How INETCO BullzAI® protects tap-to-pay transactions from PhantomCard attacks and other NFC relay fraud

What is a PhantomCard attack?

A PhantomCard attack is a type of near-field communication (NFC) relay fraud scheme. Victims are tricked into installing a fake security app and tapping their card against their phone to “verify” it. Malware relays the card’s stolen NFC data and PIN to an attacker-controlled server in real time. An accomplice at an ATM or POS terminal uses the relayed data to emulate the card and transact as if the physical card were present. Fraudsters typically start with small purchases to avoid detection before escalating to rapid fund depletion, delaying detection and increasing risk of losses and chargebacks.

Block relay-based PhantomCard attacks instantly

INETCO BullzAI protects contactless payments from PhantomCard and other relay-based attacks through end-to-end transaction monitoring and AI-driven behavioral analysis. Inspect every transaction payload and metadata field, correlating user, device, terminal and geolocation patterns in real time. Move beyond traditional rules and static limits to instantly detect fraudulent digital wallet and tokenized payment activity before it escalates.

DETECT

Detect anomalies that legacy systems miss by identifying transactions routed through anonymizing services common in relay attacks and analyzing every transaction payload and metadata field to uncover protocol-level POS Entry mode or EMV data inconsistencies, digital wallet use on previously unseen device IDs and geographic or network mismatches – such as a card being “tapped” at a terminal in one city while the mobile device is active in another

PREVENT

Instantly identify the physical and digital inconsistencies inherent in a relay attack, including transaction “burst” patterns – such as rapid successive “taps”, high-value spending from a mobile wallet provisioned minutes earlier or activity inconsistent with the cardholder’s historical behavior – using adaptive risk scoring and self-learning machine models that analyze every individual card, device and terminal

SHIELD

Rather than blocking entire IP ranges or ports, surgically stop or rate-limit a single fraudulent contactless transaction, compromised card or suspicious mobile device using rules-based alerts and AI-driven behavioral analysis