You tap your phone or card to pay for coffee. It's fast, easy, and your clients don't even have to swipe. But what if a scammer could steal their money the same way without them ever knowing? That's exactly what ghost tapping scams do. And they're growing fast.
According to the Federal Trade Commission (FTC), Americans lost more than $15.9 billion to fraud in 2025. In a March 2026 hearing, consumers submitted 3 million fraud reports to the Consumer Sentinel Network. Ghost tapping is one of the newest tools scammers are using to add to those numbers. We’ve laid out the basics you need to know, so you can help protect the members you serve from these tricks.
What is a ghost tapping scam?
A ghost tapping scam is a type of theft that uses the same wireless technology as tap-to-pay cards or phones. That technology is called Near Field Communication, or NFC. NFC lets two devices share information when they are very close together — usually within an inch or two.
When a member taps their card or phone at a store, their payment information travels wirelessly to the payment machine. Ghost tapping scammers find ways to grab that signal or trick them into sending it to them instead. The theft can happen without the scammer ever touching your wallet or phone.
The Better Business Bureau (BBB) warns that contactless payment fraud — the broad category that includes ghost tapping — is one of the fastest-growing scams targeting everyday consumers. Ghost tapping is especially sneaky because the transactions can look completely normal to your bank, making them hard to catch.
How do ghost tapping scams work?
There are a few different ways scammers pull off ghost tapping attacks. Understanding how they work can help you educate members so they spot them before it's too late.
Physical ghost tapping in public places
In this version, a scammer carries a hidden NFC reader — a small device that can fit in a bag or even a pocket. They get close to someone in a busy place, like a subway, a festival, a shopping mall, or a crowded bus stop. The device silently scans the tap-enabled card through your wallet, purse, or back pocket and tries to complete a payment.
The BBB has received real reports of this happening. In one case, a man went door to door claiming to sell chocolate for a good cause and asked people to pay by tapping their card to his device — but he charged them far more than they agreed to. One victim lost $537. Another lost $1,100. The man kept moving neighborhoods to avoid getting caught.
Fake vendor scams
Scammers sometimes set up fake booths or stands at events, flea markets, or pop-up shops. They look like real vendors. They might sell food, crafts, or tickets. When a customer taps a card to pay, they may charge a much larger amount than the price shown, or even charge multiple times. Because the machine looks convincing, victims don't realize anything is wrong until they check their bank account later.
Fake charity scams
This version is especially cruel. A scammer poses as a charity worker and asks for a small donation, maybe even as small as $5 or $10. They hand over a payment device and ask for a tap. But behind the scenes, the device charges the card for a larger amount. Sometimes the excess amount is small, like a few dollars more, so victims don’t notice it right away. Other times the amount is much higher, adding extra numbers to the amount intended for donation. Since the person meant to donate, they may not check their receipt closely or question the charge right away.
Digital ghost tapping through malware
This is the most advanced version of the scam. It starts with a fake text message or phone call. The scammer pretends to be your bank or a trusted company and tells the member there's a problem with their account. They ask them to download an app or click a link to "fix" the problem.
That app is actually malware — harmful software that secretly copies card information. Once the scammer has the card data, they load it onto their own phone or device and use it to make tap-to-pay purchases anywhere in the world. These digital ghost tapping tools are even sold online to other criminals, making the threat much bigger than any one bad actor.
Real-life scenarios to watch for
Knowing what a ghost tapping scam looks like in real life makes it easier for members to avoid. Here are a few example situations you can share with them.
Crowded public transportation. A member riding a busy subway or bus to work. Someone bumps into them and says sorry. It feels like a normal accident. But that person had a hidden NFC reader in their bag. In the split second they were near you, the device tried to charge the tap-enabled card through jeans pocket or purse.
A fake fundraiser. Someone in a shopping center parking lot approaches a member with a tablet and says they're raising money for a local school. They ask for a tap to donate $10. But the device charges $150. By the time the member gets home and checks their bank app, the person is long gone.
Urgent “bank” texts. A member gets a text that looks like it's from their bank. It says their account is locked and they need to download an app to verify their information. They download the app and tap their card as it instructs. But the app was fake. Their card information is now in the hands of a criminal who uses it to go shopping across town, or even in another country.
A sales booth. A member is at a local fair and stops at a booth selling homemade goods. The seller has a tap-to-pay machine. They tap for a $12 purchase. But over the next two days, the bank shows three charges of $48, $75, and $120 to an unfamiliar merchant. The booth was not what it seemed.
Warning signs of a ghost tapping scam
The BBB recommends members watch for these red flags:
- A small, unexpected charge they don't recognize. Small "test" charges are a common sign that scammers are checking whether a stolen card number works before making bigger purchases.
- Someone asks them to tap a card without showing the total amount or giving a receipt.
- Suspicious charges appear on the account after spending time in a crowded public place like a market, festival, or transit station.
- They receive a text or email asking them to download an app or click a link to fix a banking problem.
Steps members can take to protect themselves
- Members don't have to stop using tap-to-pay entirely. But they can take smart steps to make it much harder for scammers to steal from them.
- Use an RFID-blocking wallet or card sleeve. These special wallets and sleeves block the wireless signal from tap-enabled cards when they're not being used. A scammer's hidden reader can't pick up card information if the signal is blocked.
- Always check the amount before tapping. Members should look at the screen on the payment machine. Make sure the amount shown is what they agreed to pay. Never tap on a device that doesn't show a total.
- Turn on transaction alerts with the bank. Most banks let customers set up real-time text or email alerts for every purchase. If a charge shows up that a member didn't make, they'll know right away.
- Review bank statements often. Members shouldn't wait until the end of the month to check accounts. A quick daily or every-few-days check helps catch fraud fast — before it grows.
- Be careful about where to tap. In very crowded places or when attending an event with temporary vendors, members should consider using a different payment method. Avoiding a debit card means scammers cannot directly access a bank account — paying cash is a good alternative when unsure.
- Never download apps from links in texts or emails. If someone texts or emails saying a bank account needs attention, members should not click any links. Instead, go directly to the bank's official website or call the number on the back of the card.
- Only tap at trusted, official payment terminals. If a vendor's payment device looks unusual, broken, or different from what 's expected, members should trust their gut and pay another way.
- Keep phone operating systems and apps up to date. Software updates often fix security weaknesses that scammers try to exploit.
- Review the payment in real time. If a member receives a receipt or text message after tap to pay, they should review it right away for accuracy while still in front of the vendor.
How an IDShield® Membership helps keep members protected
Ghost tapping scams can be hard to spot in the moment. That's why offering your clients a layer of protection working for them around the clock makes a real difference. For members not currently enrolled in an Identity Theft Protection Plan, you can help them become a member at their next enrollment opportunity.
Credit monitoring and alerts
IDShield monitors members' credit files and sends alerts when something changes, like a new account being opened in their name or a credit inquiry they didn't ask for.
Dark web monitoring
When scammers steal payment card information, they sometimes sell it on the dark web — hidden parts of the internet used for illegal activity. IDShield scans the dark web 24/7 for members' personal information, including email addresses, Social Security numbers, and financial account details. If their information is found in a place it shouldn't be, IDShield lets them know.
Financial account monitoring
IDShield keeps a watchful eye on members' financial accounts and notifies them of suspicious activity. This monitoring helps them catch strange charges early by setting up threshold account limits. This way, they know about suspicious missing dollars before small amounts turn into big losses.
Identity restoration services
What happens if, despite best efforts, a member becomes a victim of identity theft? IDShield has them covered. Every IDShield Member has access to Licensed Private Investigators (LPI) who are dedicated to helping them through the recovery process. An LPI can work on their behalf to contact creditors, dispute fraudulent charges, file the right paperwork, and help restore their identity to where it was before the theft occurred. They don't have to figure it out alone.
Lost wallet protection
If a member's wallet goes missing — whether it's stolen or simply lost — IDShield's lost wallet protection service helps them cancel and replace cards quickly. Speed matters after a loss like this, and IDShield helps them move fast.
ScamCheck from Trend Micro
ScamCheck from Trend Micro can look at suspicious messages, links, and screenshots to detect scams before members click on them. The AI has been trained to spot the warning signs of fraud that humans might miss. It also blocks suspicious phone numbers and text messages automatically.
Up to $5 million identity fraud protection
IDShield backs its recovery services with up to $5 million identity fraud protection. This identity fraud protection covers certain out-of-pocket expenses related to covered identity theft events.
Your clients deserve to feel safe every time they pay
Ghost tapping scams are growing more common and more clever. But knowledge is the first line of defense. By helping members understand how these scams work, watch for warning signs, and take simple protective steps, you can reduce their risk every day. And with IDShield in their corner, they have a powerful partner watching for threats around the clock — and ready to help if something goes wrong.
Identity theft can happen to anyone. But recovering from it doesn't have to be a nightmare. IDShield is here to help make sure of that.