A New Scam Targets Americans Who Use Tap-to-Pay

American consumers have adapted quickly to contactless payment options, especially as apps like Google Wallet and Apple Pay became accessible in the mid-2000s. Recent polls show that half of Americans use tap-to-pay technology, which is great for convenience but not necessarily for security. 

The Better Business Bureau issued a warning to consumers: If you use tap-to-pay, you need to watch out for contactless payment fraud.

How does tap-to-pay work?  

Tap-to-pay technology relies on near-field communication (NFC), which allows two devices to exchange data when they’re held close together, usually within a few inches. When you hold your phone or contactless card near a payment terminal, the NFC chip in your device communicates with the reader to complete the transaction. 

Not only does the process take no more than a few seconds, but it also eliminates the need to swipe a card or enter a PIN for most purchases.

What makes this technology appealing to consumers and vendors alike is that it’s designed to be more secure than traditional magnetic stripe cards. When you tap to pay, your actual card number isn’t transmitted. Instead, the system generates a one-time transaction code that can’t be reused, a process called tokenization. This means that even if someone intercepts the payment data, they can’t use it to make fraudulent purchases.

Despite these security features, the convenience of tap-to-pay creates new vulnerabilities that scammers have learned to exploit. The same technology that makes quick payments possible can also make quick theft possible when criminals get creative.

How can cybercriminals take advantage of contactless payment options? 

According to the warning from the BBB, contactless payment fraud targets both cards with tap-to-pay capabilities and mobile/digital wallets. 

They explain that traditional point-of-sale scams required the bad actor to gain physical contact with the card (or use a device that made contact with the card). However, today, a trickster might be able to gain access to proximity to your card or device without your knowledge. 

For example, a scammer could target a victim and bump into them, secretly charging their tap-enabled card or wallet with a point-of-sale device. This is called “ghost tapping,” and it is dependent upon the “tap” going unnoticed. Fortunately for targets (and unfortunately for the scammers!), it can be quite a challenge to get close enough to a victim to effectively trigger a transaction. 

That’s why scammers try different methods, like getting you to consent to a transaction, but changing the amount. 

Here’s a potential scenario: Imagine that you encounter a charity booth at a festival or an outdoor shopping event. It’s an organization that you care about, and so you make a donation–especially because they make it easy by allowing you to tap-to-donate! 

What you’re not counting on is that the charity is fake, or the representatives are not actually from the established charity they’re representing. If you’re not paying attention, that small donation that you think you made can be quickly “revised” to be a lot more than you realized! 

Charity scammers are savvy, but they are not the only ones who will try this. Watch out for fake vendors at all kinds of places, including: 

• Festivals
• Flea markets
• Vendor fairs
• Food trucks
• Pop-up shops 
• Temporary kiosks
• Parking lot attendants 
• Tourist attractions
• Bars and nightclubs

5 Steps to protect yourself from tap-to-pay scams 

These scammers are counting on certain predictable human behaviors: being busy and distracted. Your best defense is to be alert, but you can take additional steps to protect yourself, including these five simple steps. 

1. Enable transaction notifications on your phone. Set up instant alerts for every purchase made through your digital wallet or linked card. This way, you’ll know immediately if an unauthorized charge goes through, allowing you to dispute it quickly and potentially catch a scammer in the act.

2. Use RFID-blocking wallets or card sleeves. These affordable accessories contain special material that blocks the radio frequency signals used in contactless payments. When your cards are stored in an RFID-blocking wallet, scammers can’t activate them through “ghost tapping,” even if they get physically close to you.

3. Watch the payment terminal screen before you tap. Always verify the amount displayed on the reader matches what you agreed to pay. Don’t let vendors rush you, and never tap your card or phone until you’ve confirmed the correct dollar amount. If someone tries to hurry you through the transaction, that’s a red flag.

4. Verify charities and vendors before donating or purchasing. Take a moment to research unfamiliar organizations, especially at temporary events. Look up official charity websites, ask for credentials, or use your phone to verify the organization is legitimate before making any contactless payment.

5. Keep your contactless payment methods in interior pockets or bags. Avoid storing tap-enabled cards in easily accessible places like back pockets or outer jacket pockets, especially in crowded areas. The harder it is for someone to get close to your payment methods, the less vulnerable you are to proximity-based scams.

Frequently Asked Questions about tap-to-pay fraud

What should I do if I become a victim of tap-to-pay fraud?

As soon as you realize that you have been the victim of tap-to-pay fraud, act quickly. Contact your bank or card issuer immediately to report the fraudulent charge and request a freeze on your card. Most financial institutions have 24/7 fraud hotlines. 

After reporting the fraud, your bank can instruct you on how to dispute the charge in writing. You’ll want to keep records of all communications. You should also file a report with the Federal Trade Commission at IdentityTheft.gov. You may consider filing a police report, especially if the amount is significant. Under federal law, your liability for unauthorized charges is limited to $50 if you report within two days, and zero if you report a lost or stolen card before any charges occur.

Are digital wallets safer than tap-to-pay cards?

Generally, yes. Digital wallets like Apple Pay and Google Pay offer additional security layers that physical tap-to-pay cards don’t have. These include biometric authentication (fingerprint or face recognition) before each transaction, device-specific encryption, and the ability to remotely disable the wallet if your phone is lost or stolen. 

However, physical contactless cards can be tapped without any additional verification, making them more vulnerable to ghost tapping scams. Both methods can be exploited if you’re tricked into authorizing a fraudulent transaction.

Can scammers drain my entire bank account through tap-to-pay?

It’s unlikely, but not impossible. Most tap-to-pay transactions have limits—typically $100-$250 per transaction without requiring a PIN or signature. However, a scammer could potentially make multiple small transactions quickly, or they might encounter a vendor with higher limits. This is why transaction notifications are so important: They alert you to unauthorized charges before they accumulate.

Will my bank refund fraudulent tap-to-pay charges?

In most cases, yes, your bank will refund fraudulent charges. That’s because federal law protects consumers from unauthorized electronic transactions, and most banks have zero-liability policies for fraud. However, you need to report the fraud promptly. (Ideally, within two days of discovering it.) If you authorized a transaction but were deceived about the amount (like the fake charity scenario), the situation becomes more complex, though banks will often work with you if you can demonstrate that fraud occurred.

Do I need to turn off tap-to-pay on my cards and phone?

To have 100% protection from the risk of ghost tapping and tap-to-pay fraud, you should turn off this feature on your phone and avoid carrying an NFC-enabled card. However, we don’t think it’s necessary if you are comfortable with some managed risk.

Although you can disable NFC on your phone or request non-contactless cards from your bank, these measures may be overly cautious for most people. Instead, focus on the protective measures outlined in this article: use RFID-blocking protection, enable notifications, verify amounts before tapping, and stay alert in crowded spaces. The convenience of tap-to-pay is valuable when used wisely.