Arrests in Tap-to-Pay Scheme Powered by Phishing

Authorities in multiple U.S. states arrested Chinese nationals linked to a novel tap-to-pay fraud scheme in which phishing gangs convert stolen card data into Apple/Google mobile wallets and use a custom Android NFC-relay app (reported as Z-NFC) to remotely execute contactless transactions; the report details how phishing (via iMessage/RCS) provisions wallets onto racks of phones that are sold or rented to fraudsters, along with examples of gift-card thefts and investigative observations.