{"id":85,"date":"2026-08-15T10:32:48","date_gmt":"2026-08-15T10:32:48","guid":{"rendered":"https:\/\/tapcontact.ai\/blog\/are-nfc-cards-secure\/"},"modified":"2026-08-15T10:32:48","modified_gmt":"2026-08-15T10:32:48","slug":"are-nfc-cards-secure","status":"publish","type":"post","link":"https:\/\/tapcontact.ai\/blog\/are-nfc-cards-secure\/","title":{"rendered":"Are NFC cards secure? What the research actually says"},"content":{"rendered":"

“NFC? That’s not secure.” It’s probably the most common objection we hear \u2014 and it comes from somewhere real: headlines about contactless payment fraud. The prejudice deserves a serious answer, not a salesman’s shrug. So we went to the studies. The short conclusion: the documented NFC attacks target payments and access cards \u2014 things with money or doors on the other side. An NFC business card has neither.<\/strong> The risk that remains is a different one, it is small, and it is mitigated by design. Let’s go step by step.<\/p>\n

What researchers actually attack<\/h2>\n

NFC security research concentrates on two targets, and it’s worth seeing why.<\/p>\n

Relay attacks on payments.<\/strong> The ReCoil study (arXiv, 2020)<\/a> showed that, with carefully built passive coils, the read range of a payment<\/em> card can be extended from the nominal ~5 cm to about 49 cm \u2014 enough to “brush against” someone’s pocket in a queue. The target is the bank card’s authentication protocol, because there is money on the other side.<\/p>\n

Malware that relays through the phone.<\/strong> In 2024, ESET documented NGate<\/a>, Android malware that relays the victim’s bank card NFC traffic to the attacker’s phone next to an ATM. Note what the attack requires: the victim has to be phished into installing a malicious app<\/em>, entering bank credentials and tapping their own payment card against the infected phone. It’s sophisticated social engineering against payments<\/em> \u2014 not a weakness of the chip.<\/p>\n

As for the classic man-in-the-middle, the NFC-SEC whitepaper by Ecma International<\/a> \u2014 the standards body \u2014 rates the practical risk as low in typical use cases, precisely because of NFC’s very short operating distance and radio characteristics.<\/p>\n

Why none of this applies to your business card<\/h2>\n

An NFC business card is a passive tag<\/strong>: no battery, no processor running code, no secrets inside. It stores exactly one thing \u2014 a public link. The same link that’s in your email signature, on your LinkedIn and on the back of any paper card with a QR code.<\/p>\n

No relay attack is possible because there is no transaction to relay. There is no “cloning” worth anything because the content is public by definition \u2014 cloning your business card gets you… your business card, which is its purpose. And reading the tag requires physical proximity of centimetres: nobody “sniffs” your card from across the room. We explained the physics of the tap here<\/a>.<\/p>\n

The risk that DOES exist \u2014 and how design kills it<\/h2>\n

Let’s be honest: there is one real vector, documented in a Kaspersky advisory on malicious tags<\/a> \u2014 aimed mostly at tags in public spaces (posters, caf\u00e9 tables): an unlocked<\/em> tag can be rewritten to point at a phishing site, or physically swapped for another. It’s the NFC equivalent of sticking a fake QR sticker over a real one.<\/p>\n

The mitigations are well known \u2014 Kaspersky recommends them and we build with them:<\/p>\n