In 2017, Wirecutter — the New York Times' product-review site — published the answer most U.S. shoppers ran into when they Googled the question. Their position, that year, rested on three facts that were, at the time, more or less true.
First, classic RFID skimming — a thief with a scanner across a room reading a card inside a pocket — was very rare.
Second, chip-inserted EMV transactions use a one-time code — like a single-use password — so a stolen “read” of the chip data couldn't be reused at another terminal. Still true.
Third, no high-profile real-world cases had been documented in the consumer press. In 2017, also true.
The problem is the threat didn't stay frozen in 2017.
By April 2023, ABC7 News in San Francisco was running an investigative segment with named consumers describing tap-to-pay reads through their purses, their pockets, and — in one case — through a wallet that hadn't been taken out at all.
From a Safeway shopper, Edgar Mathews: “I hadn't tapped it, I hadn't inserted it, I hadn't swiped it... and then all of a sudden, out comes a receipt.”
From a doctor's-office visitor, Sonya Cesari: “I haven't inserted my card! I haven't even taken it out of my wallet!”
Bankrate analyst Ted Rossman, interviewed for the segment, told the reporter the obvious: “You're not supposed to have a card charged by mistake. You're supposed to have to hold it very close to the reader.”
That was 2023. The story was that some store readers had been adjusted — accidentally or otherwise — to read cards from farther away than they were supposed to.
What's happening now is the inverse.
Now the readers are mobile. And they belong to the wrong people.
How a $50 device made ghost tapping replace pickpocketing
Pickpocketing, as a tactic, has been getting harder year over year.
Cameras are everywhere. Phone footage of attempts in tourist cities goes viral within hours of being recorded. There's now an entire genre of viral phone-video, tagged “Attenzione pickpocket”, that does nothing but warn travelers about it.
Returning a stolen wallet to its owner used to be the risk.
Now the risk is being filmed.
So the work moved.
The contemporary version of the same crime keeps the physical proximity — the bump in the checkout line — but you never see anything get taken. Nothing leaves the victim's pocket. Nothing is taken from a handbag.
The victim's card just answers a question it was designed to answer. The asker is a device the size of a deck of cards, held two inches away through fabric.
Per the Michigan Attorney General's ghost-tapping consumer alert and the BBB warning that echoes it: “Scammers can exploit it in crowded or distracted situations.”
McAfee's March 28, 2026 bulletin is more clinical: “Unauthorized NFC readers operating at close range, sometimes in crowded places” — with the added detail that “low-dollar transactions are used to confirm that a card can be charged without being declined.”
That confirmation step is why the small charge sometimes appears alone.
The thief is testing.
Why "your chip card is encrypted" doesn't fully apply
This is the part that wasn't in the 2017 debunker articles, because it didn't matter in 2017.
The encryption argument applies to chip-insert transactions — the slow one where you push the card in and wait.
Tap-to-pay reads a different surface of the same card. So does any tap-reader nearby — the same chip the legitimate card-payment terminals use.
A German security researcher named Thomas Skora, in a 2012 Android Authority piece that's been sitting on the internet for over a decade, demonstrated that a smartphone NFC reader app could pull “the card number, issue date, expiry date, and bank code from contactless cards.”
Banks now mask your real card number with a different one-time tag for every purchase — that's narrowed what a thief can do with a stolen scan. They generally cannot replay a tap-charge from a passive read alone.
But it doesn't make the read disappear. It just sends the fraud through a different door: online purchases where the card never gets seen, tiny test charges to see if your card is still alive, and follow-up scam calls from people pretending to be your bank.
For U.S. e-passports, it's worse.
The international body that sets passport security standards (ICAO) admitted in its own published rules that the original radio-chip protection — a chip locked by the printed letters and numbers at the bottom of your passport — wasn't strong enough. They added a stronger version in later passports. Most of the older passports already in circulation still carry the weaker one.
Limited and eliminated are not the same word.
So the technical picture has changed. The threat has changed.
The protective tools that used to be unnecessary are no longer the same protective tools they were in 2017.
