Ghost-Tapping and the Chinese Cybercriminal Retail Fraud Ecosystem

Insikt Group's report details the emergence and expansion of “ghost-tapping” NFC relay fraud where cybercriminals steal payment card credentials, provision them into mobile wallets, and use proprietary relay tools plus hired mules to perform in-person contactless purchases and ATM withdrawals; it maps the ecosystem of cybercriminals, syndicates, mule roles, and Telegram-based marketplaces (Huione, Xinbi, Tudou), cites law enforcement cases and financial losses, and offers mitigations for banks, consumers, and law enforcement.