Police say tap-to-pay fraud is draining retailers and banks

Fraud rings are using tap-to-pay systems and retail apps to turn stolen card data into gift cards, merchandise and cash, according to law enforcement officials cited by CNBC. Police say the schemes have become a major form of organized retail crime because they can happen quietly at self-checkout lanes or online.

CNBC reported that investigators have tied some of the activity to Chinese organized crime groups that police say may earn as much as $1 billion a year from the fraud. The activity differs from store raids in which thieves empty shelves; investigators say many schemes instead rely on digital wallets, stolen logins and stored payment cards.

One case described by Adam Parks, an assistant special agent in charge with U.S. Homeland Security Investigations, involved a suspect at a Lowe’s in Hammond, Louisiana. Parks said the man used a phone to buy multiple $95 gift cards with stolen credit card information while being coached through wireless headphones by people connected to a Southeast Asian scam compound.

Parks told CNBC the suspect later bought more gift cards at other retailers and returned to the same Lowe’s that day. He said the man has not been arrested and remains a suspect. Lowe’s did not respond to CNBC’s requests for comment.

How the schemes work

Investigators and fraud specialists told CNBC the theft often starts with mass text messages about unpaid tolls, expiring registrations or possible arrests. Those messages are designed to push people into giving up credit card details, email passwords or other personal information.

Jeff Otto, chief marketing officer at fraud-prevention company Riskified, said access to both an email account and a credit card can let a fraudster add the card to a device they control. If a bank sends a one-time code to the victim’s email, the criminal may be able to retrieve it before the victim notices, he told CNBC.

Retail accounts are also targets because they can hold stored cards, personal information and access to store-branded credit cards. Otto said retail platforms often place more emphasis on shopping convenience than bank-level security. Walmart told CNBC that customer privacy and safety are top priorities and that it has systems to detect and respond to unauthorized account access.

CNBC reported seeing Walmart app and website credentials advertised on Telegram channels for $1.50 to $2.50, with details about account age. Telegram did not respond to CNBC’s request for comment.

Cases across the country

CNBC said it reviewed nearly a dozen criminal cases involving retailers including Lowe’s and TJX Companies. In Miami, police accused Dancliff Labady of stealing nearly $95,000, mainly through TJX store-branded cards, after allegedly adding a phone number he controlled to customer accounts, according to a police report cited by CNBC.

Labady has pleaded not guilty, and his attorney declined to comment to CNBC. Synchrony Bank, the card issuer, said it does not comment on ongoing investigations and is cooperating with law enforcement. TJX said protecting customer information and technology systems is important and urged customers to use strong account security practices.

In Tennessee, Capt. Matt Lawson of the Knox County Sheriff’s Office said his office has been investigating a ring with alleged ties to Chinese organized crime. Since spring 2025, the sheriff’s office has arrested more than a dozen suspects accused of traveling across the country, using stolen card data to buy gift cards and laundering money, CNBC reported.

Lawson said investigators found phone apps that held stolen card information while appearing to be games with anime-style icons. Homeland Security Investigations said its Project Red Hook, which targets gift-card fraud and other digital retail crime, has produced at least 239 arrests since January 2024.

Retailers and law enforcement groups have pushed Congress to pass the Combating Organized Retail Crime Act, which they say would improve information sharing. CNBC reported that the bill passed the House in May and was recently added as an amendment to the Senate’s National Defense Authorization Act.

This story draws on original reporting from CNBC.