Relay fraud is a payment attack that forwards a live contactless transaction from one device to another so a card, phone, or wallet appears physically present when it is not. Instead of copying card data, the attacker relays the NFC exchange in real time, abusing the normal behavior of tap-to-pay systems.
This matters because the payment terminal sees a valid-looking proximity interaction, which can defeat simple checks that only look for card presence. In practice, relay fraud is often combined with social engineering and malware: a victim may be tricked into opening an app, tapping a card, or keeping a call active while the attacker relays the transaction. Defenders reduce risk with strong transaction limits, device-level NFC protections, user awareness, and fraud detection that flags unusual timing, location, or session patterns.