Ghost Tapping Scam: What It Is and What to Do - 2

Do it yourself · free Remove ghost tapping scam yourself 8 steps, 24 minutes, no software needed.

Ghost tapping scam: summary

Facts checked on 26 October 2026 against five public pages:

There is no address to test, so we made no request. We did not test any wallet or bank and could not confirm refund rules for your country.

What is a ghost tapping scam

A ghost tapping scam is a way of spending money from a stolen bank card without the card. Criminals add your card to a mobile wallet on a phone they control, and a helper pays at a shop terminal with a tap, often far away from you.

The name comes from the way it looks to the person who pays the bill. You did nothing, your card did not leave your hands, and still a charge appears for a tap in a shop you have never visited. The shop saw a normal mobile wallet payment. The real owner sees a ghost.

Security researchers use the term for a cash-out step: the criminals already hold the card data, and ghost tapping is how they turn it into goods or money. ThreatFabric, a mobile security company, wrote it in November 2024 under the name Ghost Tap.

Recorded Future's Insikt Group later wrote the method spreading in Southeast Asia. News sites in the United States carried local warnings in November 2025, at the start of the holiday shopping season.

This page explains the scam for the person who may have lost money, for the person who is afraid they will, and for the shop that sees the taps. It does not name a company as the culprit. Where the public record is silent we say so.

Is the ghost tapping scam a virus or a hack of my phone?

No. Ghost tapping does not install anything on your phone and does not hack the phone. It uses your card data, which was handed over or stolen somewhere else.

People ask this because the name sounds like malware, and because the research that made the term known talks software. That software, NFCGate, runs on the criminals' phones to relay a tap. It is not something that has to land on yours. Your wallet, your phone's PIN and your Face ID are not what the thief is attacking.

There is one honest exception. The step before ghost tapping, the theft of the data, can involve malware. ThreatFabric's report places Ghost Tap to other mobile threats that steal card data, and BleepingComputer links it to the earlier NGate malware, which relayed NFC card signals from victims.

If you installed an app from outside the official store, or an app asked for sweeping permissions, check the phone as well. That is a separate check from the card fix.

What ghost tapping scam does on an infected phone

How ghost tapping works step by step

The scam has two halves: getting your card data, and spending it through a wallet. The first half happens to you, usually through a fake page, text or call. The second half happens on the criminals' phones and at a shop.

Step one is the theft of the data. Reports describe phishing pages that copy a bank, a courier, a toll road or a government service, texts that tell you a parcel or a fine is waiting, and phone calls from someone posing as the bank. Malware on a device can also collect card data.

The page or caller asks for the card number, the expiry date, the security code and, at the end, the code that was just texted to you. That last code is the key. It is the bank's way to check that the owner agrees to put the card into a wallet, and once you read it out or type it into the fake page, the criminal can use it.

Step two is the wallet. With your data and the passcode, the criminal adds your card to Apple Wallet or Google Wallet on a phone that belongs to them. From then on that phone can pay at any contactless terminal. Your own phone and your own plastic card are not involved at all.

Step three is the tap. In the version ThreatFabric described, the wallet phone does not go to the shop. It sits with the criminal, and the near field communication signal is forwarded over the internet by a relay server to a second phone held by a helper at a till.

ThreatFabric named NFCGate, a public research tool, as the software used in the cases it saw. The helper taps the terminal and the terminal sees what looks like a normal mobile payment. Other reports say criminals also load many stolen cards onto burner phones and carry them to shops themselves.

Step four is the goods. Reports say the helpers, often called mules, buy items that are easy to sell on, and that the first payments can be small tests before larger ones. Because the helpers can be in many places while the wallet stays in one, a single stolen card can show up in several towns in a short time.

1 Your data is taken A fake page, text or call collects the card number, expiry date, security code and the passcode your bank texts you. Source: the pattern described by Recorded Future and TechRadar.

A fake page, text or call collects the card number, expiry date, security code and the passcode your bank texts you. Source: the pattern described by Recorded Future and TechRadar.

2 Your card is added to a thief's wallet The passcode lets the thief put your card into Apple Wallet or Google Wallet on their own phone. You do not see this on your phone.

Your card is added to a thief's wallet

The passcode lets the thief put your card into Apple Wallet or Google Wallet on their own phone. You do not see this on your phone.

3 The tap is relayed or carried In the relay version the signal goes over a server to a helper phone at a shop. In the other version burner phones holding many cards are carried to shops.

The tap is relayed or carried

In the relay version the signal goes over a server to a helper phone at a shop. In the other version burner phones holding many cards are carried to shops.

4 The shop terminal takes the payment The terminal sees a mobile wallet payment. The bank sees a valid card token. The charge appears on your statement.

The shop terminal takes the payment

The terminal sees a mobile wallet payment. The bank sees a valid card token. The charge appears on your statement.

What we checked for this guide, and what we could not

This subject is a method, not an address, so there is no website for us to test. We read five public pages and wrote the guide from them. We did not test any wallet, any relay tool or any bank.

Ghost tapping scam · desk check · 26 October 2026

The method is documented ThreatFabric described the relay method in November 2024, and BleepingComputer and Recorded Future wrote it afterwards.

No address to test The job gave a name, not a domain. Our server made no request, and there is no URLhaus record to read for a name.

How common it is We found no reliable count for any single country and do not print one. Recorded Future describes spread in Southeast Asia; local warnings exist in the United States.

Refund rules We did not read your bank's terms. Whether and how fast you are refunded depends on the card, the country and the bank.

Phone paths Wallet names change between versions. The steps name what we know and tell you to check your own screen.

A real fraud method; documented by security researchers Ghost tapping is real card fraud with a documented method. The risk is to the money on the card, and the fix is with the bank, not a removal tool.

Signs that a ghost tapping scam hit your card

The clearest sign is a tap payment you did not make, in a shop you did not visit, while your card is in your hand. The other signs come earlier and are easy to miss.

Who can meet a ghost tapping scam

Anyone with a bank card can be a victim, and anyone who runs a shop with a contactless terminal can be a place where it is spent. Scammers care the card data, not who you are.

Researchers describe the data as coming from broad campaigns, not from a person chosen one by one. Fake parcel texts, fake bank pages and fake tax or toll notices go to millions of phones, and a small of people type the card data in.

Older people and people in a hurry are common targets of the phone call version, but we have no study that shows who loses most, and we do not guess.

Shops have a different exposure. Recorded Future's report, as summarised by security news sites, says many shops cannot check who stands at the till, and that makes mule spending hard to spot. A shop can be hit by chargebacks when the card owner disputes the payment, even though the till did nothing wrong.

We found no official guidance written for shops in the pages we read, so the advice on this page for shops is limited to what is reasonable and is marked as our reading.

Ghost tap, ghost tapping and other names that mean something else

The words ghost tap or ghost tapping are used for the card scam on this page, but they are also used for a few other things, and some results mix them up.

A short timeline of what is reported

The public record is short and mostly written by security companies and news sites. We list what we read and give the date of each, so you can see how recent it is.

November 2024 ThreatFabric describes Ghost Tap ThreatFabric publishes Ghost Tap: new cash-out tactic with NFC relay. It describes stolen cards held in mobile wallets, two phones running NFCGate and a relay server, and helpers who tap at shops.

ThreatFabric describes Ghost Tap

ThreatFabric publishes Ghost Tap: new cash-out tactic with NFC relay. It describes stolen cards held in mobile wallets, two phones running NFCGate and a relay server, and helpers who tap at shops.

November 2024 News sites pick it up BleepingComputer and other sites report the research and link it to the earlier NGate malware.

News sites pick it up

BleepingComputer and other sites report the research and link it to the earlier NGate malware.

2025 Recorded Future reports spread in Southeast Asia Recorded Future's Insikt Group publishes a report that describes the method spreading across Southeast Asia, with police in Singapore recording incidents of card data phished and added to wallets.

Recorded Future reports spread in Southeast Asia

Recorded Future's Insikt Group publishes a report that describes the method spreading across Southeast Asia, with police in Singapore recording incidents of card data phished and added to wallets.

November 2025 Local warnings in the United States Local news in the United States, including a Cleveland station and a sheriff's warning in Tennessee, warns holiday shoppers ghost tapping with burner phones.

Local warnings in the United States

Local news in the United States, including a Cleveland station and a sheriff's warning in Tennessee, warns holiday shoppers ghost tapping with burner phones.

26 October 2026 This guide is written 2-spyware writes this guide after 1,300 people a month for a security answer the term. We found no newer major report in our five pages.

This guide is written

2-spyware writes this guide after 1,300 people a month for a security answer the term. We found no newer major report in our five pages.

What we do not know ghost tapping

Several things people ask are not settled in the public record. We list them so that you can judge what is fact and what is guess.

We do not know how many people lose money to ghost tapping in any one country. The reports we read describe the method, not a count we could check. We do not know how often relay is used compared with burner phones, because the sources describe both.

We do not know whether a given bank, wallet or card network has changed its rules since the 2024 report, because we did not find a statement from Apple, Google or a card network on the subject in the pages we read.

We also do not know whether a phone held near yours can be abused without your data having been stolen first. The sources we read describe stolen data as the start, and they say a locked phone does not hand out payment tokens. We call that our reading and not a guarantee. If new facts appear, this page will be updated and the date at the top will change.

How to remove ghost tapping scam

You cannot remove a ghost tapping scam from your phone, because the thief's wallet is on another phone.

You block the card with your bank, look at your own wallet and secure your accounts.

1 Step 1 : Call your bank first Use the number on the back of the card or in the bank's own app. Say you gave card details or a passcode to someone you do not trust, and ask the bank to block the card, remove it from all wallets and send a new one. This is the only step that cuts off a wallet on the thief's phone, so do it before everything else. Never use a number from a text or an e-mail.

Step 1 : Call your bank first

Use the number on the back of the card or in the bank's own app.

Say you gave card details or a passcode to someone you do not trust, and ask the bank to block the card, remove it from all wallets and send a new one.

This is the only step that cuts off a wallet on the thief's phone, so do it before everything else. Never use a number from a text or an e-mail.

2 Step 2 : Look at the cards in your own wallet on Android Open the Google Wallet app and look at the cards shown. To take one of your own cards out, tap the card, then More and Remove payment method , as a bank help page for Android describes; wording differs by app version, so check your own screen. Remember that a card a thief added is in a wallet on the thief's phone and will not be listed here, which is why the bank must remove it.

Step 2 : Look at the cards in your own wallet on Android

Open the Google Wallet app and look at the cards shown.

To take one of your own cards out, tap the card, then More and Remove payment method , as a bank help page for Android describes; wording differs by app version, so check your own screen.

Remember that a card a thief added is in a wallet on the thief's phone and will not be listed here, which is why the bank must remove it.

3 Step 3 : Look at the cards in your own wallet on iPhone Open the Wallet app and look at the cards shown. To remove a card of your own, tap the card, open its details with the more button and choose the option to remove the card; the exact wording depends on the iOS version, so follow what your screen shows. As on Android, a card in a thief's wallet does not appear on your phone, and only the bank can cancel it.

Step 3 : Look at the cards in your own wallet on iPhone

Open the Wallet app and look at the cards shown.

To remove a card of your own, tap the card, open its details with the more button and choose the option to remove the card; the exact wording depends on the iOS version, so follow what your screen shows.

As on Android, a card in a thief's wallet does not appear on your phone, and only the bank can cancel it.

4 Step 4 : Go through your statement and dispute charges Open the bank app and list every tap payment you do not know, with date, amount and shop. Dispute each one in the app or by form, so there is a written record to the phone call. Keep the case number the bank gives you. Check again for the few weeks, because a thief may try the card again before the block applies.

Step 4 : Go through your statement and dispute charges

Open the bank app and list every tap payment you do not know, with date, amount and shop. Dispute each one in the app or by form, so there is a written record to the phone call.

Keep the case number the bank gives you. Check again for the few weeks, because a thief may try the card again before the block applies.

5 Step 5 : Change passwords from a safe device Change the password of the bank login and of the e-mail account the bank uses. If a fake page asked for a login, change that password on every site where you used it. Turn on two step sign in where the bank and the e-mail provider offer it. Do this on a device you trust, not on a phone you think may carry a bad app.

Step 5 : Change passwords from a safe device

Change the password of the bank login and of the e-mail account the bank uses. If a fake page asked for a login, change that password on every site where you used it.

Turn on two step sign in where the bank and the e-mail provider offer it. Do this on a device you trust, not on a phone you think may carry a bad app.

6 Step 6 : Check the phone for apps you did not mean to install On Android open Google Play , tap your profile picture and Play Protect and run a scan. Settings for Install unknown apps and switch it off for the browser and messengers. On iPhone look at the app list and remove any app you do not know. A phone that carries a bad app can leak card data again, so do this even after the bank has acted.

Step 6 : Check the phone for apps you did not mean to install

On Android open Google Play , tap your profile picture and Play Protect and run a scan. Settings for Install unknown apps and switch it off for the browser and messengers.

On iPhone look at the app list and remove any app you do not know. A phone that carries a bad app can leak card data again, so do this even after the bank has acted.

7 Step 7 : Report the fraud Report the loss to the police or to your national fraud service and keep the reference. In the United States use IdentityTheft.gov of the FTC. Elsewhere find the official page of your own country. A report helps your dispute and helps investigators see the pattern behind the cases.

Step 7 : Report the fraud

Report the loss to the police or to your national fraud service and keep the reference. In the United States use IdentityTheft.gov of the FTC.

Elsewhere find the official page of your own country. A report helps your dispute and helps investigators see the pattern behind the cases.

8 Step 8 : Ignore removal tools that messages offer Nobody needs a ghost tapping remover. An app or page that sells one is using the name to sell you something, and some are scams themselves. The steps above are free. If a message after the fraud asks for a code, a fee or a remote access app to get your money back, it is a second scam, so close it and call the bank.

Step 8 : Ignore removal tools that messages offer

Nobody needs a ghost tapping remover. An app or page that sells one is using the name to sell you something, and some are scams themselves. The steps above are free.

If a message after the fraud asks for a code, a fee or a remote access app to get your money back, it is a second scam, so close it and call the bank.

After removal: passwords, accounts and prevention

What to do if you gave card details or a passcode away

Call the bank first. It is the only party that can see where your card is loaded and cancel it. Everything else on your phone comes after that call.

1 Call the number on the back of the card Use the number printed on the card or in the bank's own app, never a number from a text, an e-mail or the page that asked for your data. Say plainly that you gave card details and maybe a passcode to someone you do not trust.

Call the number on the back of the card

Use the number printed on the card or in the bank's own app, never a number from a text, an e-mail or the page that asked for your data. Say plainly that you gave card details and maybe a passcode to someone you do not trust.

2 Ask for three things Ask the bank to block the card, to remove the card from every mobile wallet, and to send a new card with a new number. Ask whether it sees any wallet added in the last days.

Ask the bank to block the card, to remove the card from every mobile wallet, and to send a new card with a new number. Ask whether it sees any wallet added in the last days.

3 Go through your statement Write down every payment you do not recognise with its date, amount and shop name. Small amounts count. Dispute each one, and follow the phone call with a message or a form so the dispute exists in writing.

Go through your statement

Write down every payment you do not recognise with its date, amount and shop name. Small amounts count. Dispute each one, and follow the phone call with a message or a form so the dispute exists in writing.

4 Change the passwords that matter Use a device you trust to change the passwords of your bank login and the e-mail account tied to it. If the fake page asked for a login too, change that password everywhere you reused it.

Change the passwords that matter

Use a device you trust to change the passwords of your bank login and the e-mail account tied to it. If the fake page asked for a login too, change that password everywhere you reused it.

5 Report it Report the fraud to the police or to your country's fraud service, and keep the case number. In the United States that is the FTC through IdentityTheft.gov. In other countries use your national centre. We did not read each country's page for this guide, so find the official address on your government site.

Report the fraud to the police or to your country's fraud service, and keep the case number. In the United States that is the FTC through IdentityTheft.gov. In other countries use your national centre. We did not read each country's page for this guide, so find the official address on your government site.

What a shop should do

A shop cannot see inside a wallet, but it can notice patterns and talk to its payment provider early. This part is our reading of what is sensible, not an official rule.

1 Tell your payment provider If several tap payments on one day are later reported as fraud, tell the provider that handles the terminal. It can see patterns that a single till cannot.

Tell your payment provider

If several tap payments on one day are later reported as fraud, tell the provider that handles the terminal. It can see patterns that a single till cannot.

2 Watch for odd behaviour at the till Be wary of a customer who pays for many small items, who holds more than one phone, or who pays several times with different phones in one visit.

Watch for odd behaviour at the till

Be wary of a customer who pays for many small items, who holds more than one phone, or who pays several times with different phones in one visit.

3 Keep records Keep the time, amount and camera footage of payments that are later disputed. A bank or the police will ask for them.

Keep the time, amount and camera footage of payments that are later disputed. A bank or the police will ask for them.

4 Do not accuse Most people with two phones are honest. Report the pattern and let the bank and the police decide.

Most people with two phones are honest. Report the pattern and let the bank and the police decide.

How to keep your card safe from ghost tapping

Treat every text, call or page that asks for your card number or a code as a scam until you have called the bank yourself.

Keep your phone locked with a PIN, fingerprint or face, so payment tokens are not released to a stranger.

Turn on the bank's alerts for every card payment and for every card added to a wallet.

Install apps only from the App Store or Google Play and keep Play Protect on, on Android.

Check your statement every week for small payments you do not know.

Read out or type a passcode that your bank texted you, for any reason a caller or a page gives.

Click a link in a text a parcel, a fine or a refund and enter card data on the page it opens.

Install an app because a message or a page told you it is needed to claim money or stop a payment.

Pay for a ghost tapping remover or a scanner offered by an ad or a message.

Call a number given by the person who contacted you.

Questions ghost tapping scam

What is a ghost tapping scam?

A ghost tapping scam is a way of spending money from a stolen bank card without the card. Criminals get your card details, add the card to a mobile wallet such as Apple Wallet or Google Wallet on a phone they control, and then pay at shop terminals with a tap.

In the version ThreatFabric described in November 2024, the tap is relayed over the internet to a helper phone in another place. The charges show up on your statement. Nothing has to be installed on your own phone for this to happen.

Is ghost tapping a virus on my phone?

Ghost tapping is not a virus on your phone, but it often starts with something that tricked you. The criminals need your card number and, usually, the one time passcode your bank texts you when a card is added to a wallet.

They get these from fake bank or delivery pages, fake texts and calls, or malware on a device. So the phone is not infected by ghost tapping itself, yet a fake page or app you used earlier may have given the data away. Treat the card as exposed and call the bank.

How does ghost tapping work?

Ghost tapping is described as a relay. The thief holds your card in a wallet on one phone and a helper stands at a shop till far away. The wallet signal is forwarded over the internet to the helper's phone, which then taps the terminal.

ThreatFabric named the open source tool NFCGate as the relay software in the cases it saw. Other reports say criminals sometimes load many stolen cards onto burner phones and tap them directly. Public sources differ on how often each version is used, and we found no figure we trust.

Can someone ghost tap my card or phone just by standing near me?

Usually not by someone walking past you. The scam described by ThreatFabric and Recorded Future uses card data that was already stolen, not a reader held against your pocket. A locked phone with a PIN, Face ID or fingerprint also does not release payment tokens to a terminal, according to the reports we read.

Anyone who tells you that a stranger can drain a card just by brushing past is describing a different, much rarer thing that we have not confirmed. The real risk is giving card details or a passcode to a stranger.

I gave my card details or a code to a scammer. What do I do first?

Call the bank on the number printed on the back of the card, or in the bank's own app, and say you gave card details to a person or page you do not trust. Ask it to block the card, remove it from every wallet and send a new one.

Then ask each charge you did not make. Do this before anything else, because the bank can cut off the stolen wallet entry and you cannot. Do not use a number from a text message or an e-mail.

Will I get my money back after a ghost tap?

Maybe, but the rules depend on the country, the card and how fast you report. In the United States, the general rule for credit cards is that liability for fraud you report is limited, and many issuers advertise zero liability.

Debit cards and other countries differ. We did not read the rules of your bank, so we cannot promise a refund. What helps in every country is the same:

dispute charges in writing as well as by phone

How can I tell whether my card was added to someone else's wallet?

Open the wallet app and look at the cards listed. A card that a thief added sits in a wallet on the thief's phone, not on yours, so you will not see it there and removing a card from your own wallet does not touch it.

Only your bank can see and cancel that token. Your clues are a bank text a card being added to a wallet, an unexpected passcode text, or tap payments in shops you never visited. If you see any of these, call the bank.

Do I need a ghost tapping remover or antivirus app?

No. Ghost tapping is a way of cashing out stolen card data, and the thing to fix is the card, not your phone. A tool or app that sells a ghost tapping remover is using the name to sell you something. What helps is free:

block the card through the bank

review your wallet and statements

change the passwords of your bank and e-mail accounts from a safe device

install only apps from the official stores

Run Play Protect on Android if you installed anything from outside the store.

What should a shop do ghost tapping?

Shops cannot always tell. The reports describe small test payments first and then larger ones, spread across places and mules, which makes each tap look like an ordinary mobile wallet payment. A shop that sees a wave of tap payments declined or later charged back should tell its payment provider and, where it exists, its fraud .

Staff should not accept a phone offered with a second phone being held to it, and a till clerk should not hand over goods after a payment the terminal flags. We found no official guidance for shops in the pages we read.

ThreatFabric: Ghost Tap, new cash-out tactic with NFC relay (November 2024) ( read October 26, 2026 )

BleepingComputer: New Ghost Tap attack abuses NFC mobile payments to steal money ( read October 26, 2026 )

Recorded Future Insikt Group: report on ghost tapping (2025) ( read October 26, 2026 )

TechRadar: experts warn scammers are loading stolen details onto burner phones in ghost tapping scams ( read October 26, 2026 )

Westpac NZ: how to remove a card from the Google Wallet app on Android ( read October 26, 2026 )