Tap-to-Pay Charity Scams: The $800 'Donation' You Didn't Agree To

A Reddit user near Lumen Field in Seattle was approached by a well-dressed person asking for a $5 donation to support a youth basketball program. They seemed friendly and legitimate. They had a tap-to-pay terminal on their phone.

The user tapped their card. The solicitor frowned and said it declined. Could they try another card? The user tapped a second card. "Still not going through — let me try again." A few more taps. Smiles. Thanks. Gone.

When the user checked their bank statements later that day, they found multiple $800+ charges across both cards. The "charity" didn't exist. The tap-to-pay terminal had been configured to charge far more than the agreed amount — and the "declined" message was a script to get access to a second card.

The Reddit post went viral. Other victims came forward. The Washington State Attorney General issued a formal consumer alert. And reports are now surfacing in Portland, San Francisco, and Chicago.

The mechanics are simple but effective:

Step 1: The approach. Scammers work high-foot-traffic areas — stadium entrances, transit hubs, shopping districts, farmers markets. They're clean-cut, friendly, and often claim to represent a youth sports team, church group, or disaster relief fund. Some wear branded T-shirts. They have a phone with a mobile payment terminal (Square, Stripe, or a generic NFC reader).

Step 2: The small ask. They request a small donation — $3, $5, $10. An amount that feels effortless. Tapping your card for $5 feels less committing than handing over cash, which is precisely why they prefer contactless.

Step 3: The "decline" trick. After you tap, they tell you the transaction didn't go through. They ask you to try again, or try a different card. Each "retry" is actually a successful charge — often for $400, $800, or more. The terminal screen either shows nothing or is angled away from you.

Step 4: The exit. Once they've run enough charges, they thank you warmly and move on to the next target. By the time you check your statement, they're gone.

Cash donations have a built-in safeguard: you can see exactly how much you're handing over. A $5 bill is a $5 bill. Contactless payments remove that visibility.

When you tap your card or phone on a payment terminal, you're authorizing whatever amount the terminal requests — and most tap-to-pay transactions under $100 don't even require a PIN. The terminal operator controls the amount, not you. In a normal retail transaction, you see the amount on screen before you tap. In a street solicitation, the screen may be turned away, cracked, dimmed, or "not working."

Mobile payment terminals from Square, Clover, and similar providers are available to anyone. There's no charity verification step. You can register a terminal under any business name and start accepting payments within hours. The scammers in the Seattle cases used generic business names that didn't match any registered charity in Washington state.

This isn't a flaw in tap-to-pay technology — it's a social engineering attack that exploits the speed and frictionlessness that make contactless payments convenient in legitimate settings.

Legitimate charities are registered with the state and with the IRS as 501(c)(3) organizations. You can verify any charity before donating:

Ask for the organization's full legal name. Not "Youth Sports Fund" but the exact registered name. If they can't provide it, walk away.

Check it while they wait. Search the name on your state's charity registration database (every state attorney general maintains one) or use the IRS's Tax Exempt Organization Search. If it doesn't appear, it's not registered.

Offer to donate online. Every legitimate charity has a website with a secure donation page. If the person insists that tap-to-pay is the only way to give, that's a red flag. Real charities want your money however you're comfortable giving it.

The Washington Attorney General's alert specifically noted that the scammers in the Seattle cases were not registered as charitable solicitors — a legal requirement in Washington and most other states.

If you tapped your card for a "donation" and later discovered unauthorized charges, act fast — time matters for dispute resolution:

Call your bank or card issuer immediately. Report the charges as unauthorized. Under federal law (Regulation E for debit cards, Fair Credit Billing Act for credit cards), you have dispute rights — but they're strongest within the first 48 hours. Credit cards generally offer stronger fraud protection than debit cards.

File a police report. This creates an official record and may help other victims. Mention the location, time, and description of the solicitor.

Report to your state attorney general. In Washington, the AG's office is actively investigating. Other states have similar consumer protection divisions.

Report to the FTC. File at reportfraud.ftc.gov. Even if you get your money back from your bank, the FTC report helps build cases against organized fraud rings.

Freeze or replace the card. If the scammer captured your card data via the NFC terminal, they may attempt additional charges later. Request a new card number from your bank.

The Washington Attorney General alert focused on the Seattle metro area, but this pattern isn't staying local. Reports matching the same script — well-dressed solicitors, youth charity claims, tap-to-pay terminals, fake "decline" messages — have appeared on Reddit and local news from Portland, San Francisco, Chicago, and Austin in the past two weeks.

The playbook is easy to replicate: a $30 payment terminal, a convincing story, and a crowded sidewalk. There's no technical barrier to entry, no dark web forum required, no coding skill needed. This is a low-tech social engineering scam with a high-tech payment mechanism — and it's spreading because it works.

ScamSignal is primarily built to analyze digital messages — texts, emails, DMs. But if someone approaches you on the street and you want to verify their story, you can paste their organization name into ScamSignal's analysis box. If the "charity" is associated with known scam patterns, we'll flag it.