What Is Ghost Tapping, and How Does It Hit a Restaurant's Terminal?

What is ghost tapping?

Ghost tapping is what happens when a criminal gets your customer’s card number, usually through a phishing text or email, loads it into a digital wallet like Apple Pay or Google Pay without the cardholder ever knowing, and then taps it to pay at a real register, in person. No physical card, no skimmer at your terminal, nothing your equipment did wrong. The card just works, because as far as the network is concerned it’s a valid card tapping a valid terminal.

Some coverage of this also uses “ghost tapping” to describe a separate trick, where a fraudster relays the NFC signal from a stolen phone in real time to an accomplice standing at a different register, so the tap that hits your terminal didn’t even happen at the wallet’s actual location. Both versions end the same way for you: a transaction that looked completely normal at the counter turns into a chargeback weeks later.

A Houston restaurant found out the hard way

Leighton Dickson opened Leighton’s, a restaurant in Houston’s Montrose neighborhood, in May 2026. Within a few months he was dealing with 30 to 40 chargebacks totaling around $5,000 to $6,000, according to Houston’s FOX26. Click2Houston’s reporting on the same case put the number of disputed transactions as high as 45. The pattern: stolen card numbers, loaded into mobile wallets, tapped at his restaurant’s real card terminal by someone who was never issued those cards.

It wasn’t a one-off. Spectrum News reported in October 2026 that a similar ring hit El Taco Society MX in Spring Branch, where the owner lost about $5,000, and roughly five other nearby businesses reported the same pattern around the same time. Houston police confirmed they’re investigating.

Who actually eats the loss

Here’s the part that should worry you more than the fraud itself: in both reported cases, the restaurant owner absorbed the loss, not the card issuer. A counterfeit physical card swiped on an old mag-stripe reader often shifts liability to whichever party didn’t support chip technology, and that protection is well established. A stolen card number that’s been properly loaded into a real digital wallet and tapped at a terminal that worked exactly as designed doesn’t trip that same mechanism. The transaction looks legitimate on your end because, technically, it was processed correctly. The fraud happened upstream, before the card ever reached your counter, and that’s exactly why it’s hard to fight after the fact.

Leighton Dickson’s response was to stop accepting tap-to-pay altogether. That’s one way to make the specific exposure go away, but it also means turning away a payment method a growing share of customers now expect, so it’s worth trying less drastic steps first.

Why this is showing up now

Digital wallets were built to make legitimate payments easier, not to create a new fraud channel, but the two features that make them convenient for customers, quick provisioning and no physical card check at the point of tap, are exactly what makes this scheme work. Loading a stolen number into a wallet takes minutes once a fraudster has it, and getting the number usually just takes a convincing phishing text. The Better Business Bureau issued a warning to small businesses after the Houston cases went public, which is a reasonable sign this isn’t a one-city problem. It’s not that Apple Pay or Google Pay have some new flaw, it’s that a phished card number has become very easy to turn into a payment method that looks completely ordinary at your counter.

What you can actually do

A few things make a real difference before you get to that point:

• Watch for the pattern, not just the amount. Multiple taps from different cards in rapid succession, or the same device tapping repeatedly with different account numbers, is the signature to flag, not any single transaction size.
• Ask your processor what transaction-velocity or amount limits they can set on your account, and whether they’ll flag unusual tap activity for review before it settles.
• Keep your own records tight. Time-stamped transaction logs and, where you have it, security footage tied to the terminal, matter if you do end up disputing a chargeback, even though the odds aren’t great.
• Train whoever’s running the register to notice odd timing: a customer who taps, walks away, and is replaced moments later by someone doing the same thing is worth a second look.
• Talk to your processor before disabling contactless entirely. Some offer monitoring tools or lower velocity thresholds that catch this kind of abuse without giving up the convenience your regular customers use every day.

If you want help reviewing what fraud monitoring your current setup actually offers, or you’re considering new hardware, get in touch and we’ll walk through it with you.

Sources: FOX26 Houston, Click2Houston, Spectrum News Austin, ID Stronghold.