HOUSTON – A little beep at the register is the sound of business. But for one Montrose restaurant owner, it’s also come with a costly question mark.
Leighton Dickson, owner of Leighton’s — House of Lamb and Ramen, says the convenience of tap-to-pay is turning into a serious problem. Since opening in May, his restaurant has dealt with 30 to 45 chargebacks — leaving him out more than $5,000.
“A customer comes in and evidently they’re using someone else’s debit or credit card that’s loaded onto their phone,” Dickson said. “They’re using the card and then we’re getting a dispute or a chargeback.”
Dickson says he partnered with his point-of-sale system, Toast, to dig into the data — and what they found painted a clear picture.
“You’ve got a 60-year-old lady who lives in Utah — you think she ordered $200 worth of lobster and lamb chops in Houston at 10 p.m.?” Dickson said. “And then the lady’s proven like, ‘Man, I haven’t left my house.’ It’s a lot of those types of things going on. It’s not even just to protect me — it’s more of an integrity thing, too.”
So how does someone else’s card information end up loaded onto a stranger’s phone in the first place? A cybersecurity expert at Intezer says most of the time, it’s not a sophisticated hack — it’s a trick.
Mitchem Boles, says it often starts with a phishing email or text that looks legitimate — one that gets the victim to hand over their card or login information without realizing it. Once a thief has that information, they don’t need the physical card. They can load it onto a phone and start spending immediately.
“If they have already tricked a victim into giving up their card information, the thieves are just using whatever biometrics they already have,” Boles said.
And when a chargeback comes in, it’s the business owner — not the bank — who often takes the hit.
“At that point, it falls on me to just take a loss,” Dickson said. “And that’s where I’ve taken over about $5,000 or so.”
Dickson says he’s now tightening up how customers can pay at his restaurant. if you’re dining in or taking out Leighton’s is asking you pay with a physical card or if you tapping by phone you need an ID that matches the card.
The policy changes have received little to no pushback from customers so far.
His advice to other business owners? Keep a close eye on your finances and track every chargeback that comes in — because by the time you notice a pattern, the losses can add up fast.
For consumers, the best defense starts with being skeptical of unsolicited emails or texts asking for card or login information — even if they look legitimate. If something feels off, it probably is.
Copyright 2026 by KPRC Click2Houston – All rights reserved.
Dining and Cooking