Watch Out for These Tap-to-Pay Scams

Contactless payment, also known as tap-to-pay, has become a quick, simple and relatively common way to make a transaction using your smartphone or credit card. It relies on near field communication (NFC) to transmit data between your device and a payment terminal when both are in close proximity, up to an inch or two away.

Although NFC technology provides additional security, such as transmitting a virtual account number instead of your actual card details, fraudsters have found a way to capitalize on contactless payment to steal money from unsuspecting targets. These “ghost eavesdropping” systems can exploit both cards and mobile wallets.

How Contactless Scams Work

According to the Better Business Bureau, phantom eavesdroppers take advantage of a potential victim’s proximity and lack of attention to detail. They suggest it’s possible for a scammer to pass you in a crowded public space and get close enough to trigger a contactless transaction without your knowledge. (It’s unclear how common it is to get close to a pay machine.)

But other versions of ghost tapping rely on your active engagement without detecting warning signs of fraud.

For example, fraudsters may appear to be selling goods or collecting small donations for charity using contactless payment, but they are actually charging a fraudulent business a much larger amount. They rely on you not carefully reviewing the details of the transaction before touching them, or they rush you through the process and fail to offer you a receipt.

In one case reported to the BBB’s Scam Tracker, people were targeted by a door-to-door salesman who claimed to be selling chocolate for a charitable cause. The transactions were worth hundreds of dollars, which the victims did not see before wiretapping them.

As with any scam, vigilance is required. Contactless payment is simple enough to feel automatic, and you may be less likely to pause and check the details than when you swipe or grab your credit card. Always slow down and confirm the merchant name, transaction and tip amount before removing your phone or card (again, proximity is sufficient to trigger contactless payment). Be wary of any salesperson who tries to rush you, hide the screen, or avoid giving you a receipt.

You may also want to set up transaction alerts with your bank or credit card company so that you can detect any suspicious charges immediately. If you receive a notification about a “test” fee, that’s also a red flag for a scam.

Finally, even if fraudsters don’t secretly mass scan contactless payments, you can protect your cards with a radio frequency identification (RFID) blocking wallet or sleeve. You can disable NFC on your Android in Settings (type “NFC” in the search bar). On iPhone, you need to enable airplane mode to block NFC.