‘It can happen truly to anyone’: Chicago woman stopped to listen to a stranger’s story — then scammers stole $5,000 through a tap-to-pay scheme

One of the men offered to hold her phone while she flipped through the binder. Even though she didn’t make a donation, a $5,000 charge appeared on her account shortly afterward for carpentry services.

She’d been scammed. “It can happen truly to anyone,” Kostecka told NBC 5 Responds.

And it’s happening more often. Some victims of tap-to-pay donation requests in the Chicago area have been scammed out of nearly $5,000 each — and it’s taken months to get a refund from their bank, according to CBS Chicago.

While Kostecka eventually got her money back, it wasn’t without effort on her part. She filed a police report and opened a fraud dispute with Chase Bank, which at first reportedly said she was responsible for the transaction. After reopening the case, they refunded her the $5,000.

How ghost tapping scams work

This is a type of scam called ghost tapping, which exploits contactless payment technology through tap-to-pay cards and mobile wallets on phones that use Near Field Communication (NFC) technology.

“Unlike previous debit and credit card scams, which required physical contact with the card, contactless payment fraud eliminates this need,” warns the Better Business Bureau (BBB).

There are several ways that fraudsters can execute this scam. For example, they could pose as a vendor at an event, market or festival, or they could pose as someone soliciting donations for a good cause. Don’t have cash? No worries, they’ve got a card reader.

They’ll ask you to make a tap payment and then rush you through the process, so you don’t confirm the business name or transaction amount. Then you end up with a higher charge on your card than you agreed to.

Or, they might claim your card didn’t go through — or offer to hold your phone, like with Kostecka — but then use it for a fraudulent transaction.

But fraudsters can also execute this scam without ever touching your card or phone. They could “accidentally” bump into you and press against your purse or bag — often choosing a crowded spot like a market or festival — to then trigger a charge on your tap-enabled card or mobile wallet.

This is easy enough to do nowadays, since scammers can install a point-of-sale (POS) app directly on their phone. “It’s almost like a modern-day pickpocket move, where the bump distracts the victim from the theft as it happens,” according to McAfee, which offers AI-powered antivirus and identity theft and privacy solutions.

How to protect yourself from ghost tapping

Fortunately, it’s not always easy for scammers to pull this off — especially if you’re vigilant. For example, your phone or card needs to be within one or two inches of a POS contactless symbol in order to initiate a transaction.

“Attackers can’t drain accounts from far away, clone full cards via a tap, or bypass wallet protections easily,” according to McAfee. “Most successful cases hinge on proximity, distraction, and human error.”

If you’re making a purchase on a card reader, check the screen for the vendor’s name and transaction amount. If the vendor is rushing you, or asks to take your phone or card to do the transaction for you, it may be prudent to walk away.

The BBB also recommends using an RFID-blocking sleeve or wallet to protect against wireless skimming, as well as limiting tap-to-pay in crowded areas: “When in doubt, consider swiping or inserting your card instead.”