'Ghost tapping’ is on the rise — what Canadians need to know about this contactless payment scam

As contactless payments become an integral part of Canadian life, a troubling scam dubbed “ghost tapping” is exploiting the very convenience it promises.

Ghost tapping is a fraud method that targets the “tap-to-pay” feature found on cards and mobile wallets. It involves using near-field communication (NFC) technology, which enables a card or phone to exchange data with a payment terminal at very close range.

How does ghost tapping happen?

Unlike older scams that required a physical swipe or a tampered reader, ghost tapping can proceed without a card ever leaving its owner’s wallet or phone. According to the Better Business Bureau, scammers have several approaches (1):

• They may bump or brush past someone in a crowded location with a hidden reader, triggering a payment from the victim’s tap-enabled device
• They might pose as vendors, charity collectors, or door-to-door sellers and insist on tap payments — then charge far more than the buyer expects (2)
• In more sophisticated schemes, scammers trick victims into entering their card details into phishing apps or links, adding them to mobile wallets they control to make unauthorized tap-to-pay purchases without the physical card present (3)

Although most documented incidents to date are U.S.-based, Resecurity reports that the same NFC infrastructure and payment flow exists in Canada, making locals vulnerable (4).

Sponsored

Smart investing starts here

Build your own investment portfolio with CIBC Investor’s Edge online and mobile trading platform. Enjoy low commissions on trades and special pricing for active traders, students and young investors.

Get started today

The rising risk due to contactless payments

In Canada, contactless payments are rapidly becoming the dominant in-store method.

According to a report by Payments Canada, in 2023, contactless payments accounted for 63% of all in-store transactions — a 17% increase year-over-year (5). A separate study also found that, by 2023, contactless payments made up approximately 50% of card transactions in Canada (6).

The broad adoption of tap-to-pay means that any scam exploiting NFC, like ghost tapping, has a large base of potential victims.

Since many tap transactions don’t require a PIN and because fraudsters frequently test accounts with small charges before escalating, the scam can go unnoticed until a victim faces huge losses.

What should Canadians do now?

Canadians should remain vigilant for subtle red flags that may indicate ghost tapping.

A good tip is to be apprehensive of any vendor who insists you “just tap” without displaying the complete total or offering receipts. Another warning sign is spotting small or odd “test” charges on your account after being in crowded venues.

Here’s how to protect yourself:

• Use an RFID-blocking wallet or card sleeve: RFID-blocking wallets can help prevent scammers from wirelessly accessing payment data through NFC technology (7).

• Always verify merchant details before tapping: Check the merchant name and amount on the payment terminal before tapping, especially in flea markets or festivals, where counterfeit readers are more common and crowd sizes are large.

• Enable real-time transaction alerts: Banks like RBC, CIBC and TD allow you to set up instant push notifications for all card activity.

• Regularly review your statements: Check your transaction history regularly for small, unfamiliar charges that may indicate testing of stolen card credentials.

• Report and act fast if you’re a victim: If you suspect you’ve been a victim, contact your bank or card issuer to freeze or cancel the card. Then, report the incident to your financial institution or the Canadian Anti‑Fraud Centre (CAFC).

As tap-to-pay becomes more common, Canadians should stay alert and verify every transaction in their accounts. Don’t let the convenience of contactless payments become your downfall.

Article sources

We rely only on vetted sources and credible third-party reporting. For details, see our editorial ethics and guidelines.

Better Business Bureau (1); ABC (2); Techradar (3); Resecurity (4); Chase (5); Clearly Payments (6); GoWood (7)