Cybercriminals have developed “Ghost Tap,” a sophisticated method to exploit mobile payment systems like Apple Pay and Google Pay to carry out fraudulent transactions. Unlike previous methods such as NGate, Ghost Tap does not require the victim’s device or continuous interaction, making it harder to detect and track. The attack involves stealing payment card data, intercepting one-time passwords (OTP), and transmitting NFC (Near Field Communication) data to a global network of “money mules” for purchases at PoS (Point-of-Sale) terminals. Security researchers at Threat Fabric have reported an increase in the adoption of this technique, highlighting its scalability and obfuscation capabilities as significant challenges for financial institutions.

Technical Summary

Ghost Tap represents a sophisticated evolution of NFC-based fraud, allowing attackers to perform large-scale anonymous withdrawals using stolen credit card data linked to mobile payment services like Apple Pay and Google Pay. This method leverages NFC traffic relaying using tools like NFCGate, originally developed for research but repurposed for illicit ends.

The attack chain includes:

• Theft of payment card data and OTPs:
• Achieved via mobile malware using overlay attacks or keyloggers on victims’ devices.
• OTPs required for virtual wallet enrollment are intercepted via SMS monitoring or phishing techniques.
• Linking cards to attacker-controlled devices:
• Cards are linked to NFC-enabled devices under the attackers’ control without needing the victim’s physical device.
• NFC traffic transmission via intermediate servers:
• Cybercriminals establish an NFC relay between the attacker’s device (with the stolen card) and the money mules’ devices that interact with PoS terminals.
• Execution of large-scale withdrawals:
• Money mules, located in different geographic areas, make retail purchases using the transmitted card data, maintaining the attacker’s anonymity.
• Devices are often set to airplane mode to further obfuscate the origin and location of the fraudulent transactions.

Unlike previous tactics (e.g., NGate), Ghost Tap eliminates the need for continuous victim interaction or small-scale ATM withdrawals. Instead, it supports large-scale operations using distributed mule networks, making detection by anti-fraud mechanisms more difficult.

Detection Challenges:

• Transactions appear legitimate as they are linked to known cards.
• Payments are made in small amounts across multiple locations, bypassing threshold-based alerts.
• Rapid transactions in geographically distant locations make tracking difficult in the absence of mechanisms to detect impossible travel.

Recommendations

To counter the Ghost Tap tactic and similar NFC relaying-based frauds, it is essential to identify suspicious events in customer behavior. Financial institutions and app developers can strengthen their security posture by focusing on:

• Card linked to a new device: Identify and flag cases where a card is associated with a new device, especially if accompanied by indicators of mobile malware on the customer’s original device. This combination is a strong signal of potential fraud.
• Impossible travel times: Monitor transactions executed in geographically distant locations within a timeframe incompatible with physical travel. Such patterns can reveal fraudulent activity.
• Device metadata anomalies: Detect abnormal device states, such as airplane mode, which may indicate an attempt to mask the location of the device used for transactions.
• Transaction inconsistencies: Keep track of spikes in frequent small payments made by a single card, often in multiple locations, as they may be part of a large-scale withdrawal scheme.