Ghost Tap: NFC Relay Fraud at Scale
A research tool built by a German university to study NFC security has been weaponized into a criminal malware-as-a-service platform. Victims install an app, tap their credit card, and their payment credentials are relayed in real-time to a mule’s device thousands of miles away — who walks into a store and buys luxury goods on the victim’s dime.
ESET’s telemetry shows NFC-based attacks surged 35x in H1 2025 compared to the previous six months. In Russia alone, losses from NFCGate variants hit 432 million rubles (~$5.5M) in Q1 2025, with an average of 40 successful attacks per day.
This is Ghost Tap. And it’s just getting started.
How NFC Payments Work
Near Field Communication (NFC) enables contactless payments at distances under 4cm. When you tap your phone or card at a terminal:
- The terminal generates an electromagnetic field
- Your card/phone responds with a cryptographic token (EMV)
- The token is validated against the payment network
- Transaction approved (typically under $100 without PIN)
┌──────────┐ NFC (4cm) ┌──────────┐ Network ┌──────────┐
│ Card / │ ──────────→ │ POS │ ──────────────→ │ Payment │
│ Phone │ EMV token │ Terminal │ Auth request │ Network │
└──────────┘ └──────────┘ └──────────┘The security model assumes physical proximity. If your card generates a valid token, the terminal assumes the cardholder is standing in front of it. NFC relay attacks break this assumption.
The Relay Attack
An NFC relay attack inserts a proxy between the card and the terminal, extending the effective range from centimeters to continents:
┌──────────┐ NFC ┌──────────┐ Internet ┌──────────┐ NFC ┌──────────┐
│ Victim's │ ────→ │ Infected │ ─────────→ │ Mule's │ ────→ │ POS │
│ Card │ │ Phone │ │ Phone │ │ Terminal │
└──────────┘ └──────────┘ └──────────┘ └──────────┘
Reader Relay EmulatorThe victim’s phone reads the card’s NFC data and streams it over the internet to the mule’s phone, which emulates the card to the POS terminal. The entire relay happens in real-time — the EMV cryptographic challenge-response passes through the proxy as if the card were physically present.
From Research Tool to Weapon
NFCGate (2015 — TU Darmstadt)
NFCGate was developed at the Technical University of Darmstadt as a legitimate security research tool to study NFC relay attacks. Open-source, academic, designed for controlled lab environments. It demonstrated that NFC relay was practically feasible, not just theoretical.
NGate (2024 — Czech Republic)
ESET discovered NGate in the Czech Republic — the first in-the-wild malware built on NFCGate’s relay functionality. Attackers used phishing campaigns to trick victims into installing a malicious app, then instructed them to tap their bank card. The relayed NFC data was used for fraudulent ATM withdrawals.
HACK
NGate was a proof of concept in the criminal underground. It showed that NFCGate’s relay architecture could be weaponized at scale with minimal modification.
SuperCard X (2025 — Chinese-Speaking Groups)
Cleafy Labs documented SuperCard X, a full MaaS (Malware-as-a-Service) platform operated by Chinese-speaking cybercrime groups. SuperCard X professionalized the NFCGate relay attack into a turnkey fraud operation:
- Recruitment: Mules hired through Telegram platforms (Huione Guarantee, Xinbi Guarantee, Tudou Guarantee)
- Tooling: Custom Android apps for both victim (Reader) and mule (Tapper) sides
- Infrastructure: Relay servers managed by the MaaS operator
- Monetization: Mules purchase luxury goods (jewelry, electronics) at retail stores using relayed credentials, then resell for cash
The Attack Flow
A typical SuperCard X operation:
- Social engineering: Victim receives an SMS or call impersonating their bank, claiming suspicious activity
- App installation: Victim is directed to install a “security verification” app (the Reader component)
- Card tap: Victim is instructed to tap their credit/debit card to their phone for “verification”
- Real-time relay: NFC data streams to the mule’s device in another city or country
- POS fraud: Mule taps their phone at a POS terminal, completing a contactless purchase
- Cashout: Purchased goods are resold or returned for cash
The entire attack — from social engineering to purchase — can happen in under 10 minutes.
Scale of Operations
The numbers are staggering:
| Metric | Value |
|---|---|
| NFCGate-infected devices (Russia, Q1 2025) | 175,000+ |
| Daily successful attacks (Russia, Q1 2025) | ~40 |
| Financial losses (Russia, Q1 2025) | 432M rubles (~$5.5M) |
| NFC attack growth (ESET, H1 2025 vs H2 2024) | 35x increase |
| Huione Guarantee lifetime transaction volume | $27 billion |
The Chinese cybercrime ecosystem supporting these operations is massive. Huione Guarantee — a Telegram-based criminal marketplace that processed over $27 billion in crypto before its nominal shutdown in May 2025 — served as a one-stop shop for recruiting mules, buying stolen card data, and laundering proceeds through luxury goods resale.
INFO
Even after Telegram banned Huione Guarantee and Xinbi Guarantee channels, the operations quickly migrated to Tudou Guarantee and other successor platforms. The decentralized, Telegram-based model makes permanent disruption extremely difficult.
The Evolution Continues
The threat landscape is evolving rapidly. F6 (a Russian security firm) documented a “reverse” NFCGate scheme where attackers use CmaxsRAT to intercept SMS notifications and PINs, then initiate and relay NFC transactions to accomplices waiting at ATMs.
Each new iteration adds capabilities:
- NGate — Basic relay, ATM withdrawal focus
- SuperCard X — MaaS platform, POS fraud focus
- Ghost Tap — Enhanced relay with reduced latency
- RatOn — Combines RAT capabilities with NFC relay in a single package
Defense
Defending against NFC relay is challenging because the EMV protocol wasn’t designed to verify physical proximity beyond the NFC range itself.
For consumers:
- Never install apps from links received via SMS or phone calls
- Your bank will never ask you to tap your card to a third-party app
- Disable NFC when not actively using contactless payments
- Set low limits for contactless transactions
For financial institutions:
- Implement velocity checks for contactless transactions
- Flag geographic anomalies (same card, different cities, short timeframe)
- Monitor for contactless-MSD transactions from EMV-capable cards
- Deploy behavioral biometrics to detect relay latency patterns
For the industry:
- Distance bounding protocols (like the proposed L1RP) can detect relay by measuring round-trip time at the physical layer
- Device attestation to verify the integrity of the NFC-capable device
- Enhanced transaction verification for high-value contactless payments
WARN
Distance bounding — measuring the physical round-trip time of NFC communications — is the only robust technical countermeasure against relay attacks. It’s specified in EMVCo standards but not yet widely deployed. Until it is, NFC relay remains fundamentally viable.
The tap that pays for your coffee could be paying for someone else’s jewelry. Check your statements.
-- tapjack