NFC-Relay ("Ghost Tap") Fraud

NFC-relay fraud, often nicknamed "Ghost Tap," is a technique for spending your card at a physical terminal without holding the card. Contactless payments work through a very short-range radio conversation between a card or phone and a reader; relay software hijacks that conversation and stretches it across the internet. One device sits with the victim's card credential or infected phone, another sits with a mule at a real terminal somewhere in the world, and the tap that should happen over a couple of centimetres is instead forwarded live between them. The mule holds their phone to the reader, the relayed signal answers as though your card were present, and the purchase completes. The distinction that matters most is this: relay is not the same as card provisioning. Provisioning enrols a stolen card into a criminal's own mobile wallet so they can spend from it later; relay forwards the tap itself, in real time, so the fraud rides on your live card or wallet rather than on a static copy of it. That live quality is exactly what makes a ghost tap so hard to catch.

The setup begins with access to a card, obtained one of two ways. In the first, criminals phish your card number and a one-time verification code, usually through a fake bank message and a follow-up call, and enrol the card into a mobile wallet on their own device, so the credential they relay is one they now control. In the second, malware on your own phone, installed after a fraudulent app download or a message posing as your bank or a delivery service, quietly reads the contactless interface and forwards its signal while the physical card never leaves your possession. Either way, relay software links two ends over the internet: one near the card or wallet, and one with a mule at a genuine terminal. When the mule presents their phone, the reader's request is carried back to the card in real time and the card's answer is carried forward, so the terminal sees a normal tap. Because contactless purchases often clear without a PIN up to a threshold, the mules move fast, splitting spending across many small transactions in shops, transit gates, and cash-equivalent purchases before the account is frozen. The same relayed credential can be tapped repeatedly at terminals in different cities, and often different countries, in a single spree.

The fraud borrows the trust the payment system places in a physical tap. A contactless terminal is built to assume that if a card can answer over such a short range, the cardholder is standing right there, so a relayed answer looks entirely legitimate. Sub-threshold amounts skip the PIN, removing the one step the criminal cannot fake. The geography works against detection too: a card tapped abroad minutes after being phished does not always trip a rule, and by the time it does, dozens of small purchases have gone through. Victims are disarmed earlier, in the phishing stage, because the fake bank message and the code request feel like routine security, not the enrolment of their card onto a stranger's phone. And with the malware variant, nothing is ever missing to notice.

Your bank: unusual activity detected. To secure your card, verify the 6-digit code we just sent. Do not share it with anyone except our agent.

Parcel could not be delivered. Install our redelivery app to reschedule and confirm your card details.

Alert: a new device was added to your mobile wallet. Tap-to-pay is now active on ANDROID-PHONE. If this was not you, call the number on the back of your card.

Card notification: purchase approved — GBP 38.50 at a store 300 miles away, one of several small taps in minutes.

The defining tell comes before the tap: legitimate banks and wallets never ask you to read back a one-time passcode to a caller, and no genuine "verification" enrols your card onto someone else's device. Treat any message or call that pushes you to approve a wallet, share a code, or install an app to "secure" your card as the attack itself. If you are told a wallet or device has been added to your account, that notification is worth acting on, not dismissing. Check your banking app for authorised devices and linked wallets, and remove any you do not recognise. Watch statements for a burst of small contactless purchases, especially in places you have not been. On your phone, install apps only from official stores, refuse "update" links sent by message, and review which apps you have granted broad permissions.