Ghost Tap Uses NFC Relays to Scale Fraudulent Cash-Outs

Nov 20, 2024 · Original article ↗

Summary

ThreatFabric describes Ghost Tap, a cash-out tactic relaying NFC traffic from a device with a stolen card linked to a mobile payment service to a mule at a retailer, and outlines fraud indicators for financial institutions.

Key points

ThreatFabric analysts report finding Ghost Tap in active use and promoted on underground forums.
Stolen card details may be linked to a mobile payment service after attackers obtain a bank OTP, potentially through mobile malware or phishing; the article presents these as plausible scenarios.
Attackers use NFCGate and a relay server to pass NFC traffic from a device holding the linked card to a mule's NFC device at a point-of-sale terminal.
The card-holding device can be remote from the store, while multiple mules may make purchases in different locations in a short period.
The article says purchases may appear to come from one device and involve individually low amounts, complicating fraud detection.
Suggested indicators include a card newly linked to a device, especially alongside detected mobile malware, and transactions in locations that cannot be reached within the time between them.
ThreatFabric recommends stronger detection by financial institutions, mobile payment services, and POS or ATM readers, including checking location inconsistencies and transaction timing.

Article Details

Attack Vectors: Ghost Tap relays NFC traffic between a device holding a stolen card enrolled in Apple Pay or Google Pay and a mule's device interacting with a retailer's POS terminal, enabling offline purchases while the cardholder device and POS are geographically separated.
The card may be enrolled after card details are stolen through mobile banking malware using overlays or keylogging, with OTPs intercepted from SMS or push notifications, or after a victim submits card credentials and an OTP to a phishing website.
The relay setup uses two devices with NFCGate installed and a server configured to relay traffic.
Defensive Notes: Monitor for a card linked to a new device, particularly when malware is detected on the customer's known device.
Detect multiple transactions in locations that cannot be reached within the time between transactions.
Assess aggregate spending over short periods, even when individual transactions are low value.
Use transaction latency and device-presence checks at ATM and POS NFC readers, and detect inconsistencies between the device's location and payment location.
Consider that the card-linked device may be in airplane mode, limiting location visibility.
Detect malicious or unusual customer-device behavior that could indicate card-detail theft and elevate risk for subsequent card enrollment and transactions.