Ghost Tap and NFC Relay: The New Face of Contactless Fraud

Near-field communication is called near-field for a reason: contactless payments were designed to work only within a few centimeters, and that tiny range was itself a security feature. Ghost Tap breaks that assumption. By relaying NFC traffic over the internet between two phones, criminals have stretched near-field to intercontinental, letting a card provisioned in one country be tapped at a store terminal in another. First detailed by security researchers (ThreatFabric coined Ghost Tap; Group-IB documented the Chinese-language Fraud-as-a-Service operation behind it in early 2026), NFC relay fraud is the cash-out stage of a chain that starts with the wallet provisioning fraud we covered earlier this month. It is worth understanding precisely, because it overturns some comfortable intuitions about why tap-to-pay was safe.

Quick answer: Ghost Tap is a form of NFC relay fraud. Criminals load stolen card details into a mobile wallet (usually by defeating provisioning verification), then use relay software on two phones linked by a server to transmit the wallet’s tap-to-pay signal from the attacker’s device to a money mule’s phone, which taps a real point-of-sale terminal anywhere in the world. Because the transaction uses a genuine provisioned token, it looks like a normal in-person tap. The main defense is timing-based relay detection, backed by stopping the provisioning step that feeds it.

How does an NFC relay attack work?

A relay attack is conceptually simple: extend a short-range radio link over a long-range network so the two ends think they are close together. Applied to contactless payments, the chain runs:

1. Card compromise and provisioning: stolen card details are enrolled into a mobile wallet on an attacker-controlled device, defeating the issuer’s verification, the provisioning fraud that is the essential precondition. Some variants instead relay directly from a victim’s malware-infected phone.
2. Relay setup: both the device holding the provisioned token and a money mule’s device run relay software (publicly available tools like NFCGate have been abused for this), connected through a relay server.
3. The ghost tap: the mule holds their phone to a genuine store terminal; the terminal’s NFC request is relayed over the internet to the device with the token, the token responds with a valid payment cryptogram, and the response is relayed back. The terminal sees a normal contactless payment.
4. Cash-out at scale: mule networks across multiple countries tap terminals using tokens relayed from a central store of compromised cards, turning stolen numbers into goods and cash rapidly, with cases reported across Asia-Pacific, Europe, and the US.

Why don’t EMV and tokenization stop it?

This is the uncomfortable part. The cryptographic protections that make contactless payments secure are all working correctly during a Ghost Tap; they are just being relayed. The payment token is genuine, the cryptogram is valid, the EMV-grade cryptography is intact. Nothing is forged. What the attack defeats is not the cryptography but an unstated assumption baked into it: that the card and the terminal are physically in the same place. Relay removes proximity while preserving every cryptographic guarantee, which is exactly why the fraudulent transaction looks legitimate to the terminal, the acquirer, and often the issuer. The same lesson appeared in our adversary-in-the-middle analysis: when the secret itself is sound, attackers stop breaking it and start relaying it. Ghost Tap is AiTM applied to the radio layer of payments.

What actually detects and stops it?

Because the transaction is cryptographically valid, defense shifts to the physics and the behavior around it:

• Timing analysis: the single most cited control. A genuine local tap completes in a predictable few milliseconds; relaying the exchange over the internet adds measurable latency. Issuers and networks analyzing the timing of the contactless exchange can flag the delay that betrays a relay, which is why NFC specifications include timing constraints and why issuers are investing in relay-aware detection.
• Behavioral and geographic signals: a card that never used contactless suddenly tapping overseas at odd hours from a newly provisioned wallet matches the pattern precisely. These are the same fraud model signals that catch other anomalies: impossible geography, new-token velocity, device-card mismatch.
• Stopping provisioning upstream: the cheapest place to break the chain is before it starts. Robust wallet-enrollment verification that resists OTP relay denies the attacker the provisioned token the whole scheme depends on, which is why the provisioning defenses from this month’s companion article are the strategic fix rather than a tactical one.
• Device-side malware defense: for the variants that relay from a victim’s own infected phone, the mobile hygiene and attestation controls in our mobile payment security guide and banking-malware awareness reduce the foothold.
• Monitoring the markets: the compromised cards feeding these operations surface in the channels our dark web monitoring guide tracks, giving issuers early warning.

What should each party do?

• Issuers: harden provisioning verification, deploy relay-aware timing and behavioral detection, constrain freshly provisioned tokens with velocity and geography limits, and alert cardholders on enrollment and first use.
• Merchants and acquirers: standard acceptance rules keep merchants largely protected on these transactions, but acquirers monitoring for mule-pattern activity (repeated odd-hour contactless taps across many cards at the same locations) can help disrupt cash-out.
• Cardholders: the defenses are familiar, because the attack begins with provisioning: never share verification codes, act on wallet-enrollment alerts immediately, avoid installing apps from outside official stores, and treat any request to tap your physical card on a phone app with suspicion.

Frequently asked questions

Is my contactless card safe from Ghost Tap?

Your physical card tapping at a normal terminal is safe. Ghost Tap mostly relies on your card details being stolen and provisioned into an attacker’s wallet first, so the real exposure is the provisioning step and card-data theft, not tapping to pay in a store.

Does Ghost Tap mean tap-to-pay is broken?

No. The cryptography works perfectly during the attack; relay simply removes the assumption that card and terminal are physically together. Tap-to-pay remains more secure than magnetic stripe or keyed entry; the fix is detecting relay, not abandoning contactless.

How is Ghost Tap different from ordinary NFC relay?

Ghost Tap focuses on mobile wallets: stolen credentials are provisioned into a wallet, then the wallet token is relayed to a mule’s phone. Classic relay intercepts a physical card’s signal directly. The wallet focus is what makes Ghost Tap scalable across countries.

What is the best single defense?

Timing-based relay detection catches the attack in progress, but stopping fraudulent wallet provisioning upstream prevents the attacker from ever getting the token to relay. The strongest programs do both, with provisioning hardening as the strategic priority.

Who bears the loss?

Generally the issuer under network rules for fraudulent wallet transactions, which is why issuers are investing heavily in provisioning and relay detection. Merchants following standard acceptance rules are usually protected on these transactions.

Ghost Tap is proof that attackers have stopped trying to break payment cryptography and started relaying it intact. Near-field was a security boundary; the internet erased it. The answer is not stronger crypto but detecting the one thing relay cannot hide, the time it takes to travel, and closing the provisioning door that lets the attack begin.