I am currently trying to determine the best way to go about designing a system that integrates both barcodes and NFC passes.
The barcodes will be displayed on a phone screen. The barcode (2D, Aztec, as best for phones screens) will contain a 16 digit number which will effectively be a "pass ID", when querying the database you can see the holders name, balance etc. When this barcode is scanned, the merchant will be able to see an image of the account holder associated with the barcode to validate they are the owner. This data is obtained from a offline database (updated every 5 minutes) containing information about each pass. We could change the 16 digit number after each transaction, but as we want the NFC cards to reference the same balance, we haven't done this.
The NFC cards are new territory for me. I am familiar with common "hacks" used in Mifare classic cards, so at minimum we will use Mifare Plus cards. As far as I'm concerned, the NFC card simply needs to inform the NFC reader of its 16 digit number in the same way the barcode does so that the prepaid balance can be updated.
The worry I have with NFC cards is that the content can be cloned/edited which is far easier than it would be to do with the barcode (remember it's on a phone screen, not physical). To cheat with the barcode, you have to make an effort to obtain a visual image of someone else's pass, and even if that does happen we can simply blacklist the pass ID and refund the original owner on a new pass. With NFC I could just swipe my phone over someones pass, see their pass ID, update my pass ID and voila, I'm using their balance.
So in conclusion, I think what I am asking for is a professionals opinion as to whether I am thinking along the right lines. I appreciate I cannot just store a plain-text pass ID on the NFC card an expect no problems. I understand there has to be a form of encryption or way of preventing cloning/editing there. I would just like to know whether the concept I have provided sounds wise from a broad overview.
To be clear, the NFC cards would be optional for those that cannot display a barcode on their smartphone (e.g. the elderly, like a concessionary bus pass), as opposed to customers having both (which they could in theory, but would gain no advantage).