Ghost Tapping Scam Exploits NFC Payments to Steal Funds

• •Ghost Tap allows criminals to exploit stolen card data via NFC payments.
• •The attack does not require the victim's device or card, making it harder to detect.
• •ThreatFabric reports a rise in this scam, especially in Southeast Asia since 2020.

Cybercriminals are employing a new tactic known as 'Ghost Tap' to exploit stolen credit card details linked to mobile payment systems like Apple Pay and Google Pay. This method allows attackers to load stolen card data onto burner phones, which are then used to make purchases at retail locations without the physical card. The attack involves stealing card data through phishing or malware and intercepting one-time passwords (OTPs) necessary for wallet enrollment. ThreatFabric, a mobile security firm, has observed a rise in this tactic, particularly in Southeast Asia since 2020. The scam is characterized by its ability to bypass security measures without needing the victim's device or continuous interaction. Experts warn that this method is more sophisticated and harder to detect than previous mobile malware attacks. There are no specific CVEs associated with this scam, and it does not involve direct hacking of victims' devices.