A Chicago woman stopped to hear a stranger's story outside Target — then $5,000 vanished from her account

shutterstock.com / sergey kolesnikov

Maybe you want to donate to a good cause or support a local vendor. But beware — it might be an attempt at ghost tapping.

Emilie Kostecka was approached by three men in the Logan Square neighborhood of Chicago, just outside a Target store. They were carrying a hefty binder with photos of a boy they said was the victim of gun violence and were asking for donations.

Must Read

One of the men offered to hold her phone while she flipped through the binder. Even though she didn’t make a donation, a $5,000 charge appeared on her account shortly afterward for carpentry services.

She’d been scammed. “It can happen truly to anyone,” Kostecka told NBC 5 (1)Responds (1).

And it’s happening more often. Some victims of tap-to-pay donation requests in the Chicago area have been scammed out of nearly $5,000 each — and it’s taken months to get a refund from their bank, according to CBS Chicago (2).

While Kostecka eventually got her money back, it wasn’t without effort on her part. She filed a police report and opened a fraud dispute with Chase Bank, which at first reportedly said she was responsible for the transaction. After reopening the case, they refunded her the $5,000.

How ghost tapping scams work

This is a type of scam called ghost tapping, which exploits contactless payment technology through tap-to-pay cards and mobile wallets on phones that use Near Field Communication (NFC) technology.

“Unlike previous debit and credit card scams, which required physical contact with the card, contactless payment fraud eliminates this need,” warns the Better Business Bureau (3) (BBB).

There are several ways that fraudsters can execute this scam. For example, they could pose as a vendor at an event, market or festival, or they could pose as someone soliciting donations for a good cause. Don’t have cash? No worries, they’ve got a card reader.

They’ll ask you to make a tap payment and then rush you through the process, so you don’t confirm the business name or transaction amount. Then you end up with a higher charge on your card than you agreed to.

Or, they might claim your card didn’t go through — or offer to hold your phone, like with Kostecka — but then use it for a fraudulent transaction.

Story Continues

But fraudsters can also execute this scam without ever touching your card or phone. They could “accidentally” bump into you and press against your purse or bag — often choosing a crowded spot like a market or festival — to then trigger a charge on your tap-enabled card or mobile wallet.

This is easy enough to do nowadays, since scammers can install a point-of-sale (POS) app directly on their phone. “It’s almost like a modern-day pickpocket move, where the bump distracts the victim from the theft as it happens,” according to (4)McAfee (4), which offers AI-powered antivirus and identity theft and privacy solutions.

Read More: About 1 in 5 Americans over 50 has zero retirement savings — here’s the catch-up plan you can actually use

How to protect yourself from ghost tapping

Fortunately, it’s not always easy for scammers to pull this off — especially if you’re vigilant. For example, your phone or card needs to be within one or two inches of a POS contactless symbol in order to initiate a transaction (5).

“Attackers can’t drain accounts from far away, clone full cards via a tap, or bypass wallet protections easily,” according to McAfee. “Most successful cases hinge on proximity, distraction, and human error.”

If you’re making a purchase on a card reader, check the screen for the vendor’s name and transaction amount. If the vendor is rushing you, or asks to take your phone or card to do the transaction for you, it may be prudent to walk away.

The BBB also recommends using an RFID-blocking sleeve or wallet to protect against wireless skimming, as well as limiting tap-to-pay in crowded areas: “When in doubt, consider swiping or inserting your card instead.”

On your phone, you can turn off tap-to-pay when you’re not using it. With Apple Pay, ensure that Face ID or Touch ID is enabled, which means your mobile wallet requires authentication before making a transaction.

Credit cards also offer an additional layer of protection over debit cards. The Fair Credit Billing Act (FCBA) means you’re only liable for unauthorized charges up to $50, though some credit card issuers offer zero-liability fraud protection (6) if the fraud is reported immediately.

Regularly check your bank and credit card statements for unauthorized charges, especially if someone “accidentally” bumped into you in a crowded place. In some cases, scammers might make a series of small charges to your account to avoid triggering fraud detection systems — and they’re hoping you won’t notice it right away.

Many banks and credit card issuers allow you to set up alerts whenever a transaction goes through, which can help you quickly detect unauthorized activity.

If you think you’ve been the victim of fraud, contact your bank or credit card company right away and file a report with local police.