Ghost Tapping Scams: What They Are, how to Stay Safe, and how IDShield Can Help You

You tap your phone or card to pay for coffee. It's fast, easy, and you don't even have to swipe. But what if a scammer could steal your money the same way without you ever knowing? That's exactly what ghost tapping scams do. And they're growing fast.

According to the Federal Trade Commission (FTC), Americans lost more than $15.9 billion to fraud in 2025. In a March 2026 hearing, consumers submitted 3 million fraud reports to the Consumer Sentinel Network. Ghost tapping is one of the newest tools scammers are using to add to those numbers. We’ve laid out the basics that you need to know, so you can protect yourself from these tricks.

What is a ghost tapping scam?

A ghost tapping scam is a type of theft that uses the same wireless technology as your tap-to-pay card or phone. That technology is called Near Field Communication, or NFC. NFC lets two devices share information when they are very close together — usually within an inch or two.

When you tap your card or phone at a store, your payment information travels wirelessly to the payment machine. Ghost tapping scammers find ways to grab that signal or trick you into sending it to them instead. The theft can happen without the scammer ever touching your wallet or phone.

The Better Business Bureau (BBB) warns that contactless payment fraud — the broad category that includes ghost tapping — is one of the fastest-growing scams targeting everyday consumers. Ghost tapping is especially sneaky because the transactions can look completely normal to your bank, making them hard to catch.

How do ghost tapping scams work?

There are a few different ways scammers pull off ghost tapping attacks. Understanding how they work can help you spot them before it's too late.

Physical ghost tapping in public places

In this version, a scammer carries a hidden NFC reader — a small device that can fit in a bag or even a pocket. They get close to you in a busy place, like a subway, a festival, a shopping mall, or a crowded bus stop. The device silently scans your tap-enabled card through your wallet, purse, or back pocket and tries to complete a payment.

The BBB has received real reports of this happening. In one case, a man went door to door claiming to sell chocolate for a good cause and asked people to pay by tapping their card to his device — but he charged them far more than they agreed to. One victim lost $537. Another lost $1,100. The man kept moving neighborhoods to avoid getting caught.

Fake vendor scams

Scammers sometimes set up fake booths or stands at events, flea markets, or pop-up shops. They look like real vendors. They might sell food, crafts, or tickets. When you tap your card to pay, they may charge you a much larger amount than the price shown, or even charge you multiple times. Because the machine looks convincing, victims don't realize anything is wrong until they check their bank account later.

Fake charity scams

This version is especially cruel. A scammer poses as a charity worker and asks for a small donation, maybe even as small as $5 or $10. They hand you a payment device and ask you to tap. But behind the scenes, the device charges your card for a larger amount. Sometimes the excess amount is small, like a few dollars more, so you don’t notice it right away. Other times the amount is much higher, adding extra numbers to the amount you intended to donate. Since you meant to donate, you may not check your receipt closely or question the charge right away.

Digital ghost tapping through malware

This is the most advanced version of the scam. It starts with a fake text message or phone call. The scammer pretends to be your bank or a trusted company and tells you there's a problem with your account. They ask you to download an app or click a link to "fix" the problem.

That app is actually malware — harmful software that secretly copies your card information. Once the scammer has your card data, they load it onto their own phone or device and use it to make tap-to-pay purchases anywhere in the world. These digital ghost tapping tools are even sold online to other criminals, making the threat much bigger than any one bad actor.

Real-life scenarios to watch for

Knowing what a ghost tapping scam looks like in real life makes it easier to avoid. Here are a few example situations where it could happen.

Crowded public transportation. You're riding a busy subway or bus to work. Someone bumps into you and says sorry. It feels like a normal accident. But that person had a hidden NFC reader in their bag. In the split second they were near you, the device tried to charge your tap-enabled card through your jeans pocket or purse.

A fake fundraiser. Someone in a shopping center parking lot approaches you with a tablet and says they're raising money for a local school. They ask you to tap your phone to donate $10. But the device charges you $150. By the time you get home and check your bank app, the person is long gone.

Urgent “bank” texts. You get a text that looks like it's from your bank. It says your account is locked and you need to download an app to verify your information. You download the app and tap your card as it instructs. But the app was fake. Your card information is now in the hands of a criminal who uses it to go shopping across town, or even in another country.

A sales booth. You're at a local fair and stop at a booth selling homemade goods. The seller has a tap-to-pay machine. You tap your card for a $12 purchase. But over the next two days, your bank shows three charges of $48, $75, and $120 to an unfamiliar merchant. The booth was not what it seemed.

Warning signs of a ghost tapping scam

The BBB recommends watching for these red flags:

• You may notice a small, unexpected charge you don't recognize. Small "test" charges are a common sign that scammers are checking whether a stolen card number works before making bigger purchases.
• Someone asks you to tap your card without showing you the total amount or giving you a receipt.
• You notice suspicious charges on your account after spending time in a crowded public place like a market, festival, or transit station.
• You receive a text or email asking you to download an app or click a link to fix a banking problem.

Steps you can take to protect yourself

You don't have to stop using tap-to-pay entirely. But you can take smart steps to make it much harder for scammers to steal from you.

Use an RFID-blocking wallet or card sleeve. These special wallets and sleeves block the wireless signal from your tap-enabled cards when you're not using them. A scammer's hidden reader can't pick up your card information if the signal is blocked.

Always check the amount before you tap. Before you tap your card or phone, look at the screen on the payment machine. Make sure the amount shown is what you agreed to pay. Never tap on a device that doesn't show a total.

Turn on transaction alerts with your bank. Most banks let you set up real-time text or email alerts for every purchase. If a charge shows up that you didn't make, you'll know right away.

Review your bank statements often. Don't wait until the end of the month to check your account. A quick daily or every-few-days check helps you catch fraud fast — before it grows.

Be careful about where you tap. In very crowded places or if attending an event with temporary vendors, consider using a different payment method. Avoid using your debit card so that scammers cannot directly access your bank account or pay cash if you feel unsure.  

Never download apps from links in texts or emails. If someone texts or emails you saying your bank account needs attention, do not click any links. Instead, go directly to your bank's official website or call the number on the back of your card.

Only tap at trusted, official payment terminals. If a vendor's payment device looks unusual, broken, or different from what you'd expect, trust your gut and pay another way.

Keep your phone's operating system and apps up to date. Software updates often fix security weaknesses that scammers try to exploit.

Review the payment in real time. If you receive a receipt or text message after tap to pay, review it right away for accuracy while you are still in front of the vendor.  

How an IDShield® Membership helps keep members protected

Ghost tapping scams can be hard to spot in the moment. That's why having a layer of protection working for you around the clock makes a real difference. IDShield offers a set of features designed to help IDShield Members stay ahead of identity theft.

Credit monitoring and alerts

IDShield monitors your credit files and sends you alerts when something changes, like a new account being opened in your name or a credit inquiry you didn't ask for.

Dark web monitoring

When scammers steal payment card information, they sometimes sell it on the dark web — hidden parts of the internet used for illegal activity. IDShield scans the dark web 24/7 for your personal information, including email addresses, Social Security numbers, and financial account details. If your information is found in a place it shouldn't be, IDShield lets you know.

Financial account monitoring

IDShield keeps a watchful eye on your financial accounts and notifies you of suspicious activity. This monitoring helps you catch strange charges early by setting up threshold account limits. This way, you know about suspicious missing dollars before small amounts turn into big losses.

Identity restoration services

What happens if, despite your best efforts, you do become a victim of identity theft? IDShield has you covered. Every IDShield Member has access to Licensed Private Investigators (LPI) who are dedicated to helping them through the recovery process. An LPI can work on your behalf to contact creditors, dispute fraudulent charges, file the right paperwork, and help restore your identity to where it was before the theft occurred. You don't have to figure it out alone.

Lost wallet protection

If your wallet goes missing — whether it's stolen or simply lost — IDShield's lost wallet protection service helps you cancel and replace your cards quickly. Speed matters after a loss like this, and IDShield helps you move fast.

ScamCheck from Trend Micro

ScamCheck from Trend Micro can look at suspicious messages, links, and screenshots to detect scams before you click on them. The AI has been trained to spot the warning signs of fraud that humans might miss. It also blocks suspicious phone numbers and text messages automatically.

Up to $5 million identity fraud protection

IDShield backs its recovery services with up to $5 million identity fraud protection. This identity fraud protection covers certain out-of-pocket expenses related to covered identity theft events.

You deserve to feel safe every time you pay

Ghost tapping scams are growing more common and more clever. But knowledge is your first line of defense. By understanding how these scams work, watching for warning signs, and taking simple protective steps, you can reduce your risk every day. And with IDShield in your corner, you have a powerful partner watching for threats around the clock — and ready to help if something goes wrong.

Identity theft can happen to anyone. But recovering from it doesn't have to be a nightmare. IDShield is here to help make sure of that.

IDShield is a trademark of Pre-Paid Legal Services, Inc. (“LegalShield”). LegalShield provides access to identity theft services through membership-based participation. IDShield is a product of LegalShield. Some of the services provided under the plan by third party providers are subject to change without notice. All Licensed Private Investigators are licensed in the state of Oklahoma. The information made available in this blog is meant to provide general information and is not intended to provide professional advice, render an opinion, or provide commendation as to a specific matter. The blog post is not a substitute for competent and professional advice. Information contained in the blog may be provided by authors who could be third-party paid contributors. All information by authors is accepted in good faith; however, LegalShield makes no representation or warranty of any kind, express or implied, regarding the accuracy, adequacy, validity, reliability, availability, or completeness of such information. The Identity Theft Insurance is underwritten and administered by American Bankers Insurance Company of Florida, an Assurant company. LegalShield is not an insurance carrier. Please refer to the actual policies for terms, conditions, and exclusions of coverage. Coverage may not be available in all jurisdictions.