Newsletter, Podcast

Human In[Security] Weekly (Jan 26, 2026): Ghost Tapping, Sheriff’s Office, Grubhub Breach

3 weeks ago

3 min read

Cyber safety in plain English for busy people and their parents.

Today’s Menu (30-second skim)

Ghost Tapping: the “tap-to-pay” scam that steals your card by standing near you
“This is the Sheriff’s Office…” phone scam (spoiler: it’s not)
Grubhub breach + extortion claims (what it means for normal humans)

Ghost Tapping: when your wallet gets robbed… without leaving your pocket

What happened (plain English):
Criminals are reportedly using devices/apps to steal payment info from contactless cards and phone wallets by getting close to people in crowded places—airports, transit stations, concerts. It abuses “tap-to-pay” (NFC) tech.

Why it matters to you:
This is the 2026 version of a pickpocket—except they don’t need your wallet. If you don’t catch it fast, you’ll find out via a “Why did I buy 14 tacos in a city I’ve never visited?” alert.

How to protect yourself (do this):

Turn on transaction alerts for every card (fast detection is half the battle).
Prefer Apple Pay / Google Pay when possible (usually safer than the physical tap card).
Keep your phone locked when not in use.
Consider an RFID-blocking sleeve/wallet for physical cards.
In crowds, keep cards in a front pocket or a zipped compartment close to your body.

Published: Jan 29, 2026
Source: https://www.ksat.com/news/local/2026/01/29/cybersecurity-experts-warn-of-rising-ghost-tapping-scam-targeting-credit-cards-digital-wallets/

The “Deputy” phone scam: pay in Bitcoin or go to jail (lol, no)

What happened (plain English):
Scammers are calling people pretending to be law enforcement. They claim you owe money (missed jury duty, unpaid fines, etc.) and threaten arrest unless you pay immediately—often pushing Bitcoin, gift cards, or wire transfers.

Why it matters to you:
This scam works because it hijacks your nervous system: authority + urgency + fear. It’s especially brutal for older folks who are polite and don’t want “trouble.”

How to protect yourself (do this):

Treat this as a law of physics: real law enforcement won’t take payment over the phone.
Never pay with Bitcoin, gift cards, prepaid cards, or wire transfers for “fees” or “fines.”
If you’re unsure, hang up and call back using the official number from the agency’s website.
Teach your family the rule: “Real cops don’t take Venmo.”

Published: Jan 29, 2026
Source: https://wcti12.com/news/local/craven-county-sheriffs-office-warns-residents-of-phone-scam-impersonating-deputies

Grubhub breach + extortion claims: what normal people should do

What happened (plain English):
“` WCTI Craven County Sheriff’s Office warns residents of phone scam impersonating deputies The Craven County Sheriff’s Office is letting residents know about a scam in the area involving suspects who pretend to be deputies, claiming that the victim of Yesterday at 1:08 PM https://wcti12.com/resources/media2/16×9/970/1320/0x3/90/0293356a-8514-4fc3-b1cc-df745a4888cf-Scamalert.png Grubhub confirmed unauthorized individuals downloaded data from certain systems. Reporting suggests the company may be facing extortion demands. Grubhub says financial info and order history were not affected and that they stopped the activity.

Why it matters to you:
Even when card numbers aren’t stolen, breaches can leak enough personal info for scammers to run convincing follow-up scams (“Hi, I’m calling about your Grubhub account…”).

How to protect yourself (do this):

Change your password if you reuse it anywhere else (and if you do… we need to talk).
Turn on 2-factor authentication where possible (email, banking, shopping).
Don’t click “support” links—open the app/site directly.
Consider a credit freeze if you want set-it-and-forget-it peace of mind.

Source: https://www.bleepingcomputer.com/news/security/grubhub-confirms-hackers-stole-data-in-recent-security-breach/