Ghost tapping scam targets holiday shoppers using tap-to-pay technology

CLEVELAND, Ohio (WOIO)- As the holiday shopping season approaches, scammers are targeting consumers who use tap-to-pay technology through a method called “ghost tapping.”

The scam exploits near-field communication technology on credit cards, allowing thieves to charge victims without their knowledge by getting close enough to read card information through electronic devices.

“They’re close to you, and they have some kind of a device or some kind of mechanism that their device can read your card,” Ericka Dilworth, Director of Operations with the Better Business Bureau office in Broadview Heights.

The technique is called “brushing” because scammers brush up against victims to get within range of their cards or mobile devices.

Scammers intercept near-field communications between electronic devices, which allows unauthorized transactions using victims’ credit card information.

“When those communications are intercepted, it allows a bad guy to essentially use your credit card for unauthorized transactions. The good news is, a bad guy has to be within inches of either your mobile phone or your credit card in order to skim that information,” said cybersecurity expert Robert Siciliano.

The Better Business Bureau issued a warning ahead of the holiday shopping season. Mastercard reports that more than half of Americans use mobile wallets like Apple Pay, creating a large pool of potential victims.

Scammers typically start with small amounts to test stolen card information.

“It could only be for a couple dollars, that’s usually what they do. Then, okay...let’s see if I can get this to work for $2, and if it works for $2 then I’m going to try for $50. I’m going to try for $100,” said Dilworth.

She recommends purchasing an RFID wallet to block credit cards from being ghost tapped.

“It looks in size like your credit card, a similar size. You slide it in there, and it protects your card from that accessibility,” Dilworth said.

Siciliano said the best protection is monitoring card activity closely and setting up push notifications to dispute unauthorized charges with credit card companies immediately.