NFC Attacks

Tap & Steal? Targeting users with short-range wireless attacks

Introduction

Near Field Communication (NFC) is a short-range wireless technology that allows compatible devices to exchange small amounts of data when they are brought close together.

NFC is now commonly found in smartphones, contactless payment cards, access-control systems, transport cards, smart locks and identification systems. Its very short operating range is often considered a security advantage, but NFC is not automatically secure simply because two devices need to be close together.

Attackers can exploit weaknesses in NFC implementations, applications, authentication mechanisms or the systems connected to NFC devices.

What is NFC?

Near Field Communication (NFC) is a wireless communication technology derived from Radio-Frequency Identification (RFID).

Operating at 13.56 MHz, NFC is designed for very short-range communication, typically requiring devices to be within a few centimetres of one another.

NFC supports several different operating modes:

  • Reader/Writer – a device reads information from or writes information to an NFC tag.
  • Card Emulation – a smartphone or other device behaves like a contactless card.
  • Peer-to-Peer – two NFC-enabled devices exchange information.

NFC is deliberately designed for simple, short-range interactions. A user may simply tap their phone against a payment terminal, access reader or NFC tag and expect the transaction to happen automatically.

NFC has become ubiquitous in the modern world from paying in a shop, travelling on public transport, checking in to a hotel, or simply exchanging contact details with a client or friend.

That convenience is also what makes NFC an interesting attack surface.

How NFC attacks work

An NFC attack generally requires the attacker to get physically close to the target device or NFC system.

Unlike Wi-Fi or Bluetooth, NFC normally has a very limited communication range. However, specialised equipment can potentially extend the effective attack distance or improve an attacker’s ability to interact with NFC communications.

NFC eavesdropping

Although NFC is designed for extremely short-range communication, an attacker may attempt to intercept NFC communications using specialised radio equipment.

The attacker attempts to capture the electromagnetic signals exchanged between the legitimate devices.

Whether this is practical depends heavily on factors such as:

  • Distance between the devices
  • Antenna design
  • Transmission power
  • NFC implementation
  • Environmental interference
  • Whether encryption or authentication is being used

If sensitive information is transmitted without adequate protection, interception could potentially expose that information.

Modern payment systems generally use additional cryptographic protections, meaning simply capturing NFC traffic does not necessarily provide an attacker with useful payment credentials.

Relay Attacks

One of the more important NFC attack concepts is the relay attack.

Instead of directly breaking the cryptography protecting a transaction, the attacker attempts to relay communications between two legitimate devices.

For example:

Victim’s device → Attacker’s relay → Attacker’s second device → Payment terminal

The victim may believe their device is communicating with a legitimate terminal, while the terminal believes it is communicating with the victim’s legitimate device.

The attacker effectively extends the communication path between the two devices.

This is particularly significant for systems that rely heavily on physical proximity as evidence that two devices are close together.

NFC skimming

NFC skimming involves attempting to obtain information from contactless cards or other NFC-enabled devices without the owner’s knowledge. An attacker may use a reader to attempt to communicate with a nearby NFC device.

However, the information available from a contactless payment card depends on the specific payment technology being used. Modern payment systems are designed so that intercepted transaction information generally cannot simply be reused to make another transaction.

This means NFC skimming should not automatically be equated with obtaining a complete, reusable payment-card number.

The actual risk depends on the implementation and the information being exposed.

Malicious NFC tags

NFC tags are inexpensive and can be placed almost anywhere. An attacker could place a malicious or misleading NFC tag in a public location and trick users into interacting with it.

For example, a malicious tag could attempt to direct a smartphone to:

  • A phishing website
  • A fake login page
  • A malicious application
  • A fraudulent payment page
  • A website designed to exploit a browser vulnerability

The NFC technology itself may not be compromised, Instead, the attacker abuses the trust placed in the physical environment.

A user sees an NFC tag and assumes that tapping it is safe.

NFC tag replacement

A particularly simple attack involves replacing a legitimate NFC tag with a malicious one.

For example, an organisation might use NFC tags to provide services such as:

  • Building information
  • Equipment instructions
  • Payment services
  • Website links
  • Authentication

An attacker could physically replace the legitimate tag with another NFC tag containing malicious content.

Because NFC tags are often small and inconspicuous, the replacement may not be immediately obvious.

This makes physical security an important part of NFC security.

NFC relay and contactless payment

NFC is heavily used for contactless payments. This makes payment systems an attractive target for attackers.

However, modern mobile payment systems typically use multiple layers of security, including:

  • Tokenisation
  • Cryptographic authentication
  • Device authentication
  • Secure hardware
  • Transaction-specific data

Consequently, an attacker cannot normally simply copy the radio signal from one transaction and replay it indefinitely, but weaknesses in the surrounding system could potentially be exploited through techniques such as relay attacks, social engineering or compromised terminals.

This demonstrates an important security principle:

Breaking the communication protocol is not always necessary if the attacker can manipulate the system around it.

NFC data manipulation

Some NFC tags are designed to allow their contents to be rewritten. If an attacker can physically access such a tag, they may be able to modify its contents.

For example, a legitimate NFC tag might contain a URL link such as https://legitimate-site.example

An attacker could replace this data with https://malicious-site.example

A user may then unknowingly follow the malicious link after tapping the tag.

NFC tags used in public areas should therefore be appropriately protected against unauthorised modification.

NFC spoofing

An attacker may also attempt to impersonate a legitimate NFC device or tag.

For example, a malicious device could attempt to present itself as a legitimate NFC endpoint.

If the receiving system does not adequately authenticate the device or validate the data being received, the attacker may be able to manipulate the interaction.

The risk is particularly significant where NFC is being used for access control, authentication or identification rather than simply transferring harmless information.

NFC Denial-of-Service

NFC communications can also be disrupted. An attacker may attempt to interfere with the radio communication between legitimate NFC devices, preventing a transaction or interaction from completing.

Possible consequences include:

  • Failed contactless payments
  • Access-control failures
  • Interrupted device pairing
  • Unavailable NFC services
  • Repeated transaction failures

While this may not provide the attacker with access to information, it can still cause disruption.

Why NFC attacks matter

NFC is increasingly embedded into everyday systems and provides connectivity between various systems such as

  • Smartphones
  • Payment systems
  • Access control
  • Transport systems
  • Smart locks
  • Identification systems

This means that an NFC vulnerability may have consequences beyond the NFC communication itself.

For example, compromising an NFC tag might lead to a phishing attack, while compromising an access-control implementation could potentially provide physical access to a restricted location.

The security of NFC therefore depends not only on the wireless protocol but also on the applications, authentication systems and physical environments surrounding it.

Detecting NFC attacks

NFC attacks can be difficult to detect because the communication is extremely short-range and often happens within seconds.

Potential indicators include:

  • Unexpected NFC prompts
  • Unknown or suspicious NFC tags
  • Unexpected URLs appearing after tapping a tag
  • Unexplained contactless transactions
  • Repeated failed NFC transactions
  • Unexpected access-control events
  • NFC tags that appear physically altered
  • Devices attempting unexpected NFC communications

Organisations using NFC-based systems should monitor both the NFC interaction and the underlying application or transaction logs.

Preventing NFC Attacks

Several measures can reduce the risk associated with NFC.

  • Keep Devices Updated – Operating-system and firmware updates can address vulnerabilities in NFC implementations and associated applications.
  • Disable NFC When Not Required – Where NFC is not needed, disabling the functionality reduces the available attack surface.
  • Verify NFC Tags – Users should be cautious when tapping unfamiliar NFC tags, particularly those found in public locations.
  • Protect Writable Tags – NFC tags containing important information should be protected against unauthorised modification where possible.
  • Use Strong Authentication – Systems using NFC for access control or authentication should not rely solely on proximity. Strong cryptographic authentication should be used where appropriate.
  • Monitor Transactions – Payment and access-control systems should monitor for unusual transactions, repeated failures and anomalous activity.
  • Protect the Physical Environment – Because NFC attacks often require close physical proximity, protecting NFC tags, terminals and access-control equipment can significantly reduce the opportunity for attack.

Conclusion

NFC is designed to make short-range wireless interactions simple and convenient, but convenience can introduce security risks.

Attacks such as eavesdropping, relay attacks, NFC skimming, malicious NFC tags, tag replacement, spoofing and denial-of-service demonstrate the different ways NFC systems can potentially be abused.

The very short range of NFC should not be treated as a complete security control.

Physical proximity is not the same as authentication.

A secure NFC system should therefore combine the technology’s short operating range with strong authentication, encryption, secure applications and appropriate physical security.