The Signal 8/21/26 - Never tap your card because a caller asked you to

A newly documented Android attack turns a victim's own phone into a card reader for criminals: one convincing "bank" phone call, one sideloaded app, and then the killer move, "tap your card on your phone and enter your PIN to verify." Thirteen minutes, start to finish, including a loan taken out in the victim's name. Today: how tap-to-pay actually works, why the scam needs *you*, and the rules that end it.