“Ghost Tap” is a reported label for NFC relay fraud: a mule can make a contactless payment at a local terminal using card data or wallet credentials supplied through a separate device, potentially far away. NFC itself still works over a short range; the relay connects the terminal-side device to the credential source. The name covers related but distinct methods, not one universal attack sequence.
What is a Ghost Tap scam?
ThreatFabric uses “Ghost Tap” for a cash-out tactic involving stolen card details linked to Apple Pay or Google Pay and relayed NFC traffic. Recorded Future uses “ghost-tapping” more broadly for NFC relay fraud in which devices relay payment information from a victim’s card or phone to a payment terminal without the victim’s knowledge.
As an Amazon Associate I earn from qualifying purchases.
In the wallet-based version, a criminal can use a mule at a physical shop to turn access to payment credentials into goods that can be resold. The person presenting a device at the till need not be the person whose card credentials are being used.
Free tools Windows power users keep installed
One-click scans. No signup required.
How does an NFC relay attack work?
The common idea is to connect two sides of a transaction: a device close to the payment terminal and a separate device or system that has access to payment data. The terminal still communicates with the nearby device over NFC. The relay carries the relevant traffic between that device and the credential source; it does not extend NFC’s own radio range.
#1 Best Overall
- RFID Protection: An electromagnetically opaque layer helps block unauthorized scans, protecting credit card, debit card, and passport information from nearby readers; This RFID blocking card helps prevent digital skimming by shielding your wallet from electronic theft
- Threats Stay Outside: Digital pickpockets use hidden readers to skim contactless cards in crowds, transit and checkout lines; This credit card protector works as an RFID blocker the moment it's placed in your purse or wallet, stopping electronic theft before it occurs
- Invisible Yet Active: Ultra-thin and sized to fit any wallet slot, this rfid blocking card adds no bulk; Invisible protection helps shield your debit cards and IDs from electronic skimming without changing the way you carry your wallet
- One Card Protects All: Forget slipping every card into a separate RFID sleeve, just one RFID blocking card protects every contactless card, passport, and license all at once; Carry it in a purse, travel pouch or cardholder and stay shielded at airports, transit hubs and during daily commutes
- Drop and Defend: Keep the RFID blocking card in your wallet or travel bag, or save it as a backup; Simply insert it alongside your credit and debit cards for immediate protection against identity theft — no charging, no setup
Reports describe several ways criminals obtain or emulate card data. The victim’s involvement, whether a wallet is used, and where the relay runs differ by method.
| Reported method | How credentials are obtained | Victim-side malware or physical card needed? | Wallet enrollment and emulation | Cash-out described |
|---|---|---|---|---|
| ThreatFabric’s Ghost Tap model | Phishing or mobile malware steals card details and an OTP needed to enroll a card in a mobile wallet. | The account describes credential theft and OTP capture; it does not establish that every operation requires malware on the victim’s phone. | The card is enrolled in Apple Pay or Google Pay on a criminal-controlled device, which relays NFC traffic to another device. | A mule uses the terminal-side device to buy goods that can be resold. |
| European Payments Council’s 2025 report variant | A caller or text message impersonates a security alert and persuades the victim to disclose a PIN and install an app; malware captures chip data when the card is brought near the phone. | Victim-side app installation and presentation of the physical card near the phone are part of this described sequence. | The report says captured data can be emulated for point-of-sale or ATM transactions; it does not describe wallet enrollment as a required step. | Unauthorized POS or ATM transactions are described; this account does not specify the same mule-and-resale sequence. |
| Group-IB’s TX-NFC pattern | Stolen card data is loaded into Android malware on the fraudster’s device. | Group-IB says the victim’s device can be clean and malware-free in this operation; the described flow does not require the victim to bring a physical card near a phone. | The malware emulates the card using Android Host Card Emulation at a POS. | The reported transactions are made at POS terminals; the account describes no required victim-side wallet enrollment. |
These are distinct reported flows, not steps to combine into one checklist. Recorded Future also describes wallet fraud that did not involve NFC relay, so mobile-wallet fraud and relay fraud are not interchangeable terms.
Rank #2
- Ultra-thin: This wallet measures 4.3 x 3 x 0.5 inches and can hold at least 11 cards and 15-20 bills. Even when it's packed full, it's only 0.8 inches thick,It can perfectly conceal itself in your pocket without any noticeable bulge.
- Rfid Blocking: Our wallets are equipped with German Instiute Certified RFID Security technology, a unique metal composite, engineered specifically to block 13.56 MHz or higher RFID signals to protect the valuable information and privac.
- Lifetime After-sales Service: Regardless of the circumstances, if any GSOIAX brand wallet has a quality issue during your use, we promise to provide a full, unconditional, refund within 24 hours!
- Durable Surface: Crafted from premium 3-layer leather, our wallets outperform 2-layer alternatives in durability. Specially treated leather exterior delivers enhanced scratch resistance to guard against minor scuffs from everyday items like keys and buttons.
- Perfect Gifts For Him: This Money Clips Wallets for men comes in classy gift box package. It's a good idea to send the mens wallets as the gifts in birthday，anniversaries, Fathers Day，Valentine's Day，Christmas and other special occasions to someone you love.
Can someone use my card through NFC from far away?
A remote criminal may be involved even though the terminal’s NFC exchange is local. In the ThreatFabric and Recorded Future descriptions, the terminal-side device can be used by a mule in the victim’s country while another device or credential source is elsewhere. ThreatFabric says the attacker can be far away, including in another country. That distance comes from the relay, not from NFC reaching farther.
This does not mean every unfamiliar contactless transaction is a relay attack. The cited reports describe particular methods and operations; they do not establish a universal sequence or a global prevalence rate.
Rank #3
- Slim and Thin Wallet - This minimalist bifold wallet measures 4.3x3.2x0.6 inches and stores up to 15 cards. The bifold wallet perfectly fits in your pocket and is well-suited for everyday carry
- Elite Features - 2 ID windows (DL & Other ID Cards) and 2 quick slots allow for quick access during travel, shopping or work. With 15 card slots and 2 more slots behind them, it is easy to carry all your important cards,cash and bills, meet all your daily needs
- RFID Blocking- Our wallets are equipped with advanced RFID SECURE Technology, a unique metal composite, engineered specifically to block 13.56 MHz or higher RFID signals and protect the valuable information stored on RFID chips from unauthorized scans.License and ID cards will be protected effectively. No more worrying about unauthorized scans during travel, shopping, or daily commuting!
- Durable Surface - Our leather wallets are pressed with high quality 3 layers leather, which is more durable than 2 layers leather wallets. The surface of the leather is made more scratch-resistant by special treatment, which can effectively prevent small scratches caused by keys and buttons in life
- Gifts for him - The thin wallet comes in classy gift packaging. It is a perfect present for birthdays, anniversaries, Father's Day, Valentine's Day, Christmas and other special occasions, so you can easily gift it to someone you love
What do the reported figures tell us?
Group-IB’s January 2026 TX-NFC reporting gives indicators of one criminal operation’s reach and activity. They are company-reported observations, not independently audited global totals.
- Group-IB documented more than $355,000 in illegitimate transactions from one POS vendor between November 2024 and August 2025. This is not a worldwide loss estimate.
- Group-IB reported more than 21,000 subscribers to a Telegram channel and more than 54 distinct APK variants.
- Group-IB reported advertised subscription prices ranging from $45 per day to $1,050 for three months. These are reported offers, not evidence of completed sales at those prices.
The European Payments Council calls NFC relay fraud a growing concern, but the cited passage does not provide a Ghost Tap-specific loss total. The available figures do not establish the total scale of losses across banks, countries, or payment networks.
Rank #4
- STYLISHLY SMALL, SLIM & DISCREET: Measuring just 3 1/8" x 4 7/16", our RFID front pocket wallet is designed to be super thin and exceptionally slim. Its modern, minimalist profile fits perfectly in your pocket, purse, or travel pack without adding bulk.
- SURPRISINGLY SPACIOUS: Though slim, it features 8 slots to easily organize your essentials. Comfortably holds your driver's license, credit cards, debit cards, and membership cards, keeping everything you need right at your fingertips.
- ADVANCED RFID BLOCKING: Our slim wallets for men and women are outfitted with advanced RFID SECURE Technology. They block electronic signals to keep your identity protected while you travel, shop, or explore, safeguarding you from digital theft.
- DURABLE & STYLISH FAUX LEATHER: Crafted from premium synthetic leather, this minimalist wallet sleeve combines a luxurious look and feel with everyday functionality. Its durable construction is designed to withstand the rigors of daily use, travel, and shopping.
- THE PERFECT UNISEX GIFT: With its sleek design and practical security features, this wallet is a popular choice for both men and women. It arrives ready for gifting, making it an ideal present for the frequent traveler, minimalist, or anyone in your life!
How can cardholders reduce the risk?
- Treat unsolicited calls and texts about suspicious card activity as untrusted, especially if they ask for your card details, PIN, OTP, or for you to install an app. The European Payments Council’s described variant begins with this kind of social engineering.
- Contact your bank using a number or channel you already know is official; do not rely on contact details supplied in an unexpected message or call.
- Enable transaction notifications if your issuer offers them, and report an unrecognized payment promptly through the issuer’s official channel.
- If you installed an app at a caller’s request, tell your bank and seek help securing the phone as well as the payment account. Removing an app cannot undo credentials already disclosed or prevent every variant: Group-IB says TX-NFC malware can run on a fraudster’s device while the victim’s phone remains clean.
Issuer procedures and consumer protections vary by location. The cited sources do not establish a universal reimbursement rule.
What should banks, processors, and merchants monitor?
ThreatFabric and Group-IB describe detection ideas for payment providers; these are not guaranteed controls and may require data or capabilities held by different parts of the payment chain.
Best Value
- SECURE YOUR WALLET FROM e-PICKPOCKETING: Prevent potential identity and financial theft through your contactless cards. This is the simplest and most effective prevention solution! Block RFID and NFC signals, protect your personal information, and enjoy peace of mind wherever your travels or business take you.
- JAMMING CHIP: An antenna and jamming chip makes up the main components of the card. The antenna will sense incoming radio waves and draw power for the chip to create a jamming signal. Lifetime usage as the card does not require battery.
- BROAD WORKING DISTANCE: With a 2.4” working distance, your entire wallet stays protected. The premium RFID blocking card helps secure cards within 1.2” on either side, providing reliable protection against electronic pickpocketing.
- ULTRA-THIN & COMPACT: At the size of a standard credit card and at only 0.03” thick, the card will fit into any wallet, purse or card case. Keep your wallet compact with no added bulk from this card. Best for travel, business, and everyday use.
- TEST THE CARD: Test the card is working at your local supermarket. At the self-service checkout machines, combine the card and a contactless card on the payment reader. Payment with the contactless card will be blocked and an error message should occur on the reader.
- New device links: ThreatFabric flags a card linked to a new device, particularly alongside malware found on the known customer device.
- Impossible travel: ThreatFabric recommends looking for transaction locations a cardholder could not reach within the time between purchases; Group-IB also recommends geographic-velocity monitoring.
- Contactless timing: Group-IB recommends processor-level analysis of contactless handshake timing.
- Terminal patterns: Group-IB recommends reviewing transaction patterns at POS terminals that handle abnormal volumes of cards associated with geographically dispersed cardholders.
Because the reported variants place malware and emulation in different locations, no single signal described here covers every flow. For example, a clean victim phone would not rule out the TX-NFC pattern Group-IB reports.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
