Refuses to provide a receipt or cannot clearly explain the charge.
- Uses a device that appears damaged, altered, unbranded, flimsy, or disconnected from a normal point-of-sale setup.
- Asks you to tap more than once because the first transaction supposedly “did not go through.”
- Displays a transaction total, merchant name, or tip prompt that differs from what you expected.
- Approaches people in crowded locations and claims to collect donations, sell tickets, or accept payments without a clearly identifiable business or organization.
While the idea of someone stealing your money with a quick tap sounds frightening, most major banks and card providers have security systems that monitor unusual account activity, and many contactless transactions have value limits.
In addition, mobile wallets typically require facial recognition or a passcode before approving a payment. Still, there are steps consumers can take to help reduce the risk of falling victim to a ghost tapping scam:
- Keep your cards and phone secure, especially in crowded places, such as airports, shopping centers, and public transportation.
- Be cautious if someone carrying a device gets unusually close to you for no obvious reason.
- Before tapping, confirm the merchant name, exact dollar amount, and tip amount shown on the payment terminal. If the information is incomplete or doesn’t match the transaction, don’t tap.
- Do not let a stranger handle your unlocked phone or guide you through a payment screen. A legitimate merchant should allow you to control your own device and review the transaction before authorizing it.
- Check whether your bank offers card controls in its online app, and use contactless features only when necessary.
- Set up real-time transaction alerts for card purchases, including small-dollar transactions. Fraudsters may use small unauthorized charges to test whether a card is active before attempting larger transactions.
- Use a strong phone passcode and biometric security, such as facial recognition or fingerprint authentication, for mobile-wallet apps.
- Check your account regularly for fraudulent activity and set up fraud alerts with your bank or credit card provider so you are notified of any suspicious card activity.
- Consider using a wallet with RFID-blocking technology. While it may add an extra layer of protection, it should not replace more important safeguards such as reviewing transactions, enabling alerts, and protecting your cards and phone.
- Keep receipts and, when practical, take a screenshot of unexpected payment prompts or merchant information. This information may be useful if you need to dispute a charge.
If you are targeted by a ghost tapping scam, contact your bank or credit card provider immediately and ask them to freeze or cancel your card. You should also update any passwords that are linked to your banking and digital-wallet accounts.
Speed matters if you believe an unauthorized transaction has occurred. Dispute the charge through the card issuer’s official mobile app, website, or the telephone number printed on the back of the card. Don’t rely on a phone number, text link, QR code, or email supplied by an unfamiliar person. Review recent activity on all cards and digital wallets, since criminals may test more than one payment method.
Also remove the affected card from any digital wallet until the issuer provides guidance. Review your financial accounts for unfamiliar devices, new contact information, or changes to account settings. If you believe your identity or account credentials were compromised, change passwords promptly and use unique, strong passwords for financial accounts.
Michigan Attorney General Dana Nessel advises scam victims to report fraudulent charges to their bank, credit card company, or payment app immediately, notify local law enforcement when appropriate, and consider filing a report with the Federal Trade Commission. Michigan consumers may also submit a consumer complaint to the Attorney General’s Consumer Protection Team. Other states have similar consumer protection teams.
As Halloween approaches, the only ghost tapping you should encounter is the kind that comes with a haunted house, a dark hallway, and a good scare, not an unexpected charge on your account. Before you tap, take a moment to verify the details and keep a close eye on your accounts, so scammers don’t turn a little convenience into a costly trick.
Sam H. Fawaz CFP®, CPA, PFS is the President of YDream Financial Services, Inc., a fee-only investment advisory and financial planning firm serving the entire United States. If you would like to review your current investment portfolio or discuss any other retirement, college, tax, or financial planning matters, please don’t hesitate to contact us or visit our website at http://www.ydfs.com. We are a fiduciary financial planning firm that always puts your interests first, with no products to sell. If you are not a client, an initial consultation is complimentary, and there is never any pressure or hidden sales pitch. We begin with a thorough assessment of your unique personal situation. There is no rush and no cookie-cutter approach. Each client’s financial plan and investment objectives are unique.
Source: Broadridge Advisor Solutions. © 2026 Broadridge Financial Services, Inc.
