TAP TO PAY FRAUD- New Technology May Act Like an Electronic Pick Pocket

 In April 2026 KIRO TV News published a warning about a new cybercrime tactic that they called “ghost tapping.” This is defined as getting close to your credit/debit card or smartphone with a mobile wallet to collect the account information that they contain. KIRO emphasized that this could occur in crowded areas where you would not realize that your account information has been collected. The fix is to put your credit/debit cards into a Faraday sleeve or wallet which would block any short-range radio signals that would initiate transmission of the card information. For a mobile wallet on your phone, most require approval, often by entering your PIN or the use of biometrics, before the information is sent. An additional protection step is to keep the NFC capability off until you need to make a transaction.

The Better Business Bureau (BBB) has observed that ghost tapping can occur in one of three situations,

·         Getting close in a crowd. A criminal can get close to you to collect the information on your credit/debit card or bump into you like a pick pocket. You might not even know that an incident occurred.

·         Pretending to be a vendor. A criminal can pretend to be a vendor at a special event, flea market, festival, etc.

·         Charity scams. This could occur in crowded areas where scammers pretend to collect donations for charity.

In the cases of pretending to be a vendor and charity scams the criminal may rush the process. They may not let you see a screen that has the agreed upon price and/or do not present you with a paper receipt that shows what was charged on your card. This way they can charge you more than you thought you were paying without you knowing.

BBB offers red flags to watch out for,

·         A request to tap without showing you the total charge or offering a receipt.

·         Bank alerts about small or unusual test charges.

·         Suspicious charges that show up after you have been in crowded areas.

BBB recommends the following to protect yourself from ghost tapping,

·         Use RFID protection such as a Faraday sleeve or wallet.

·         Confirm payment details before tapping your card or phone.

·         Set up transaction alerts with your bank and credit card provider.

·         Check your accounts frequently.

 

This seems to be prudent advice. Yet, there are those who say that the need for special measures to block an RFID or NFC signal is in reality not very high. They point out that the likelihood of someone bumping into you and collecting your information is unlikely in most cases. They also point out that transmissions are encrypted, making the information unusable by anyone who might manage to intercept it. Also, NFC transmissions often use “tokenization” that transmits enough information to complete the transaction but not give essential account information to strangers. Finally, they point out that to skim account information like a pick pocket is too difficult to be attractive to a criminal and that documented cases of criminals acting like electronic pick pockets is scarce.  

Yet several sources are sounding the alarm that cyber thieves are stealing credit card account information through RFID technology on modern tap to pay cards and NFC technology on cell phones.

As evidence, they point to a phishing scam that was discovered in Italy and Tennessee attributed to Chinese cyber gangs. A victim receives a text message claiming to be from their bank telling them that there is something wrong with their account and that they should call the phone number provided. One of the actions the victim is told to take is to download an app that they are told is a security tool or verification utility. Then the victim is told to tap their credit or debit card on their phone. The “security app” in reality transfers the information to a cell phone in the criminal’s control. The criminal can then use his cell phone to make purchases or collect cash at an ATM on the victim’s dime.

But you say, what does this have to do with stealing like a pick pocket?  This was a phishing scam that fully involved the victims. And two of the three ghost tapping situations cited by the BBB have to do with victims using sketchy circumstances to pay for a product, or service, or contribute to a charity.

The phishing scam could be a precursor to a new technique that mimics how pick pockets operate. The fake “security app” could be modified to collect credit card data and forward the data in mass to a cybercriminal’s cell phone. The app then can be distributed to “mules” who wittingly or unwittingly collect the data.

Disclaimer: I have seen anyone document this. But it is a potential, and I believe a highly possible, advancement in technology. The risk for the average person might be limited to crowded areas such as tourist traps, transit situations, popular bars, concerts, etc. And while the rewards may seem small, modern cybercriminals often play a numbers game.  It’s like plants. They often propagate with seeds. To survive, they spread lots and lots of seeds, which are easy to make. Most of the seeds won’t sprout. But enough sprout for the plant species to thrive. For cybercriminals who might try this as a technique it could be another source for personal data and cash.

If you are often in a crowd, you might consider using a Faraday sleeve or wallet. And, if you have a mobile wallet on your phone, be sure to set up your wallet to verify you with a PIN or biometrics like fingerprints or your face.

 

 

KIRO TV News:

https://www.kiro7.com/news/local/ghost-tapping-scam-charging-your-card-without-you-knowing/LO7BM345F5AOLLBV6MTRQCX6E4/

 

Better Business Bureau:

https://www.bbb.org/all/consumer/scam/how-to-spot-and-avoid-tap-to-pay-scams

https://www.bbb.org/article/news-releases/26288-what-to-know-if-youre-using-nfcs-and-you-probably-are

 

ZDNET:

https://www.zdnet.com/article/this-ghost-tapping-scam-can-steal-money-from-your-mobile-wallet-or-card-how-to-block-it/

 

Finance Buzz:

https://financebuzz.com/what-is-rfid-blocking

 

Consumer Threats:

https://www.idx.us/knowledge-center/rfid-skimming-is-the-danger-real

 

AARP:

https://www.aarp.org/money/scams-fraud/rfid-wallets-purses/?src=psn?cmp=EMC-DSM-NLC-OTH-WBLTR-2239402-2353302-e318cf4ba79e412d9bf3ba234e3e628a-NA-07102026-Webletter-MS2-foundry-BTN-NA-article-1f3094e836&encparam=WnvEyp%2FiTaKWUyvgb9wdGFaTDfrqFFWXvVB%2FMiAIV5E%3D

 

Recorded Future News:

https://therecord.media/new-payment-card-scam-involves-malware-tap

https://therecord.media/scammers-ghost-tapping-retail-fraud-launder-cash

 

Cleafy:

https://www.cleafy.com/insights/nfc-relay-attack-understanding-and-preventing-contactless-payment-fraud

https://www.cleafy.com/cleafy-labs/supercardx-exposing-chinese-speaker-maas-for-nfc-relay-fraud-operation

 

Krebs on Security:

https://krebsonsecurity.com/2025/03/arrests-in-tap-to-pay-scheme-powered-by-phishing/

 

CAPTCHA- New Phishing Scam

We are all used to CAPTCHA’s, those check boxes and picture matching tasks that prove you are a human. Scammers have found a way to steal the information from your computer by pretending to use a CAPTCHA.

A true CAPTCHA has you click on a box, or type letters or numbers just as they appear on the screen, or match pictures of objects. The fake CAPTCHA has you type a specific sequence of keys. A common sequence is the Windows Key+ R then Ctrl+ V. The sequence is a series of commands to your computer to download a script that downloads a virus onto your computer. The virus can then copy your email account login information, mobile banking credentials, or other information.

Legitimate CAPTCHA’s will NOT ask you to,

·         Run commands on a device

·         Open the Windows Run dialog

·         Paste text into a command box

·         Download files

·         Install software

·         Enable special permissions

If a website asks you to open a “Run” box or paste computer code, close the window immediately. Legitimate CAPTCHA’s will not ask you to run code or download anything as part of their verification that you are a human.

If you do follow keyboard prompts and think you have been infected, take the following actions:

·         Disconnect from the internet. Turn off Wi-Fi or unplug your internet cable. This cuts off the data link between you and the scammer.

·         Scan your device for viruses.

·         Change the password for the account that you were trying to access when the fake CAPTCHA window popped up. Use a clean device, such as your phone, to do the change.

·         Check your bank statements for any charges that you do not recognize.

 

Identity Theft Resource Center:

https://www.idtheftcenter.org/post/new-captcha-scam/

 

Federal Trade Commission:

https://consumer.ftc.gov/consumer-alerts/2026/06/how-spot-captcha-scam

 

CBS News:

https://www.cbsnews.com/philadelphia/news/fake-captcha-scams/

 

 

CYBERSECURITY MYTH- Phishing emails are easy to spot due to poor grammar and misspellings

This might have been true in the past, but computer technology is advancing fast, giving scammers easier ways to fool us that an email or text message is authentic. Lately, cybersecurity professionals have been warning about the easy use of AI by scammers to leverage their crimes. They cite several AI capabilities that improve scammers’ abilities to victimize people,

·         Hyper-personalized messages. AI can quickly collect personal data from social media profiles, work bios, and the dark web to personalize any email or text message. This makes the message feel personal and authoritative if you think it is coming from a friend, a coworker, or a business that you know and trust.

·         Perfect grammar and zero typos. AI can know the proper grammar and spelling for any language. This leverages the effectiveness and breadth of a scammer’s campaign.

·         Deepfake audio and video. AI can create audio and video that looks and sounds like any real person. Useful for phone calls that sound like they are from your boss or from your grandchild to convince you to act quickly.

·         Large-scale automated attacks. While scammers have long taken advantage of computer automation to conduct their scam campaigns, AI super sizes their capabilities to allow them to create customized messages faster, more creatively, and to more people.

·         Dangerous links in disguise. AI allows scammers to create more genuine looking fake webpages, making it more difficult to distinguish them from real webpages. Also, AI can create authentic looking URLs.

 

Probably the scariest capability of AI scams is deepfake audio and video. AI can efficiently and rapidly find voice samples or pictures to use for telephone calls or for video. And there is no more checking for six fingers on hands. AI video capability has become way better.

AI allows scammers to quickly and efficiently develop a more effective scam campaign without the scammer needing many high-tech skills, expanding the availability of “good quality” fake audio, video, emails, texts, and websites to more criminals.

While AI makes audio, video, emails, text messages, and web sites look more genuine, there are still red flags that you can look for.

·         Urgency. The scammer wants you to act quickly to make a payment or click on an included link or call a provided phone number in an emotional and urgent situation that the scammer has made up. You should be especially wary if the scammer discourages you from talking to someone else about the situation. cut off communication! If you feel the situation is genuine, talk to a friend or family member or contact the organization that the scammer claims to represent separately.

·         Payment. If you are required to make payment with crypto currency, wire transfers, gift cards, or peer-to-peer apps, cut off communications. These methods are like cash and funds paid through these methods are almost impossible to recover.

·         URL’s. Inspect URL’s of links and email addresses for genuineness. Small spelling mistakes or unusual domains such as “.xyz” instead of “.com” can be tip offs that the links will take you to a webpage that is controlled by the scammer.

Two suggestions,

Safe Word. Cybersecurity professionals are encouraging you to establish a safe word among your family, coworkers, close friends, elderly adults and caregivers, to help verify who you are talking to, especially in an emotional or urgent situation. A safe word can help a family in a grandparent scam. A safe word can help a business in an imposter scam when it looks like the boss is telling you to pay a large amount of money to a client or vendor using an account that is normally not used.

Be your own fact checker. A common rule of thumb is to not click on links or call phone numbers imbedded in emails or text messages, especially if they are suspicious. Contact the company, governmental agency, or organization from a trusted source. This can be the customer service number on the back of your credit card, an invoice or bill, or the website that you have looked up separately.

Scammers are rapidly adopting AI into their operations. The improvement of their fake websites, emails, text messages and audio/video increases the difficulty to detect fakes. This requires all of us to be more careful when we see these types of communication.

 

 

 

 

CBS News:

https://www.cbsnews.com/news/elder-scams-family-safe-word/

 

National Cybersecurity Alliance:

https://www.staysafeonline.org/articles/why-your-family-and-coworkers-need-a-safe-word-in-the-age-of-ai

 

The Seattle Times:

https://www.seattletimes.com/life/travel/ai-is-making-travel-scams-nearly-impossible-to-spot-heres-what-to-do/?utm_source=marketingcloud&utm_medium=email&utm_campaign=Morning+Brief+02-23-26_2_23_2026&utm_term=Active%20subscriber

https://www.seattletimes.com/business/ai-is-making-scams-hard-to-spot-heres-how-to-protect-yourself/

 

Identity Theft Resource Center:

https://www.idtheftcenter.org/post/ai-scams-harder-to-detect/

https://www.idtheftcenter.org/post/ai-scams-2025/

https://www.idtheftcenter.org/post/voice-cloning-scam/

https://www.idtheftcenter.org/podcast/weekly-breach-breakdown-ai-scams-cybersecurity-risks/

 

Norton:

https://us.norton.com/blog/online-scams/top-5-ai-and-deepfakes-2025

Ask Leo:

https://askleo.com/how-ai-is-revolutionizing-scams-can-we-no-longer-trust-our-eyes-or-ears/

 

 

CRYPTOCURRENCY KIOSKS- Another New Tool for Scammers

It is well known that scammers want to be “paid” with methods that are difficult to reverse. Some of the classics include wire transfers, peer-to-peer transactions, and gift cards. The suggestion of using any of these methods is often used as a red flag that the transaction is suspect and that you should stop communicating with the person who suggests them.

Scammers have added a new method to transfer money to them, cryptocurrency. Converting regular money to or from a cryptocurrency can be done in one of two ways,

·         Cryptocurrency exchange. A cryptocurrency exchange is a digital marketplace where you can buy, sell, and trade cryptocurrencies. You can send cryptocurrency to your personal cryptocurrency wallet or to another wallet through an exchange. Users need to create an account and deposit funds. They can also use a digital wallet to securely store their currency.

·         Cryptocurrency kiosks. A Cryptocurrency kiosk is a kiosk that looks similar to an ATM, that can be found in high traffic areas such as convenience stores, gas stations, or malls. You can use a crypto kiosk for quick access to your digital wallet, convert cash to a cryptocurrency, pay bills, or transfer funds to another person such as a family member or friend.  

Crypto kiosks are considered easier to operate than an exchange in some ways. All you have to do is walk up to the kiosk, like an ATM, insert cash or a debit card, then send the money on its way in a few steps. You do not have the complications of a crypto exchange. This makes it easier for scammers to instruct victims to send their money. And, once the money is in the scammer’s wallet, the scammer can easily and quickly launder the money so that it is impossible for the victim to recover their funds.

Crypto kiosks have been so successful for scammers that the FBI received 13,400 complaints through its Internet Crime Complaint Center (IC3) in 2025 amounting to $388 million in losses, a 23% increase in complaints and 58% increase in losses over 2024. Of those totals, Washington State had 391 complaints for losses of $8,341,828.

While there are legitimate uses for crypto kiosks, the Iowa Attorney General found that in 2025 at least 94% of transactions from at least two crypto kiosk providers (Bitcoin Depot and CoinFlip) were fraudulent. In addition, money launderers, drug traffickers, and human traffickers have been reported using crypto kiosks to quickly and anonymously move and launder money.  

Scammers have been using the kiosks in all sorts of scams including government impersonation scams, tech support scams, romance and investment scams, and prize and employment scams. Once the scammer convinces the victim that they need to pay or “invest” their money, the scammer will send a QR code to the victim with the address of the scammer’s crypto wallet. The scammer instructs the victim to withdraw cash from their bank, then to go to a nearby crypto kiosk. Sometimes, the scammer will keep the victim on the phone throughout the process to give detailed instructions and to ensure that the victim complies with those instructions.

The use by scammers of crypto kiosks has caught the attention of state legislators throughout the U.S. Several states have passed legislation that regulates the kiosks for the protection of the public. The Washington State Legislature considered Senate bill 5280, “Protecting consumers of virtual currency kiosks.” The bill passed in the Senate but was sent back to committee by the House. If passed in the future, the bill would

            • Cap daily transactions at $2,000 per consumer.

            • Limit fees to $5 or 15% per transaction (whichever is greater).

            • Require paper receipts for all transactions.

            • Post clear, visible scam warnings on every kiosk.

Legislation like this attempts to give at least some protection for consumers. The limit to $2,000 in transactions per day tries to limit the potential loss that a consumer might experience if they are being scammed. Transaction fees at crypto kiosks tend to be higher than for crypto exchanges. The limit to the fees tries to prevent gouging by the kiosk owners. Paper receipts provide proof of the transactions in case a consumer needs to report a scam to police. Finally, scam warnings attempt to educate the public of the opportunity of scams and encourage kiosk users to slow down and be thoughtful about an upcoming transaction.

 

 

 

 

Federal Trade Commission:

https://www.ftc.gov/news-events/data-visualizations/data-spotlight/2024/09/bitcoin-atms-payment-portal-scammers

 

 

Consumer Affairs:

https://www.consumeraffairs.com/news/crypto-kiosks-are-being-used-to-run-multiple-scams-052226.html

 

FBI:

https://www.ic3.gov/PSA/2026/PSA260515-2

 

AARP:

https://www.aarp.org/states/washington/aarp-backs-legislative-action-to-stop-crypto-kiosk-scams/?msockid=1ccaa3490741631714d9b3fb03416160

https://www.aarp.org/advocacy/crypto-atm-fraud-protections/

 

 

SNOHOMISH COUNTY SHERIFF’S OFFICE- The Psychology of Scams

The Snohomish County Sheriff’s Office has published the latest issue if its crime prevention newsletter “Partners in Crime Prevention.” This issue discusses the psychology of scams and how you can detect when you are being scammed. It also talks about where to report scams.

 

Snohomish County Sheriff’s Office:

https://www.snohomishcountywa.gov/ArchiveCenter/ViewFile/Item/7482

 

 

SCAM ALERT- Inspect Those Party Invitations

The Federal Trade Commission (FTC) has just issued a warning about scammers using email and text party invitations in a phishing scam. Scammers take advantage of new ways to steal your money and your identity. They also take advantage of special events such as high school and college graduation as well as disasters and high-profile news events.

The FTC has been getting complaints about citizens receiving unexpected party invitations. The emails and texts do not use common procedures found with invitation services such as Evite or Paperless Post. Instead, the phishing messages ask for email login credentials or a special pass code to open them. Requiring credentials is not normal for invitation services. Also, the phishing message may use the name of someone that you know as the host.

The phishing message might try to steal (or reset) your account information. It may also take over your email account and send the scam to your contacts.

Take the following steps to protect yourself from phishing scams,

·         Keep security software updated. Set your computer to update its software automatically. Also, keep your phone software up to date.

·         Use multi-factor authentication. MFA will make it more difficult for a scammer to enter your accounts if they obtain your username and password.

·         Act quickly. If a scammer acquires your email account information, change your password to a new strong password right away. And the FTC recommends that you go to www.identitytheft.gov for guidance on other steps to take to protect your identity.

Also, forward phishing emails to the Anti-Phishing Working Group at www.reportphishing@apwg.org. Report phishing texts to SPAM (7726). Also report the phishing attempt to the FTC at www.ReportFraud.ftc.gov.   

 

 

 

 

 

Federal Trade Commission:

https://consumer.ftc.gov/consumer-alerts/2026/05/asked-enter-your-email-address-and-password-open-party-invite-thats-scam

 

 

National Cybersecurity Alliance:

https://www.staysafeonline.org/articles/phishing

 

ROMANCE SCAMS- Romance Scams Turning into Friend Scams

You probably have heard about romance scams. That’s where someone contacts you through a dating app and strikes up a conversation. They might try to get you to communicate with them away from the app. They may also quickly declare their “love” for you. They often claim to be located in a remote area, such as the Middle East or Africa. After a while, they might ask you for money to help them out in some sort of emergency. Or for a plane ticket to meet you in person. They often find it hard to meet you in person, as much as they would like to.

A recent twist is that they say that they have been making a killing in crypto currency and would be very happy to share with you how they do it. In the end, the “relationship” revolves around money either to help the scammer out or to share the new wealth that both of you have accumulated.

Recently, this scenario has morphed from a Romance scam into a Friend scam. With a friend scam you might receive a text message from an unknown phone number. The message would look like the sender had sent the text to the wrong number. If you reply by saying something like “sorry, you have the wrong number,” the scammer keeps up communication with you. According to AARP this scam has been exploding since the summer of 2025.

At one point, and this might take several weeks or months, the scammer brings up their great success at investing in crypto currency, and they would be very happy to share their techniques with you.

Scammers in either a Romance scam or Friend scam look for targets through social media to find more well-off victims. Or they can use a shot gun approach by sending the same text message to hundreds of phone numbers.

Getting you to invest in crypto currency is perfect for the scammers because the transfer of money is instant, irreversible, and hard to trace (although there are some instances when it can be traced). The scammer, or scammers group, will have set up a fake trading web site that you will be steered to so that your investment can go into the scammer’s account. Also, the web site can show you fake investment numbers that appear to show the increase in your investment. The scammer might coach you very closely through each step in their “investment” process. Over time the scammer will encourage you to invest in larger amounts to “take full advantage of this investment opportunity.” When you decide to cash in on your investment, then that’s when the trouble begins. The scammer will start charging substantial withdrawal fees, fake taxes, etc. When you have figured out that this good deal is a scam the scammer and the web site all disappear with your money.

Anyone is a good target for this scam, no matter their age, education level, or profession.

·         Older adults are vulnerable because of their accumulated wealth and the potential that they are isolated.

·         People who are less tech savvy no matter their age or education are also vulnerable.

·         People who are financially savvy are good target if the scammer can “demonstrate” that he/she is financially savvy also.

·         Scammers can take advantage of people in emotional turmoil such as going through a divorce or who have lost a loved one.

If you find yourself in a situation like this, here are some red flags to look for,

• Communication

• The scammer wants to move to a private platform.
• The scammer avoids real time video, or they use short video clips.
• Photos they send you are too perfect.
• The scammer contacts you several times a day.

      ·     Behavioral

• They fall in love with you very quickly.
• They insist on secrecy.
• They proclaim that “we are a team.”

• Financial

• They offer to teach you to invest.
• They move to crypto very quickly.
• They guide you to a specific app or website.

 

 If you detect one or two of the above behaviors, slow down and pause:

·         Do some research.

o   Do a reverse image search on any photos the scammer has sent you.

o   Look up the investment platform independently. For example, do a web search on the name of the platform with the word “scam,” “fraud,’ or “crime.”

o   Talk to a friend or a trusted financial advisor about the investment.

·         Insist on a real time video call.

If you have not met this person in person, DO NOT send money in any form!!!!!

If you suspect this to be a scam, report it to,

·         Federal Trade Commission- .https://reportfraud.ftc.gov/

·         FBI-  https://www.ic3.gov/

·         Your bank

·         The crypto exchange

Scammers are always changing the way they operate. They find more effective methods to victimize people. While it may seem complicated and confusing, scammers are after the same thing in any of their scams; your money and/or your identity to steal your money. And they want you to act emotionally without researching or asking trusted family members or friends.

 

AARP webinar on Romance and Friendship scams:

https://www.youtube.com/watch?v=LolZG7Wfrxw

 

AARP:

https://www.aarp.org/money/scams-fraud/affinity-fraud/?msockid=1ccaa3490741631714d9b3fb03416160

 

National Cybersecurity Alliance:

https://www.staysafeonline.org/articles/online-romance-scams

https://www.staysafeonline.org/events/why-romance-scams-work-how-to-protect-yourself-and-others

 

Ask Leo:

https://askleo.com/romance-scams-when-loneliness-makes-us-vulnerable/