Man
Professional
- Messages
- 3,046
- Reaction score
- 570
- Points
- 113
This is the case when your phone is the main tool of hackers.
Security researchers from ThreatFabric have discovered a new tactic for cashing out stolen funds called "Ghost Tap". This scheme allows cybercriminals to use NFC technology to anonymously transact with stolen credit card data linked to mobile payment services such as Google Pay and Apple Pay.
The essence of the method is the relay transmission of NFC traffic between devices, which makes it possible to conduct transactions at a considerable distance from the actual location of the card. Criminals use readily available tools such as NFCGate, originally developed for research purposes. This approach allows you to scale operations, using "mules" for purchases in different geographical locations in a short time.
To implement Ghost Tap, scammers link stolen cards to devices by obtaining OTP codes through phishing sites or mobile malware. The card details are then transmitted to the "mule" device, which makes purchases in stores. This makes it difficult to detect criminals, as transactions look like normal operations from a single device.
The key problem for banks and payment systems is the difficulty in identifying these transactions. The use of the "on the plane" mode and small amounts of purchases make it difficult for anti-fraud systems to work. At the same time, criminals can quickly spend large sums by dividing them into many small transactions.
The growing popularity of NFC attacks is due to the lack of effective detection mechanisms. To counter such schemes, financial institutions need to improve monitoring systems that can take into account the mismatch between the location of the device and the terminal, as well as suspicious customer behavior.
Ghost Tap illustrates how technological tools created for research purposes turn into powerful scams. Combating such threats requires cooperation between financial institutions, technology developers, and law enforcement agencies. Only joint efforts will help stop the evolution of such schemes.
Source
Security researchers from ThreatFabric have discovered a new tactic for cashing out stolen funds called "Ghost Tap". This scheme allows cybercriminals to use NFC technology to anonymously transact with stolen credit card data linked to mobile payment services such as Google Pay and Apple Pay.
The essence of the method is the relay transmission of NFC traffic between devices, which makes it possible to conduct transactions at a considerable distance from the actual location of the card. Criminals use readily available tools such as NFCGate, originally developed for research purposes. This approach allows you to scale operations, using "mules" for purchases in different geographical locations in a short time.
To implement Ghost Tap, scammers link stolen cards to devices by obtaining OTP codes through phishing sites or mobile malware. The card details are then transmitted to the "mule" device, which makes purchases in stores. This makes it difficult to detect criminals, as transactions look like normal operations from a single device.
The key problem for banks and payment systems is the difficulty in identifying these transactions. The use of the "on the plane" mode and small amounts of purchases make it difficult for anti-fraud systems to work. At the same time, criminals can quickly spend large sums by dividing them into many small transactions.
The growing popularity of NFC attacks is due to the lack of effective detection mechanisms. To counter such schemes, financial institutions need to improve monitoring systems that can take into account the mismatch between the location of the device and the terminal, as well as suspicious customer behavior.
Ghost Tap illustrates how technological tools created for research purposes turn into powerful scams. Combating such threats requires cooperation between financial institutions, technology developers, and law enforcement agencies. Only joint efforts will help stop the evolution of such schemes.
Source
