This form of fraud exploits the ease of digital payments and the security gaps in retail apps, allowing criminals to turn small transactions into massive profits.
Imagine someone walking into a Lowe's, tapping a phone at the self-checkout, and walking out with a $95 gift card. Not a big deal on its own. Now imagine that happening hundreds of times a day across the country.
That is the new face of organized retail crime. Sophisticated criminal rings now rely on digital fraud techniques like tap-to-pay, stolen app credentials, and gift card schemes. Adam Parks, who serves as an assistant special agent in charge at Homeland Security Investigations, said, "We know that there are hundreds of individuals at any one time doing this across the country. Even though you think that's $95 every transaction, that adds up to a lot of money."
The math is stark. Since January 2024, HSI's Project Red Hook has made 239 arrests.
The fraud follows a straightforward process. First, criminals send out mass text messages about unpaid tolls or pending arrests. Those phishing links steal credit card numbers and personal info.
Get the market news that matters in a five-minute read with Market Briefs, our free daily newsletter
Then they load the stolen card into a digital wallet on their own phone. At the store, they tap the phone at the self-checkout to buy gift cards or merchandise.
Criminals orchestrate the scheme to avoid detection. Scott Glenn, The Home Depot's vice president of asset protection, put it plainly: "It's very low risk for the bad actors. It's not the same thing as walking into a Home Depot, filling up a cart full of power tools, and then walking out. It's just not as visible."
Retailers prioritize convenience over security, leaving their apps vulnerable, according to Jeff Otto of Riskified. Criminals buy login credentials for as little as $1.50 on Telegram, and often use old email addresses to bypass fraud checks. Once inside, they can load a stolen credit card into a device they control. "When the bank reaches out to say, 'Hey, is that you loading the card?' They've already got access to the victim's email," Otto explains.
Law enforcement has made some progress. In spring 2025, the Knox County Sheriff's Office in Tennessee arrested more than a dozen suspects tied to Chinese organized crime. Captain Matt Lawson described how investigators had to search phones for hidden tap-to-pay apps disguised as games.
"They look like anime games. They kind of look like Pokemon characters. We would just kind of start tapping on them … and we would find the ones that were the actual tap-to-pay apps."
But the arrests mostly catch the lowest-level workers. Parks says the real organizers stay hidden: "So [they're] going to instruct you on how to go into a store, convert the stolen credit card information into acquiring goods and then now you're going to ship those goods back to China. That's where a lot of times we get our arrests, but that is the lowest level of the organization."
The proposed Combating Organized Retail Crime Act, which passed the House in May and is now part of the National Defense Authorization Act, aims to increase penalties and improve data sharing between retailers and law enforcement.
If the bill becomes law, it could mean stiffer penalties and better coordination between stores and police. For investors, the real question is how retailers respond. Companies like Lowe's, Home Depot, Walmart, and TJX are already spending heavily on security. Riskified and other fraud-prevention firms are seeing more demand.
But the trade-off between convenience and safety is not going away. If retailers tighten security too much, they risk annoying shoppers. If they do too little, fraud eats into profits. The cumulative cost of small transactions hits earnings and prices, making fraud detection a key investment metric.
Join Market Briefs, our free daily newsletter, for a quick daily rundown of the markets
