Ghost Tap is a reported form of NFC relay fraud—not a way to make NFC’s radio reach farther. A criminal can use one device to communicate with a contactless payment terminal while another device, possibly far away, supplies or relays the payment credentials. The exact steps vary: reported methods include mobile-wallet enrollment using stolen card details, malware that captures a physical card’s chip data, and Android malware that emulates a card at the terminal.
What is a Ghost Tap scam?
“Ghost Tap” is a label ThreatFabric used for a cash-out tactic involving stolen card details linked to Apple Pay or Google Pay and relayed NFC traffic. Recorded Future uses “ghost-tapping” more broadly for NFC relay fraud in which devices relay payment information from a victim’s card or device to a payment terminal without the victim’s knowledge. The name therefore does not describe one fixed sequence, and it should not be treated as a label for every kind of mobile-wallet fraud.
The common idea is a relay: a device at a physical point of sale (POS) communicates with the terminal, while payment information is obtained from or passed through a separate device. A mule may use the terminal-side device to buy goods that can be resold. The victim may be nowhere near the shop.
How does an NFC relay attack work?
NFC is still the short-range link between a device and the payment terminal. The relay connects that local exchange to a separate device or credential source; it does not extend NFC’s own radio range. ThreatFabric describes an attacker operating from far away, potentially in another country, while Recorded Future describes mules making transactions in victims’ countries.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Fix the driver behind crashes, sound loss and screen glitches3Clear out junk files and repair common Windows errors#1 Best Overall
- STYLISHLY SMALL, SLIM & DISCREET: Measuring just 3 1/8" x 4 7/16", our RFID front pocket wallet is designed to be super thin and exceptionally slim. Its modern, minimalist profile fits perfectly in your pocket, purse, or travel pack without adding bulk.
- SURPRISINGLY SPACIOUS: Though slim, it features 8 slots to easily organize your essentials. Comfortably holds your driver's license, credit cards, debit cards, and membership cards, keeping everything you need right at your fingertips.
- ADVANCED RFID BLOCKING: Our slim wallets for men and women are outfitted with advanced RFID SECURE Technology. They block electronic signals to keep your identity protected while you travel, shop, or explore, safeguarding you from digital theft.
- DURABLE & STYLISH FAUX LEATHER: Crafted from premium synthetic leather, this minimalist wallet sleeve combines a luxurious look and feel with everyday functionality. Its durable construction is designed to withstand the rigors of daily use, travel, and shopping.
- THE PERFECT UNISEX GIFT: With its sleek design and practical security features, this wallet is a popular choice for both men and women. It arrives ready for gifting, making it an ideal present for the frequent traveler, minimalist, or anyone in your life!
- Payment credentials are obtained. Depending on the method, criminals may phish card details and a one-time password (OTP), use malware to capture card data, or use card data obtained by other means.
- The credentials are made usable at a terminal. One reported method enrolls stolen card details in a mobile wallet. Other reported methods capture chip data from a physical card or load stolen card data into malware that emulates a card.
- A device communicates with the POS terminal. A criminal or mule presents a phone or other device at the terminal. A separate device or software process supplies, relays, or emulates the payment information, depending on the variant.
- The transaction is cashed out. In the wallet-relay sequence described by ThreatFabric and Recorded Future, a mule can buy goods for resale. Other flows may use POS or ATM transactions; the cash-out method is not identical across reports.
How the reported methods differ
The sources describe related techniques with important differences. In particular, a victim does not have to install malware in every reported operation, and mobile-wallet enrollment is not a required step in all of them.
| Reported method | How credentials are acquired | What happens on the victim’s side | Where relay or emulation occurs | Reported transaction or cash-out |
|---|---|---|---|---|
| ThreatFabric’s named Ghost Tap model, also described in Recorded Future’s reporting | ThreatFabric describes stolen card details and an OTP used to link a card to Apple Pay or Google Pay; Recorded Future discusses phishing, malware, OTP interception, burner phones, and mule activity in the broader ecosystem. | In the described wallet-enrollment sequence, card details and an OTP are compromised. Victim-side malware is not established as a requirement for every such transaction. | A criminal’s device holding the enrolled card relays NFC traffic to a second device used at a physical terminal. | A mule buys goods that can be resold. Recorded Future also documents wallet fraud that did not use NFC relay, so not every wallet-fraud case belongs to this method. |
| European Payments Council (EPC) variant | A caller or text impersonates a security alert, persuades the victim to disclose a PIN and install an app, and malware captures chip data when the physical card is brought near the phone. | The described flow involves the victim installing an app and bringing the physical card near the phone. | The EPC says captured data can be emulated for POS or ATM transactions; it does not specify the same two-device wallet-relay arrangement as ThreatFabric’s model. | POS or ATM transactions are described; a specific mule resale sequence is not stated in the cited EPC passage. |
| Group-IB’s TX-NFC pattern | Group-IB describes stolen card data loaded into Android malware on the fraudster’s device. | Group-IB says the victim’s device can be clean and malware-free in this operation. | Android Host Card Emulation (HCE) malware on the fraudster’s device emulates the card at a POS. | A POS transaction is described; a specific resale or other cash-out path is not stated in the cited TX-NFC profile. |
Why “not-so near field” is a useful description—but not a literal one
NFC is designed for a local exchange between a terminal and a nearby card or device. In a relay attack, the nearby device is not necessarily the one that originally holds the victim’s card or payment credentials. The criminal bridge makes a local terminal interaction possible using information or a device elsewhere. That is why a transaction can occur in a mule’s location even when the victim—and potentially the credential-holding device—is remote.
Rank #2
- Slim and Thin Wallet - This minimalist bifold wallet measures 4.3x3.2x0.6 inches and stores up to 15 cards. The bifold wallet perfectly fits in your pocket and is well-suited for everyday carry
- Elite Features - 2 ID windows (DL & Other ID Cards) and 2 quick slots allow for quick access during travel, shopping or work. With 15 card slots and 2 more slots behind them, it is easy to carry all your important cards,cash and bills, meet all your daily needs
- RFID Blocking- Our wallets are equipped with advanced RFID SECURE Technology, a unique metal composite, engineered specifically to block 13.56 MHz or higher RFID signals and protect the valuable information stored on RFID chips from unauthorized scans.License and ID cards will be protected effectively. No more worrying about unauthorized scans during travel, shopping, or daily commuting!
- Durable Surface - Our leather wallets are pressed with high quality 3 layers leather, which is more durable than 2 layers leather wallets. The surface of the leather is made more scratch-resistant by special treatment, which can effectively prevent small scratches caused by keys and buttons in life
- Gifts for him - The thin wallet comes in classy gift packaging. It is a perfect present for birthdays, anniversaries, Father's Day, Valentine's Day, Christmas and other special occasions, so you can easily gift it to someone you love
This distinction matters: the threat is not that an ordinary NFC payment suddenly works over a long distance. It is that criminals use multiple devices, software, or compromised credentials to connect a remote source with a local terminal transaction.
What the reported figures do—and do not—show
Group-IB’s January 2026 TX-NFC profile reports more than $355,000 in documented illegitimate transactions from one POS vendor between November 2024 and August 2025. That is a finding scoped to one vendor and period, not a global loss estimate. Group-IB also reported more than 21,000 Telegram channel subscribers and more than 54 distinct APK variants in its reporting, and advertised subscription pricing ranging from $45 per day to $1,050 for three months. These are company-reported observations about the activity it examined, not independently audited measures of worldwide prevalence.
Recommended Free Tools
Rank #3
- Ultra-thin: This wallet measures 4.3 x 3 x 0.5 inches and can hold at least 11 cards and 15-20 bills. Even when it's packed full, it's only 0.8 inches thick,It can perfectly conceal itself in your pocket without any noticeable bulge.
- Rfid Blocking: Our wallets are equipped with German Instiute Certified RFID Security technology, a unique metal composite, engineered specifically to block 13.56 MHz or higher RFID signals to protect the valuable information and privac.
- Lifetime After-sales Service: Regardless of the circumstances, if any GSOIAX brand wallet has a quality issue during your use, we promise to provide a full, unconditional, refund within 24 hours!
- Durable Surface: Crafted from premium 3-layer leather, our wallets outperform 2-layer alternatives in durability. Specially treated leather exterior delivers enhanced scratch resistance to guard against minor scuffs from everyday items like keys and buttons.
- Perfect Gifts For Him: This Money Clips Wallets for men comes in classy gift box package. It's a good idea to send the mens wallets as the gifts in birthday，anniversaries, Fathers Day，Valentine's Day，Christmas and other special occasions to someone you love.
The EPC describes NFC relay fraud as a growing concern, but the cited passage does not give a Ghost Tap-specific loss total. The sources cited here do not establish a global prevalence estimate or total industry loss figure.
How to protect yourself from Ghost Tap
- Do not trust an unsolicited fraud alert. Treat calls and texts about suspicious card activity as untrusted, especially when the caller asks for card details, a PIN, an OTP, or installation of an app.
- Verify through a known bank channel. End the unsolicited interaction and contact your bank using the number on your card or its official app or website. Do not use a number or link supplied in the suspicious message.
- Never disclose a PIN or OTP to someone who contacts you. Do not enter a code into a link or app because an unexpected caller says it is needed to stop fraud.
- Be cautious about installing an app at someone else’s request. The EPC’s described variant uses social engineering to persuade victims to install an app and bring a physical card near the phone.
- Turn on transaction notifications where available. Alerts can help you notice activity you do not recognize.
- Report an unrecognized transaction promptly. Contact the card issuer through an official channel and follow its instructions. Issuer procedures and consumer protections differ by location; the cited sources do not establish a universal reimbursement rule.
An NFC-blocking sleeve should not be presented as a complete defense against these methods. It cannot recover credentials already stolen or prevent a remote wallet credential from being relayed or emulated by another device.
Rank #4
- 【RFID Blocking Wallet for Men】Protect your personal information with our advanced RFID blocking tech. The wallet features a durable metal shell and composite materials that block 13.56 MHz and higher RFID signals, keeping your credit cards and IDs safe from electronic theft no matter where you are
- 【Card Slides Out Smoothly】This minimalist wallet features a button-activated ejection mechanism that pops cards up for easy access. The inner-facing slot ensures cards stay secure and never fall out
- 【Minimalist, Perfectly Slim】Designed to be sleek and easy to carry, featuring a dedicated ID card slot that allows for swiping without removing the card. It's perfect for ID cards, work badges, access cards, and transit cards. A separate cash compartment keeps your bills organized
- 【12 Card Slots & Cash Slot】Offers a total capacity of 12 cards (6 cards fitting in the chamber, 1 ID card, 4 slots on the wallet's outer surface, 1 slot on the card case exterior) and a cash slot. It features premium leather and aluminum chamber with a smooth pop-up card function, secured by a magnetic cover
- 【Premium Craftsmanship】Discover the perfect blend of quality and functionality with our wallet. Crafted from premium leather and airplane-grade aluminum, it features a convenient side pop-up for easy access. Durable and stylish, it complements both business and casual settings
What banks, processors, and merchants can monitor
ThreatFabric and Group-IB identify signals that may help payment firms spot suspicious activity. They are detection ideas reported by the researchers, not guaranteed controls or proof that any single transaction is fraudulent.
- New-device wallet links: ThreatFabric highlights a card linked to a new device, particularly when malware is also found on the known customer device.
- Impossible travel between transactions: ThreatFabric points to purchases in locations that could not be reached in the time between transactions.
- Geographic velocity: Group-IB recommends examining whether transaction locations and timing imply implausible travel.
- Contactless handshake timing: Group-IB recommends processor-level analysis of NFC transaction timing for signs consistent with relaying.
- Unusual terminal patterns: Group-IB suggests looking for POS terminals handling abnormal volumes of transactions associated with cardholders spread across distant locations.
These signals need to be assessed in context. A new device, unusual location, or busy terminal alone does not establish an attack.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Quick Recap
Best Value
- ★REAL LEATHER: This wallet is MADE IN INDIA and comes in 2 leather qualities, namely Nappa and Crazy Horse. Nappa leather is conventional drum dyed leather which is finished with natural pigments to attain a smooth and buttery touch, while Crazy Horse is vegetable tanned and sprayed with oils and waxes to give a distressed look with warm and soft touch.
- ★ELITE FEATURES: ID windows allow for quick access when traveling or at the store /working place. With 5 card slots and 2 more slots behind them, it’s easy to carry all your important cards, meet all your daily needs.
- ★RFID BLOCKING ANTI THEFT SECURITY: Our wallets are anti theft, equipped with advanced RFID SECURE Technology, a unique metal composite, engineered specifically to block 13.56 MHz or higher RFID signals and protect the valuable information stored on RFID chips from unauthorised scans and make them anti theft.
- ★COMPACT DESIGN: Making this bifold superb for travel, and everyday use, keeping cards safe and organized! It holds 8+ cards, and lots of cash!
- ★GIFT BOX PACKING: It is one of the most special gifts for Groomsmen, Birthdays, Anniversaries, Father's Day, Christmas and other Special Occasions.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
