A new payment scam is exploiting the convenience of tap-to-pay technology, potentially turning what appears to be a small charitable donation into a charge worth hundreds or even thousands of dollars.
The scheme targets people in busy public areas, where someone approaches them with a request to donate to a youth group, school fundraiser or another charitable cause. The victim may agree to give $5, $10 or $20, only to discover later that a much larger amount was authorized.
How the Tap-to-Pay Scam Works
The scam can look like a normal charitable solicitation.
A person asks for a small donation and offers a phone or payment reader for a contactless transaction. The problem is that the amount entered into the device may be dramatically higher than what the donor agreed to pay.
For example, someone who believes they are approving a $20 donation could actually be presented with a $2,000 transaction. If the donor taps without checking the amount displayed on the payment screen, the transaction may be authorized at the inflated value.
Police in Brentwood, Tennessee, previously warned about a version of the scheme involving people soliciting donations outside stores and using payment services including Square or Cash App.
Victims Have Reported Thousands in Losses
The financial consequences can be severe.
The Washington state attorney general's office received reports involving alleged solicitors near Seattle's waterfront. In one reported case, a person agreed to donate $15 but later discovered a $4,800 charge. Another person who intended to donate $20 reportedly found a charge of almost $5,000.
Seattle police have also warned about fraudulent digital-payment solicitations targeting visitors and others in busy areas. Investigators said suspects could manipulate handheld payment devices to charge substantially more than the amount victims had agreed to pay.
Tap-to-Pay Itself Is Not the Problem
The scam does not necessarily exploit a technical weakness in contactless payment systems.
Mobile wallets can use tokenization or virtual card numbers, which can help prevent a user's actual card number from being transmitted directly to a merchant. The vulnerability in this scheme is instead the transaction amount the customer knowingly or unknowingly approves.
If a payment terminal displays $2,000 and the customer authenticates that transaction, the payment network may treat it as an authorized purchase.
Scammers therefore rely heavily on distraction, speed and the assumption that people will tap without carefully reading the screen.
Never Hand Over an Unlocked Phone
Security experts also warn consumers not to give an unlocked phone to someone claiming to need it to complete a payment.
A stranger who gains access to an unlocked device could potentially view sensitive information, including email, messages, banking applications and other financial accounts, depending on the phone's security settings.
If a payment supposedly fails, consumers should cancel the transaction rather than allowing a stranger to troubleshoot their phone.
Simple Steps Can Help Prevent the Scam
The most important precaution is also the simplest: check the amount before tapping.
Before bringing a phone or card near a payment reader, carefully examine the amount displayed on the screen. If you agreed to donate $20, make sure the device actually shows $20.
Consumers should also consider these precautions:
- Keep control of your phone throughout the transaction.
- Be suspicious of anyone pressuring you to donate immediately.
- Research unfamiliar charities independently.
- Donate through the organization's verified website when possible.
- Enable bank and credit-card transaction alerts.
- Review bank and card statements after making donations.
- Never provide an unlocked phone to a stranger.
The Federal Trade Commission also recommends researching unfamiliar charities and avoiding pressure to donate immediately.
What to Do If You Were Charged Too Much
Anyone who discovers an unexpectedly large charge should contact their bank or card issuer immediately and explain what happened.
Consumers should save screenshots, receipts and other transaction information and monitor their accounts for additional suspicious activity.
If a stranger handled an unlocked phone during the encounter, consumers should also review financial and email accounts, change potentially exposed passwords and enable multifactor authentication where available.
Tap-to-pay remains a convenient way to make legitimate purchases, but the growing use of contactless payments also gives scammers another opportunity to exploit distracted consumers.
A single second spent checking the payment amount before tapping could prevent a small act of generosity from becoming a financial nightmare.
Also Read: FDA Approves New Pill That Nearly Doubles Pancreatic Cancer Survival