Ghost Tap: Contactless Payment Fraud, Must the Bank Reimburse?

Court of Appeal of Rennes (cour d’appel de Rennes), 2nd chamber, 26 May 2026, No. RG 24/00410 (on the regime applicable to the fraudulent enrolment of a card in a mobile payment wallet).

What Is Ghost Tap and Why Is It an Unprecedented Fraud?

Ghost Tap is a fraud technique that appeared in France at the beginning of 2026. It exploits a weakness not in the cards themselves, but in the chain by which cards are enrolled in mobile payment wallets. Its principle is as simple as it is formidable: making a bank card pay in a physical shop when it is in reality hundreds of kilometres away, on a fraudster’s phone.

Whereas “classic” card fraud often presupposes an online transaction or physical possession of the card, Ghost Tap severs the link between the card and the place of payment. The fraudster no longer needs your card: they only need to have succeeded, once, in enrolling it in their own wallet. Afterwards, “mule” accomplices spend the funds in shops, simply by holding their smartphone against the terminal.

What makes the phenomenon worrying is its growing scale. The European Association for Secure Transactions (EAST) noted an increase of about 25% in fraud on payment terminals in Europe in early 2025, largely attributable to NFC data relay and Ghost Tap. The tools required, originally designed for IT security research, now circulate on underground forums, lowering the technical level needed to commit the offence.

How Does an NFC Relay Attack Work in Practice?

To grasp the legal stakes, one must understand the mechanics. A Ghost Tap attack typically unfolds in five stages.

1. Theft of the data and of the validation code. It often starts with phishing (fake SMS messages from the bank, a delivery service or an official body) or with malware. The aim is not only to obtain the card number: it is above all to intercept the one-time validation code (received by SMS or notification) used to enrol the card in a mobile wallet.

2. Fraudulent enrolment in the wallet. With these elements in hand, the fraudster adds the stolen card to Apple Pay or Google Pay on their own phone. The card is now “tokenised” and ready to pay, without the victim suspecting anything.

3. Setting up the relay. Two smartphones equipped with an NFC relay application communicate via an intermediary server: one holds the enrolled card, the other will be presented in the shop.

4. Payment at the till. A “mule” holds their phone against the payment terminal. The terminal’s request is instantly relayed to the phone of the fraudster who holds the card. The terminal receives a valid response and authorises the payment, without detecting that the transaction comes from another location, which incidentally neutralises geolocation controls.

5. Serial cashing out. The operation is repeated, in several shops, until the victim notices the debits and stops the card.

The decisive point, from a legal standpoint, is this: the fraud succeeds only because a card could be enrolled in a wallet. Yet, as we shall see, this enrolment never relieves the bank of its duty to authenticate each payment afterwards.

Should the NFC “Ghost Tap” Be Confused with the Touch-Based “Ghost Tapping”?

A clarification is needed, as two frauds with similar names are circulating and sowing confusion.

Ghost Tapping (touch-based) refers to a malware attack that simulates gestures on a smartphone screen (taps, swipes, inputs) to steal credentials or trigger transactions without the user’s knowledge. It mainly targets Android and relies on abuse of the phone’s accessibility functions.

Ghost Tap (NFC), our subject, is quite different: it does not control your screen, it relays the contactless payment signal between two remote devices. It concerns Apple Pay and Google Pay alike.

In both cases, the technical modus operandi is different, but the legal fate of the fraudulent payments is governed by the same protective regime: that of unauthorised payment transactions.

Are These Payments “Unauthorised” Transactions Within the Meaning of the Law?

Yes, and this is the foundation of the whole defence of victims. Where the holder consented neither to the enrolment of their card in the wallet nor to the resulting payments, the situation falls within the scope of unauthorised payment transactions, governed by Articles L. 133-6, L. 133-7, L. 133-18 and L. 133-19 of the Monetary and Financial Code.

The principle is laid down in Article L. 133-18: in the event of an unauthorised transaction reported by the user, the bank must reimburse the amount immediately and restore the account to the state in which it would have been. Reimbursement is the rule; refusal is the strictly regulated exception. This regime, derived from the second European Payment Services Directive (PSD2), is deliberately protective of the user, who is regarded as the weaker party vis-à-vis the institution.

In other words: the sophistication of the fraud changes nothing. Whether the fraudster used a state-of-the-art NFC relay or a more rudimentary method, the characterisation remains the same, and the reimbursement mechanism is triggered as soon as the fraud is reported.

Who Must Prove the Fraud: You or Your Bank?

This is the most common misunderstanding, and the most costly for victims. Many believe it is up to them to demonstrate that they did not carry out the transactions. It is the opposite.

Article L. 133-23 of the Monetary and Financial Code is unambiguous: where the user denies having authorised a transaction, it is for the bank to prove that the transaction was “authenticated, duly recorded and accounted for and that it was not affected by a technical or other deficiency”. Better still, the text specifies that the use of the payment instrument or of the security data alone is not sufficient, by itself, to establish authorisation by the payer or fault on their part.

Applied to Ghost Tap, this means that it is not enough for the bank to assert that “the card was enrolled and the payment validated by the system”. The mere fact that the right card, the right token or the right phone were technically used proves nothing, neither your consent nor your fault. The Court of Appeal of Rennes applied this principle rigorously in its judgment of 26 May 2026.

Does Enrolling My Card in Apple Pay Amount to Authorising All Payments?

This is the decisive question, and the answer is no. The Court of Appeal of Rennes ruled on it head-on in a landmark case: a customer of an online bank had seen her card enrolled, without her knowledge, in Apple Pay on a third-party phone, after a simple confirmation by SMS. Eleven fraudulent transactions had followed, for a total of €6,667.56. The bank refused to reimburse, arguing that strong authentication had been “ensured at enrolment” and that the customer had been grossly negligent.

The court dismissed this argument in clear terms: “strong authentication means authentication of each of the transactions in question and not the validation of a means of payment”. The initial validation of the enrolment therefore does not cover subsequent payments. The bank was ordered to reimburse all of the sums, together with legal costs.

The logic is compelling. To accept that a single validation of the enrolment covers all future payments would amount to giving the fraudster a blank cheque: it would be enough for them to succeed once in enrolling the card on their phone and then plunder the account without limit. Ghost Tap is precisely the implementation of this scenario on an industrial scale. The Rennes case law sets a barrier against it: the bank remains bound to ensure the authenticity of each transaction, whatever wallet is used.

Can the Bank Raise “Gross Negligence” Against Me?

This is the institutions’ other main defence. Article L. 133-19, IV of the Monetary and Financial Code provides that the user bears the losses if they have committed gross negligence (négligence grave) in safeguarding their security data, for example by giving a code to a fake adviser.

Two major limits, however, greatly reduce the scope of this argument, and both work in favour of Ghost Tap victims.

First limit: the order of proof. Before it can even discuss any negligence, the bank must first clear the evidentiary hurdle of authentication transaction by transaction (Art. L. 133-23). As long as this proof is not provided, the debate on negligence is beside the point. This is exactly the reasoning of the Rennes court: since the bank failed to demonstrate the authentication of each debit and the absence of technical deficiency, the question of negligence was not even examined, and reimbursement was required.

Second limit: the absence of strong authentication. As will be seen in the next section, where the unauthorised transaction was executed without strong authentication, the customer bears no loss, unless they acted fraudulently, even if they were negligent.

That said, gross negligence is assessed in abstracto, in light of the signs of anomaly that an attentive user could have detected. Yet phishing and impersonation frauds have become so sophisticated (spoofed bank number, credible script, calibrated messages) that recent case law frequently rules out gross negligence: a customer acting in good faith, faced with an undetectable scheme, does not have to bear the consequences.

This trend could be strengthened further: in his opinion of 5 March 2026 (Case C-70/25), the Advocate General of the Court of Justice of the European Union considers that a bank cannot refuse immediate reimbursement of an unauthorised transaction by invoking the customer’s negligence, even gross negligence, the burden of any subsequent action for recovery then falling on the bank (see our analysis: gross negligence does not allow refusal of reimbursement). The Court’s final decision is expected in the coming months.

What Happens If There Was No Strong Authentication?

This is probably the most powerful angle for Ghost Tap victims. Article L. 133-19, V of the Monetary and Financial Code lays down a radical rule: unless they have acted fraudulently, the payer bears no financial consequence if the unauthorised transaction was carried out without the bank requiring strong authentication.

The consequence is considerable: if the enrolment in the wallet or the payments did not give rise to genuinely compliant strong authentication, the bank can not take refuge behind the customer’s negligence. Even a negligent customer does not have to bear a fraudulent payment that the bank let through without strong authentication.

For Ghost Tap, this shifts the whole debate to a precise technical point: was the enrolment of the card in the fraudster’s wallet protected by compliant strong authentication? If the card was added on the sole basis of a phished SMS code (a single factor, which can be circumvented), the legal requirement is not satisfied. And it is for the bank, not the customer, to prove that it actually implemented strong authentication within the meaning of Article L. 133-44 of the Monetary and Financial Code.

This hierarchy is a framework that can be transposed directly to Ghost Tap: at every level, the burden is on the bank, and the slightest missing link tips the dispute in the victim’s favour.

What Other Levers Can Be Used Against the Bank?

Beyond the regime of Articles L. 133-18 et seq., which remains the main ground, the victim can strengthen their case by questioning whether the bank has complied with its own technical security obligations.

Yet Ghost Tap leaves typical traces: a card enrolment on a new device immediately followed by a burst of unusual payments, often in shops and geographical areas far from the customer’s habits. Where a bank fails to detect such a manifestly atypical pattern, its compliance with its monitoring obligations may usefully be questioned. This is a lever that victims still under-use, and it deserves to be systematically examined alongside the regime for unauthorised transactions.

By contrast, reporting to the gendarmerie or filing a complaint, as well as any reporting steps taken by the bank, remain factually useful to the investigation but do not, in themselves, constitute the civil basis of compensation: this rests above all on the regime for unauthorised payment transactions.

What Should You Do If You Are a Victim of Ghost Tap?

Reacting quickly is your best ally, both to stop the fraud and to demonstrate your diligence.

As a preventive measure, a few habits greatly reduce the risk: never click on a link received by SMS or email, even one that appears official; install applications only from official stores; regularly check the permissions granted to applications; and activate payment notifications so as to be alerted in real time to the slightest debit.

Conclusion

Ghost Tap illustrates a reassuring truth: fraud evolves faster than security technology, but the law is already a step ahead. The NFC relay technique is unprecedented; the regime that governs it is not. Faced with payments that you never authorised, you do not have to justify yourself: it is for the bank to prove. And that proof is not satisfied by an initial validation of the wallet: it must cover the strong authentication of each disputed transaction. Failing that, the debate on your possible negligence is beside the point, and reimbursement is required.

For customers whose card has been misappropriated via Apple Pay, Google Pay or another mobile wallet, recent case law, foremost among which the judgment of the Court of Appeal of Rennes of 26 May 2026, provides solid support. If your bank refuses to reimburse you by invoking authentication “ensured at enrolment” or alleged negligence on your part, the firm LE BOT Avocat, dedicated to banking law, can analyse your case and take up the evidentiary battle on the basis of Articles L. 133-18 et seq. of the Monetary and Financial Code.

FAQ: Frequently Asked Questions