Fraud Watch - June 2026
Emerging “Ghost Tap” Fraud Leveraging Stolen Mobile Devices
Summary:
“Ghost Tapping” - A rapidly evolving fraud scheme combining mobile device theft, account takeover, and advanced payment manipulation. Criminal networks are targeting consumers at large public venues (e.g., concerts, festivals, sporting events) to steal smartphones and exploit mobile wallet functionality for fraudulent transactions.
This emerging threat highlights the convergence of physical theft and advanced payment fraud. By exploiting trusted authentication methods such as mobile wallets, criminals are able to conduct fraudulent transactions that may appear legitimate.
How the Scheme Works:
Targeting and Theft: Criminals identify individuals using mobile wallets in crowded environments. The victims’ device passcodes are observed or recorded while making purchases or unlocking the device. The device is then stolen.
Account Takeover: Using the passcode, fraudsters quickly reset the device’s account credentials (e.g., Apple ID), locking out the account owner. The fraudster then has full access to the mobile wallet and other sensitive applications.
Device Trafficking and Monetization: Stolen devices are often shipped in bulk to organized fraud operations overseas. The devices are maintained in “phone farms” with active digital wallets.
“Ghost Tap” (EMV Relay) Fraud: Fraudsters remotely relay payment credentials from stolen devices to a separate device at a POS terminal. The transactions appear as legitimate contactless payments and therefore bypass traditional fraud controls.
Best Practices
Use biometric authentication where available.
Immediately report lost or stolen devices. Cancel or reports your cards immediately.
Resources
The information presented in this email is intended for informational purposes only and should not be construed as legal advice or a legal opinion and it may not reflect the most current legal developments. You should seek the advice of legal counsel of your choice before acting on any information provided in this blog.