Recent headlines about "ghost tapping" and tap-to-pay fraud have put NFC in the spotlight. Here's what that means — and doesn't mean — for TapTheMap and our venue partners.
A type of fraud known as "ghost tapping" has surged roughly 150% over the past year. Criminals use stolen card data or handheld devices that mimic payment terminals to trigger unauthorized charges through NFC — the same short-range wireless technology behind Apple Pay, Google Wallet, and contactless credit cards. They target crowded venues like malls, airports, and transit hubs, where close physical contact goes unnoticed.
Scammers typically test accounts with small $5–10 charges before attempting larger fraudulent transactions. Many victims don't catch the activity until they review their statements days later.
TapTheMap uses NFC stickers for venue wayfinding. We share the technology — but absolutely nothing else — with the systems being exploited. We want to be clear about the difference.
When a guest holds their phone near one of our NFC stickers — placed at a venue entrance, kiosk, or signage — a custom, phone-optimized venue map opens instantly in their browser. We also provide QR codes as a backup for devices that don't support NFC. No app to download. No account to create. Just tap or scan and go.
Our stickers are passive NFC tags. They contain a single web URL and nothing else. They have no battery, no processor, and no ability to read data from your device. The interaction is entirely one-directional: the sticker delivers a link, your phone opens it. That's the entire transaction.
Tapping a TapTheMap sticker is functionally identical to clicking a link on a website. It opens a map in your browser. It cannot read your credit card, access your digital wallet, or initiate any kind of payment.
We built TapTheMap with a privacy-first approach from day one. On the guest side, we collect no personal data, set no cookies, and perform no location tracking. Our analytics are strictly aggregate — map views, peak attendance days, engagement patterns — never individual user information. Venue operators upload their own branded maps and can update them in real time through our admin panel.
Our NFC tags are passive, one-directional, and contain nothing but a URL. Zero financial risk.
While these scams have nothing to do with our platform, we care about the communities our venues serve. Here's what security experts recommend:
Turn on real-time transaction notifications through your bank or card issuer.
Your bank will never ask for codes via unsolicited texts or emails.
Strong, unique passwords and MFA on any account tied to your finances.
Scammers test with small $5–10 charges before going bigger.
Affordable protection if you carry contactless cards in crowds.
Contact your bank directly using the number on your card.
If you're a venue operator or a guest with questions about how our NFC technology works, we'd love to hear from you.