Scammers turn to ‘ghost-tapping’ retail fraud to launder funds

Chinese organized criminal groups in Southeast Asia are increasingly using stolen payment card information and retail fraud to launder their illicit proceeds.  

The technique demonstrates the sophisticated level of coordination among criminal actors as they attempt to move money derived from the massive scamming operations in the region. 

In a report released Thursday, researchers at Recorded Future’s Insikt Group detailed what they call “ghost-tapping” — when stolen payment card details are uploaded onto a burner phone and used in-person to purchase goods. (The Record is an independent editorial unit of Recorded Future.)  

Using social engineering, phishing and mobile malware, cybercriminals steal the card information and — by intercepting a one-time password intended for the victim — upload it to a device in their control. The researchers also found evidence of software that allows them to relay the card details to separate mobile devices. 

These phones are then offered up for sale on Telegram channels, where they are purchased by criminal syndicates. The syndicates use hired mules to make purchases with the phones, typically of luxury goods that are then resold on some of the same Telegram channels. 

Earlier this year, Singapore police warned the public to be vigilant of phishing scams targeting credit card details, saying that in the last three months of 2024 there were 656 reports of phished card credentials being connected to mobile wallets, with about $1.2 million in losses. They cautioned people not to enter their bank details into suspect e-commerce sites, and especially not to then plug one-time passwords into the same site. 

A hub for luxury shopping, Singapore has seen multiple arrests that bear the hallmarks of money laundering through ghost-tapping. In November 2024, police warned about a spike in foreigners tied to syndicates coming to Singapore to carry out retail fraud. Four Chinese nationals were arrested for allegedly conspiring to buy luxury goods on behalf of criminal groups. Singapore police also arrested two Taiwanese men in April for a similar offense.

The tactics reflect what the United Nations Office on Drugs and Crime (UNODC) described last year as a huge growth in scamming operations, which are buttressed by a vast criminal ecosystem that provides money laundering and technology services.

“The convergence between the acceleration and professionalization of these operations on the one hand and their geographical expansion into new parts of the region and beyond on the other translates into a new intensity in the industry — one that governments need to be prepared to respond to,” Benedikt Hofmann, UNODC acting regional representative for Southeast Asia and the Pacific, said at the time.

According to Inskikt Group researchers, the sales of ghost-tapping services are taking place on Telegram channels linked to Huione Guarantee, a criminal marketplace that facilitated billions in transactions before announcing it was closing down in May. 

Despite the purported closure, Huione’s “massive decentralized infrastructure” on Telegram is still being used to sell ghost-tapping services, the researchers said. Cybercriminals are also selling a range of services connected to ghost-tapping using two other platforms — Xinbi Guarantee and Tudou Guarantee — that are known alternatives to Huione for fraudsters.