Police say tap-to-pay fraud fuels organized retail crime

A man wearing a black Air Jordan T-shirt walks into a self-checkout kiosk in Louisiana. lowe’s Last spring, he looked like any other customer.

Over the course of about seven minutes, he methodically summoned various gift cards worth $95 each, then used his cell phone to tap and pay for each card as employees in red vests surrounded him, surveillance video showed.

Police said that, unbeknownst to employees, the man was part of a sprawling Chinese criminal organization that used stolen credit cards to purchase gift cards while a group of Southeast Asian fraudsters guided him through each transaction via wireless headphones in his ear.

“We know of hundreds of individuals across the country doing this at any one time,” said Adam Parks, assistant special agent in charge for the U.S. Homeland Security Investigations, which investigated the case. “Even if you think it’s $95 per transaction, it adds up to a lot of money.”

After leaving the hardware store, the man bought more gift cards containing the stolen credit card information at other retailers, Parks said, but returned to the original Lowe’s store later in the day and repeated the act. He added that he has not been arrested and remains a suspect. Lowe’s did not respond to repeated requests for comment from CNBC.

Credit card theft and fraud are nothing new, but with the proliferation of tap-to-pay and the increased use of retail apps, these digital thefts are forming the next wave of organized retail crime, with Chinese gangs raking in as much as $1 billion a year, police said. Unlike typical retail theft, where criminals empty the shelves of big-box stores and resell items piecemeal on online marketplaces, this crime can be carried out in front of store employees or from a computer anywhere in the world.

“The risk to the bad guys is very low,” said Scott Glenn, vice president of asset protection. home depot. “It’s not the same as walking into a hardware store, filling a cart full of power tools, and then walking out. It’s become more of a preferred method in recent years because it’s not just less visible, it’s less obvious what’s going on there.”

Scammers have chosen to target retailers because their platforms, which house sensitive information such as credit card and personal data, do not have the same level of security as banks, industry experts and law enforcement say.

While there is no hard data on how much retailers are losing out on due to digital forms of retail crime, CNBC found about a dozen criminal cases affecting various retailers across the country that police said involved organized groups and low-level fraudsters.

Lt. Matt Lawson of the Knox County Sheriff’s Office in Tennessee, who said the cases are complex and often difficult for local authorities to handle, said the agency is investigating a fraud ring with ties to Chinese organized crime.

“It’s almost like you can get away with it,” he said, unless the theft reaches a certain threshold or rises to the level of a federal crime.

Tap-to-pay scams, in which scammers add stolen credit cards to their digital wallets and use them to purchase gift cards or merchandise, often begin with a familiar text message and end up with consumers’ identities being put up for sale on platforms like Telegram without their knowledge.

Scammers send a barrage of text messages warning consumers about unpaid bills, expired vehicle registrations, pending arrests, etc. in an attempt to scare consumers into providing credit card information, email credentials, or other sensitive data. Experts say AI has only made this scheme easier, as criminal groups can spread scams more quickly and make messages appear more legitimate.

“Once scammers have a person’s email password and credit card, they can load that credit card onto a device they control,” said Jeff Otto, the company’s chief marketing officer. there is a riskis a technology company that works with retailers like Foot Locker, Peloton, and BJ’s Wholesale Club to fight fraud.

“When a bank reaches out and says, ‘Are you charging the card?’ they already have access to the victim’s email and can often check the one-time passcode before the consumer knows,” he said.

Low-level opportunists involved in tap-to-pay schemes can operate independently by purchasing goods or gift cards and reselling them at a discount for cash.

But at the organized crime level in China, Parks said, this activity involves entire criminal networks. To return profits to China, Parks said criminal groups use tap-to-pay fraud to purchase gift cards, which are then used to buy high-value items that can be resold in China for high prices, such as American-style iPhones. This practice allows gangs to circumvent strict banking laws in both the United States and China and convert larger amounts of cash into the legitimate economy.

At the center of the strategy are foot soldiers like the Lowe’s customers who police say helped carry out the fraud, Parks said, whose numbers have grown as more Chinese people have crossed the U.S. land route in the years since the coronavirus pandemic.

People attempting to enter the country illegally often rely on smugglers and organized crime networks, leaving them with debts that must be repaid once they arrive in the United States.

“So (they) go into the store, tell them how to convert the stolen credit card information to get the products, and then they send those products back to China,” Parks said. “Often people get arrested there, but it’s at the lowest level of the organization.”

Tap-to-pay schemes can also include retail app fraud, where you steal someone’s credentials, log into their account, and use their stored credit card information to purchase goods or gift cards.

Riskified’s Otto showed CNBC how fraudsters can gain access to consumers’ retail accounts through data breaches, phishing, and social engineering (which involves piecing together publicly available information about someone to steal personal information).

CNBC has confirmed its login credentials. walmartThe app and website were being sold for between $1.50 and $2.50 on various Telegram channels, along with information about how long the account had been active.

“They have Yahoo addresses from 10 years ago, Gmail from 10 years ago,” Otto said. “These are older accounts and often pass more rudimentary fraud checks, because we tend to trust accounts that have been around for a long time. And in this case, these may be sold.”

Telegram did not respond to requests for comment.

The problem is compounded by the fact that many retail apps and websites don’t always have the same level of security as platforms such as banking apps, Otto said. On the surface, retail apps are about shopping, where consumers buy clothes, household goods, and cosmetics.

However, it also includes access to stored credit cards, sensitive personal information, and in some cases, the consumer’s store brand credit card. for example, Macy’s Customers can shop on its app and pay their Macy’s credit card bills using the same platform.

Otto said the retail industry “has a lot to do with the fact that they’re focused on convenience and conversion to maximize online revenue, so they don’t have bank-level security.” “They don’t want to add more friction.”

“The privacy and safety of our customers is our top priority,” Walmart said in a statement to CNBC.

“While we won’t disclose specific security measures, Walmart has systems in place to help detect fraud, prevent and respond to unauthorized account access, and we continually strengthen these protections,” the company said. “Additionally, complete payment card information is never stored in an unsecured format.”

CNBC investigated tap-to-pay incidents across the country and found a mix of low-level opportunists and organized crime syndicates.

Duncliff Labadie was arrested in Miami in January and accused of stealing nearly $95,000 using store-branded credit cards, primarily from TJX Companies’ TJ Maxx, Marshall’s and Home Goods, according to a police report. Police allege he accessed approximately 15 different customer accounts by making phone calls. sync bankthe card issuer, and a phone number he controls to the account. It is unclear what customer information Labady was required to provide to Synchrony in order to make changes to the account.

Once Labadie added his number to the account, he added the card to a digital wallet and was able to make dozens of transactions at TJX stores in the Miami area during the holiday shopping season without having a physical card, police said. He was arrested after TJX’s asset protection team reported suspicious activity to Synchrony Bank.

Labadie has maintained his innocence, but his lawyer declined to comment. A Synchrony spokesperson would not comment on ongoing investigations, saying the company is “fully cooperating with law enforcement.”

“Protecting our customers’ personal information and our technology systems is extremely important to us,” a TJX spokesperson said in a statement.

“We have measures in place across our systems and stores to identify and address potential fraudulent account activity,” the spokesperson said. “We also encourage customers to maintain strong online account security practices, such as not reusing passwords across websites or apps, and to immediately report any suspected fraudulent activity to their bank or credit card company.”

Extensive efforts are also underway to root out fraudulent schemes.

The Knox County Sheriff’s Office has arrested more than a dozen suspects with ties to Chinese organized crime since spring 2025, and officials say the suspects traveled across the country using stolen credit card information to buy gift cards and launder money.

Investigators examined mobile phones seized in connection with the incident and discovered that the suspects had used a special app containing stolen credit card information to disguise it as a game to avoid detection.

“They look like anime games. They look like Pokemon characters,” said Lawson, who investigates fraudulent organizations. “We started tapping on them a little bit…and found one that was an actual tap-to-pay app.”

At the national level, Homeland Security Investigations’ Project Redhook targets gift card fraud and other forms of digital retail crime. At least 239 people have been arrested since January 2024, HSI said, targeting some of the largest Chinese organized crime groups operating in the United States.

The retail industry and law enforcement agencies have been lobbying Congress for years to pass the Organized Retail Crime Control Act, saying it would improve information sharing and make it easier to tackle these types of complex cases. The bill passed the House in May and was recently included in the Senate as part of the National Defense Authorization Act. A vote is expected by the end of the year.

Lawson said he would like to see better information sharing.

“Law enforcement likes to hold on to information and sometimes doesn’t share everything and does some sort of compartmentalization. Even retailers are guilty of this.”

“The more information we have when we realize these people are breaking the law, the easier it will be to catch them,” he said.

— Additional reporting by Paige Tortorelli