In 2020, students at the Technical University of Darmstadt, Germany, developed
NFCgate to capture, analyze, or alter NFC traffic. Their research has immediately attracted the attention of cybercriminals who created the malware called NGate, leveraging principles they described - the malicious tool relayed NFC data from victims’ payment cards, via victims’ mobile phones, to the device of a perpetrator waiting at an ATM. Cybercriminals didn't limit themselves to ATMs. The "Ghost Tap" technique enables cybercriminals to cash out money from stolen credit cards linked to mobile payment services such as Google Pay or Apple Pay by relaying NFC traffic via NFC-enabled POS terminals. In this case, bad actors "tap" their mobile devices with stolen, compromised data to make fraudulent transactions. Therefore, the merchandise can be “purchased” at the POS terminal, but the credit card terminal will not submit the transaction for payment to the merchant’s payment processor.
