Your credit card never leaves your pocket… but somehow, your money does.
It’s called Ghost Tapping. A proximity-based scam that uses the same tap-to-pay technology you see at legitimate businesses every day, to steal from you.
Using cheap, easy-to-buy card readers, thieves can trigger small wireless transactions just by getting close enough to your wallet or phone. No swipe. No PIN. No warning.
The scam relies on proximity and crowded spaces like transit, concerts or busy sidewalks, where victims may never realize a charge is happening in real time.
“It’s a growing problem,” said Ben Spradling with the Better Business Bureau. “When you think about how convenient and how commonplace this payment is, it’s just a matter of time before somebody wants to take advantage of that.
Insights from cybersecurity firm, GuidePoint Security, show a 150% surge in ghost tap related claims over the past year.
And because the transactions are often small, they can slip by unnoticed until it’s too late.
“A lot of these transactions are very small numbers just to test to see if that transaction goes through,” said James Chatwani a cybersecurity advisor for GuidePoint Security. “Then what attackers are doing is adding that to their digital wallets and essentially buying gift cards and doing other types of scams to make a quick transaction out of it, but to take as many dollars as it can in the shortest period of time possible.”
Chatwani said, if you have a card with a chip or a smart phone (items with NFC, or Near-Field-Communication technology) – you are at risk.
“I don’t have online baking or anything, so from the very beginning, I was hyper-visualized. It still happened to me,” said Carly Sargent.
Sargent tells she was shopping at a Trader Joes in Everett when the emergency credit card in her wallet was charged.
The card was scanned through layers or other cards, cash, and coins.
“Very violated. Yeah. Going into my clothes without my permission and taking a card of their choice,” Sargent said.
The BBB tells it’s not surprising that we are seeing a spike in these NFC tech-related scams in a world of smart phones and EMV cards (cards with chips).
“It’s not surprising at all and it’s an opportunity for us as consumers, as people who use these devices, to really be aware of those possibilities so that we can take the precautions to safeguard ourselves,” Spradling said. “We kind of are left playing defense right now.”
The best defense? Prevention.
Physical Wallet Protection Experiment: Which Safety Items Work?
purchased four common items that claim to protect your physical wallet by blocking RFID (Radio-Frequency Identification) signals – to see what works, and what’s a waste of money.
For our experiment we bought a contactless payment device, like the ones used by small businesses (and now scammers) and tested the protection item on both a plastic credit card and a metal credit card.
First: RFID Blocking Card
Price: $1 per piece
The RFID blocking card is supposed to offer protection to your entire wallet just by placing it inside.
It did not work. Our scanner was able to charge the card directly behind it inside the wallet.
Second: RFID Blocking Sleeve
Price: 20¢ per piece
The RFID blocking sleeve was the cheapest option we purchased. One card fits inside each sleeve, so you would need one for each item in your wallet.
The sleeve worked for both the plastic and metal card – but was slightly inconvenient considering the consumer has to take the card out every time they use it, and put it back in after.
Third: Faraday Pouch
Price: $6
The Faraday pouch is intended to protect both your phone and your physical payment cards.
All items go in, and no signal goes out.
It worked very well, however, cell phone service is also blocked out so the phone no longer receives calls or texts while inside.
Fourth: RFID Blocking Wallet/Phone Case Combo
Price: $20
The wallet/phone case combo was the most expensive item purchased. It does not promise protection for your mobile wallet, only the physical cards you put inside.
The wallet feature worked, our cards could not be charged while inside.
TAKE AWAYS:
For convenience, go for the case.
For cost, go for the sleeves.
Mobile Wallet Protection Advice:
Now that your physical wallet is covered, let’s talk about your mobile one.
Spradling said the safest way to protect yourself is to limit NFC capabilities on your phone.
“It’s a little tedious, but it’s going to save you a lot of headaches in the long run. You can turn your phone off if you want to, if you’re at an event and you want to be in the moment. You can make sure that you’re in the safest position possible that way. But any time you have that NFC capability enabled, you are susceptible,” said Spradling.
Both Apple and Android devices have built-in protections that require you to approve charges, so the risk is already lower, especially if your device is locked.
Both BBB and our cybersecurity exp…
chia sẽ trên Twitter: Ghost tapping The scam charging your card without you knowing
