Tap-to-pay fraud fuels organized retail crime, police say

When a man in a black Air Jordan T-shirt walked up to a self-checkout kiosk at a Louisiana Lowe’s last spring, he looked like any other customer.

Over the course of about seven minutes, he methodically rang up different gift cards for $95 each, using his phone to tap-to-pay for each card as a red-vested associate circled nearby, surveillance video showed.

Unknown to the employee, the man was part of a sprawling Chinese crime ring, using stolen credit cards to buy the gift cards while a Southeast Asian scam compound coached him through each transaction through the wireless headphones in his ears, police say. 

“We know that there are hundreds of individuals at any one time doing this across the country,” said Adam Parks, an assistant special agent in charge with U.S. Homeland Security Investigations, who investigated the case. “Even though you think that’s $95 every transaction, that adds up to a lot of money.”

After the man left the hardware store, he purchased more gift cards with stolen credit card information at other retailers only to return to the original Lowe’s the same day to repeat the act, Parks said. He was not arrested and is still a suspect, he added. Lowe’s didn’t respond to repeated requests for comment from CNBC. 

While credit card theft and fraud isn’t new, with the proliferation of tap-to-pay and growing use of retail apps, these digital thefts are shaping the next wave of organized retail crime and earning Chinese gangs as much as $1 billion annually, police said. Unlike typical retail theft operations — where criminals clear out shelves in big box stores and resell merchandise piece by piece on online marketplaces — the crimes can be carried out right under a store employee’s nose or from a computer anywhere in the world.

“It’s very low risk for the bad actors,” said Scott Glenn, vice president of asset protection at The Home Depot. “It’s not the same thing as walking into a Home Depot, filling up a cart full of power tools, and then walking out. It’s just not as visible, it’s not as obvious to what’s happening out there and so it’s become a more preferred method over the last several years.” 

Fraudsters have selected retailers as their targets because their platforms carry sensitive information such as stored credit cards and personal data but they do not have the same level of security as banks, according to industry experts and law enforcement. 

There’s no firm data on how much retailers are losing from digital forms of retail crime, but CNBC found around a dozen criminal cases across the country affecting a wide variety of retailers that police said involve a combination of organized groups and low-level fraudsters.

The cases are complex and often hard for local authorities to handle, said Capt. Matt Lawson of the Knox County Sheriff’s Office in Tennessee, who said he’s been investigating a fraud ring with ties to Chinese organized crime. 

Unless the theft hits a certain dollar threshold or rises to the level of a federal crime, “it’s kind of like they get away with it almost,” he said. 

Tap-to-pay fraud, which involves a fraudster adding a stolen credit card to their digital wallet and using it to buy gift cards or merchandise, often starts with a familiar text message and can end with an unwitting consumer’s identity up for sale on platforms such as Telegram. 

Fraudsters send out mass text messages warning about unpaid tolls, expiring car registrations or pending arrests that are designed to scare consumers into providing their credit card information, email credentials or other sensitive data. AI has only made the schemes easier, as crime groups can scale the scams more quickly and make the messages appear more legitimate, experts said.

“Once a fraudster has a person’s email password and credit card, they can load that credit card into a device that they control,” said Jeff Otto, the chief marketing officer of Riskified, a tech company that works with retailers including Macy’s, Peloton and Prada to fight fraud. 

“When the bank reaches out to say, ‘Hey, is that you loading the card?’ They’ve already got access to the victim’s email” and can often check it for a one-time passcode before the consumer notices, he said.

Low-level opportunists engaging in tap-to-pay schemes can operate independently, using the practice to either buy merchandise or purchase gift cards and resell them at a discount for cash. 

But on the Chinese organized crime level, the practice involves an entire criminal network, Parks said. In order to get profits back to China, crime groups use tap-to-pay fraud to buy gift cards and then use those gift cards to purchase high-value goods that can be resold at a premium in China, such as iPhones with American settings, Parks said. The practice allows gangs to skirt strict banking laws both in the U.S. and China and convert higher amounts of cash into the legitimate economy. 

At the heart of the strategy are foot soldiers such as the customer at Lowe’s who police say helped carry out the fraud, which in the years since the Covid-19 pandemic has ramped up along with a surge of Chinese nationals at U.S. land crossings, Parks said.

People looking to enter the country illegally often rely on smugglers and organized crime networks, and they then owe a debt that crime groups require them to pay off once they’re in the U.S.

“So [they’re] going to instruct you on how to go into a store, convert the stolen credit card information into acquiring goods and then now you’re going to ship those goods back to China,” Parks said. “That’s where a lot of times we get our arrests, but that is the lowest level of the organization.”

Tap-to-pay schemes also can include retail app fraud, which involves stealing someone’s credentials, logging into their account and using stored credit card information to purchase merchandise or gift cards.

Riskified’s Otto showed CNBC how data breaches, phishing and social engineering, which involves piecing together publicly available information about someone to steal their identity, can give fraudsters access to a consumer’s retail account.

CNBC saw that login credentials for Walmart‘s app and website were being sold on various Telegram channels for between $1.50 and $2.50 with information about how long the accounts had been active.

“They have Yahoo addresses that are 10 years old, Gmails that are 10 years old,” Otto said. “These are older accounts that often get past some of the more rudimentary fraud checks [because] we tend to trust accounts that have been with us for a long time. And in this case, these can be sold.” 

Telegram didn’t return a request for comment. 

Compounding the issue is the fact that retail apps and websites don’t always have the same level of security as platforms like banking apps, Otto said. On their face, retail apps are for shopping, places for consumers to buy clothes, household necessities or makeup. 

But they also contain stored credit cards, sensitive personal information and sometimes, access to a consumer’s store-branded credit card. For example, Macy’s customers can shop on its app and use the same platform to pay their Macy’s credit card bill. 

“It has a lot to do with the fact that they are focused on convenience and they’re focused on conversion, generating the maximum amount of online revenue, and because of that, they do not use bank-grade security,” Otto said. “They don’t want to add additional friction.”

In a statement to CNBC, Walmart said “customer privacy and safety is a top priority.” 

“While we won’t disclose specific security measures, Walmart has systems in place to help detect bad actors, prevent, and respond to unauthorized account access and is continuously enhancing these protections,” the company said. “In addition, full payment card information is not stored in an unprotected form.” 

In a review of tap-to-pay cases across the country, CNBC found a mix of low-level opportunists and organized crime rings. 

In January, Dancliff Labady was arrested in Miami and accused of stealing nearly $95,000 primarily using TJX Companies’ store-branded credit cards for TJ Maxx, Marshall’s and Home Goods, according to a police report. Police allege he obtained access to about 15 different customer accounts by calling Synchrony Bank, the card issuer, and adding a phone number he controlled to the accounts. It’s unclear what customer information Labady needed to provide to Synchrony to make the account changes. 

Once Labady added his number to the accounts, he was able to add the cards to his digital wallet and conduct dozens of transactions at TJX stores across the Miami area over the holiday shopping season without having a physical card, police said. He was arrested after TJX’s asset protection team reported the suspicious activity to Synchrony Bank.

Labady has pleaded not guilty and his attorney declined to comment. A spokesperson for Synchrony said it doesn’t comment on ongoing investigations and is “cooperating fully with law enforcement.” 

In a statement, a TJX spokesperson said “protecting our customers’ personal information and our technology systems is very important to us.”

“We have measures in place across our systems and stores designed to identify and address potential fraudulent account activity,” the spokesperson said. “We would also encourage our customers to maintain strong online account security practices, including not re-using passwords across websites or apps, and to report any suspected fraudulent activity to their bank or credit card company immediately.”

There have been broader efforts to root out the fraud schemes, as well.

Since spring 2025, the Knox County Sheriff’s Office arrested more than a dozen suspects with alleged ties to Chinese organized crime who officials said were traveling across the country and using stolen credit card information to purchase gift cards and launder money.

In a review of cell phones seized in connection with the cases, investigators found the suspects were using special apps that contained the stolen credit card information but disguised them as games to evade detection. 

“They look like anime games. They kind of look like Pokemon characters,” said Lawson, who’s been investigating the fraud ring. “We would just kind of start tapping on them … and we would find the ones that were the actual tap-to-pay apps.”

On a national level, Homeland Security Investigations’ Project Red Hook targets gift card fraud and other forms of digital retail crime. So far, it has led to at least 239 arrests since January 2024 and is targeting some of the largest Chinese organized crime groups operating in the U.S., HSI said.

For several years, the retail industry and law enforcement organizations have been lobbying Congress to pass the Combating Organized Retail Crime Act, which they say would increase information sharing and make these types of complex cases easier to tackle. It passed the House in May and was recently included as part of an amendment to the National Defense Authorization Act in the Senate. It’s expected to be voted on before the end of the year. 

Lawson said he’d like to see better sharing of information. 

“Law enforcement sometimes likes to hold information and not share everything and kind of compartmentalize it … even the retailers are guilty of this.” 

“The more information that we get out when we notice these people are breaking these laws” the easier it will be to catch them, he said.

— Additional reporting by Paige Tortorelli