Cybercriminals have introduced a sophisticated new tactic known as “Ghost Tap,” leveraging near-field communication (NFC) technology to facilitate large-scale fraudulent transactions. This method involves using stolen credit card information linked to mobile payment services such as Google Pay or Apple Pay to execute global transactions, often without the cardholder’s physical presence. The scheme begins with tricking victims into downloading malicious banking malware, allowing attackers to capture sensitive financial credentials. Once they have the card details, the criminals link them to a mobile payment service and use a tool called NFCGate to relay tap-to-pay information to a mule, who then conducts purchases at a point-of-sale terminal. Ghost Tap exploits NFC technology by establishing a relay system that enables anonymous and scalable cash-outs across multiple locations. The transactions mimic legitimate activity, making them difficult to detect with traditional anti-fraud measures. This anonymity and ability to quickly scale pose significant challenges for financial institutions and retailers attempting to combat such fraud. The advancement of communication networks and the absence of effective time-based detection mechanisms on ATM and point-of-sale (POS) terminals have further enabled the execution of Ghost Tap attacks.