Unlike earlier carding methods reliant on cloned magnetic stripes, this approach exploits contactless payment infrastructure via NFC relay tools like NFCGate—a repurposed academic tool originally designed for testing NFC security. Security analysts warn that the tactic poses significant challenges for financial institutions and underscores vulnerabilities in mobile payment ecosystems. Cyber Security News is a Dedicated News Platform For Cyber News, Cyber Attack News, Hacking News & Vulnerability Analysis. Kaaviya is a Security Editor and fellow reporter with Cyber Security News. Advanced groups also generate counterfeit card images, which are scanned into Apple Pay or Google Wallet to trigger OTP verification. Most financial institutions rely on SMS-based OTPs to verify mobile wallet linkages, which are easily intercepted by phishing or malware. ThreatFabric estimates that attackers using these tactics could generate $15 billion annually, based on median losses of $250 per card across 33,000 phishing domains. Behavioral Analytics: Monitoring for geographic inconsistencies (e.g., transactions in unreachable locations) and rapid serial purchases can flag Ghost Tap activity. A single compromised device can facilitate purchases at impossible travel speeds, e.g., transactions in New York and London within minutes. This relay bypasses geographic limitations, allowing simultaneous fraudulent purchases across multiple locations. She is covering various cyber security incidents happening in the Cyber Space. Picture from the Telegram channel, Chinese phishing gang depicts several toll road phish kits that are available. POS Terminal Upgrades: Implementing latency checks during NFC transactions could detect relay delays. The mule’s device interacts with the terminal, while the master device—often located in a different country—authenticates the transaction remotely. This method eliminates the need for physical card clones and scales operations by distributing cash-outs among multiple mules. Additionally, merchant adoption of 3-D Secure (3DS), a protocol for authenticating online transactions, remains inconsistent. Apple’s Device Account Number (DAN) and Google’s virtual cards must integrate multi-factor authentication. Proactive adoption of 3DS, coupled with AI-driven anomaly detection, could mitigate risks—but only if deployed before threat actors further refine their tactics.
This Cyber News was published on cybersecuritynews.com. Publication date: Wed, 19 Feb 2025 13:45:06 +0000