Everywhere a question like this is asked, I see people responding that (in a scenario where a card is used) the card does some processing with the data it receives/generates some data when it receives a signal. How is this possible without power?

And even if that's the case, why can't every NFC tag in, let's say, credit cards just be cloned because there are no variables in them and only static data? You'd think those RFID tags could be copied and used for transactions.

  • 31
    Why do you think they have no power? Every article I can find on even passive RFID and NFC mentions how they obtain power from the radio signals.
    – schroeder
    Commented Aug 1, 2016 at 22:53
  • 5
    @schroeder: They have no power source. They do indeed use wireless power from the radio itself. Commented Aug 2, 2016 at 1:09
  • 21
    @MooingDuck So the power source is wireless power from the radio itself. They don't have no power source... Commented Aug 2, 2016 at 4:38
  • 6
    There are RFID tags which can be cloned. Cheaper models always respond with the same number, so you can easily read that number and create an RFID tag which sends the same. Only the more expensive tags use a challenge/response protocol with actual encryption.
    – Philipp
    Commented Aug 2, 2016 at 11:31
  • 2
    Some RFID can be cloned. github.com/linklayer/BLEKey
    – Guntis
    Commented Aug 9, 2016 at 16:31

4 Answers 4


Because the cards contain a chip which are powered by a coil. The coil is not really a antenna, but half of a transformer.

Think your regular mobile charger. This contains a transformer, that will transform the voltage from 230V or 120V AC to 5V DC. This is done by having a coil magnetize some iron, and this iron magnetizes the "receiving coil". If you draw current from the receiving coil, the primary coil will also draw more current.

Now, let's go to the "passive" card again.

The reader is one half of a transformer, and the card is one half of a transformer, but this transformer does create a magnetic field in the air instead of magnetizing iron. When you put the card close to the reader, the reader and card becomes a full transformer, and thus the card can be powered, like it was connected to a battery.

For the reader to transmit information to the card, the reader only needs to vary the frequency or amplitude of the AC voltage that powers the primary coil. The card can sense this and act on this information. For the card to send information back to the reader, the card simply short-circuits its own antenna via a transistor and a resistor. This will, like the mobile charger, cause the primary coil, i.e. the coil in the reader, to consume more current, and the reader can sense this (by having the primary reader coil via a resistor and then measure the voltage over the resistor) and read the data the chip sends to the reader.

This means that half-duplex bidirectional communication is possible with RFID, thus the chip can do anything, and work like a contact smart-card. And as you know, a contact smart card with a security chip, that can securely store a key, and only perform operations with the key, is impossible to "clone" or "copy" as the key cannot be extracted. That's the security of smart cards, they cannot be cloned, and that's why they are preferred over magnetic strip cards.

Thus, the same applies to wireless/contactless RFID card.

  • 54
    I like how this answer also explains the low-level stuff like how the card actually gets powered and talks to the reader. Commented Aug 2, 2016 at 2:48
  • 37
    I forgot i wasn't on the electronics stackexchange for a second.. good answer.
    – James T
    Commented Aug 2, 2016 at 7:35
  • 3
    Disagree on the part of impossible to "clone" or "copy" . Anything that store digitally can be clone, just depends on difficulties and tech availability. security.stackexchange.com/questions/46319/…
    – mootmoot
    Commented Aug 2, 2016 at 11:11
  • 4
    @mootmoot Most smartcards do have special "tamper-resistant" circuity, that makes it impossible to "clone" or "copy" them. Some cards however, do have possibility to "clone" or "copy" with advanced microscopy and tampering, but if the card is a secure one, its impossible. Commented Aug 2, 2016 at 11:32
  • 4
    About the attack you referred to in the link, thats another thing. If the challenges issued is predictable, you can simply store a copy of these challenges and their replies. That does not mean the card is cloned, it just means that the reader asked for something you can know in-future and thus be able to "fool" the reader with a fraudulent card. But the card is still unclonable such as when vulnerable readers are updated to use sufficently unpredictable challenges, its really impossible to clone the card. Commented Aug 2, 2016 at 11:36

NFC (Near Field Communications) cards are not passive. NFC readers constantly transmit RF (radio frequency) energy; this is called a carrier signal. Very close to the reader (within about one wavelength, putting the "Near" in Near Field Communications,) the RF transmission is strong enough to induce enough energy into the receiving antenna to power the circuit in the card. The card contains a computer chip that has a CPU that can process received data, a small amount of static memory, and the ability to "transmit" a response (transmission is achieved by attenuating the carrier signal.)

Mag stripe cards (those that have no embedded chip) are passive. They have only "static" authentication data, which is probably what you're thinking of. The data is encoded on the stripe at the bank when it's issued, and it's always the same data, read after read after read. The mag stripe is technically very limited, and contains only a few pieces of information. They are the PAN (Primary Account Number), cardholder name, expiration date, service code, and a secret value called the CVV (Cardholder Verification Value). In total, no more than 79 characters can be encoded on the first track of a mag stripe.

NFC chip cards used for payments are programmed to emulate the same 79 characters that you might find on a mag stripe card, with a couple of exceptions: they can listen for variable data transmitted by the reader, they can respond with whatever the chip is programmed to send, and each card contains a secret key that is known only to the bank that issued the card.

To communicate, the reader sends the chip some data about the transaction including a random "challenge" number. The chip then encrypts the challenge value (and other transaction data) using the secret key stored in the card. The chip then emits this computed value in place of the CVV. This is called "dynamic" authentication data, because the number is different with every transaction and challenge.

The reason these cards are not easily clonable is that nobody but the bank knows the secret key hidden in the chip, so nobody else can produce a card that will react the same way to the challenge that came from the reader, thus the cloned card cannot produce the correct CVV. The bank is responsible for detecting the incorrect CVV and rejecting the request from the cloned card.

Not all the systems in use today are perfect. Researchers (and criminals) have figured out several attacks. Some cards are inherently insecure because they use weak encryption (such as the MiFare cards often used in transit systems.) Some cards have had their secret keys read by using side channel attacks, such as power analysis or timing analysis. Some have been examined using ion beam microscopy, revealing the bits containing the secret keys. And some banks did a poor job initially implementing their secret keys such that they didn't validate the CVVs correctly.

Once a system is properly implemented, chip cards are very very difficult to clone, whether they be NFC read or inserted into a chip reader.

  • I thought I had read somewhere that the billing address is also stored on the mag stripe? Commented Aug 3, 2016 at 15:40
  • 1
    @DanHenderson, no, the ANSI/ISO standards for the mag stripe do not include any address info. Track 2 has a 4-bit numeric character set, and includes PAN, exp date, service code, and discretionary data, and can be a max of 40 characters. Track 1 has a 6-bit alphanumeric character set and adds the cardholder name to the data, but that's basically the only difference between tracks 1 and 2. Track 3 is not normally used for financial cards. Non-standard cards (gift cards, loyalty cards, etc.) are free to encode whatever they want, of course, but they won't work in anyone else's readers. Commented Aug 3, 2016 at 20:46
  • Upon reflection, I think the context was that of a warning that a compromised reader could extract your personal info from the card; perhaps at one point, some issuers had put birth date and/or ZIP into the "discretionary data"? Commented Aug 3, 2016 at 20:57
  • It's possible that certain issuers have placed that kind of information in the discretionary data, but that would be for their own use. The contents of that field are not well defined, so a regular payment terminal such as you might find at a gas pump wouldn't know to look in that field for a ZIP code. And if you're sticking ZIP on the mag stripe for your own store's credit card, why not just look it up from your own database when you authorize their credit? Such a thing would likely be a historical leftover from the days before the PCI Data Security Standards. Commented Aug 3, 2016 at 21:53
  • 1
    @DanHenderson, I just remembered that most state IDs and Driver's Licenses have mag stripes that contain address and birthdate information. If you're using a mag stripe reader to check IDs at a liquor store to prevent underage purchases), that data is at risk. But those are not payment cards and don't follow the payment card standards. Commented Aug 3, 2016 at 22:44

How can RFID/NFC tags not be cloned when they are passive technology?

Your question assumes 2 things:

  1. That RFID tags cannot be cloned
  2. And they are passive, not active.

Both points are incorrect:

  1. RFID tags can be cloned. Tags which do not make use of password-protection or over-the-air (OTA) encryption can have their data banks copied into new tags.
  2. RFID tags (at least Class 1 Generation 2 tags, aka UHF RFID tags) are computationally active, not passive. Their "passive" nature refers to their not needing an attached power source.

RFID tags (at least "Class 1 Generation 2" tags) are transponders and they're powered by the very RF wave sent to query them.

The majority of RFID tags are not encrypted or have any secrets - they act like a barcode does and merely repeat the same information every time they're queried, in which case they can very easily be cloned.

However the Class 1 Gen 2 tags (at least) support features like passwords (the scanner includes a password in the RF signal sent to query the tags) and over-the-air encryption, though this is not a mandatory feature and not every Class 1 Gen 2 chip supports it.

Research has been done into the security of RFID, here is one such recent paper: The security of EPC Gen2 compliant RFID protocols.


I'll try to make it rather short and try to answer every question.

How is this possible without power?

There is power like usual. It works by the same electromagnetical principle as a transformer (which is contactless as well). Or like one of those modern(ish) contactless smartphone chargers where you just lay your phone on a plate instead of plugging it in anywhere. Or like an induction cooker (just with less power).

The fact that you do not need touch is just a technical detail; you can ignore it and treat it just like any other electrical connection.

there are no variables in them and only static data?

This is not necessarily the case. For example there are building access cards which have to be "loaded" (over the air) with the codes for the day each day to get access to certain locks. Or money cards which can be loaded up and "emptied" by paying stuff.

why can't every NFC tag ... just be cloned because

First, there is no reason to assume that the NFC tag behaves like a RAM module or USB stick, just presenting itself as a data storage device. That's not how it works.

There may be very simple NFC tags which are used as actual identification tags only; those can be made so they simply transmit their ID to whoever asks. This may be what a store can use to quickly scan some items (or to avoid theft). No secrecy is needed here, only identification. This likely the majority of all RFID tags produced.

If you want secrecy: things like money cards or building access cards with daily rotation of codes need onboard computing as well as some kind of encryption. Without going into details, this kind of encryption can be done in a way that the actual "secret" is safe inside the chip and not visible on the air at all. At no point do they allow to access the actual "secret", nor do they need to, similarly in the way that the secret keys in HTTPS/TLS never go in the clear over the insecure channel.

EDIT: replaced the last paragraph which could be read as TLS being used in RFID chips.

  • Compared to just passing data back and forth, TLS is very computationally intensive and needs quite a bit of storage space just for the crypto keys. I doubt a RFID or NFC tag or card has the processing power to do a full TLS-style encryption setup just for key exchange. That said, though, it's almost never needed; no need to use asymmetric encryption if symmetric crypto will do just as well. Which it does whenever both sides can store the key.
    – user
    Commented Aug 2, 2016 at 19:07
  • How would you use symmetric cryptography? The card cannot trust the reader (any reader can be used for tampering) and the reader can certainly not trust the card. You could even perform a man-in-the-middle attack with specialist devices. Please correct me if I'm wrong, but symmetric cryptography can only be used when both parties already trust each other (i.e. when they have already exchanged the key over a known secure channel, like one secured with asymmetric cryptography). But at that point, identity is already established, which is the main purpose of RFID.
    – sanderd17
    Commented Sep 8, 2020 at 7:43
  • @sanderd17, if you have the shared key pre-configured on both devices, then they can use it. They enc/dec the data they send/recv with the key. If the other party can read, that's cool. Otherwise communication cannot happen, which is the point I think. Idk if this is how RFIDs work though. It's just theoretically possible. But they can also use asymmetric encryption - diffie-hellman for example for key or short data exchange. Commented Nov 23, 2023 at 13:43
  • Maybe of interest, iopscience.iop.org/article/10.1088/1742-6596/1997/1/012028/pdf or patents.google.com/patent/DE102009022850A1/en (research and patents regarding asymmetric RFID encryption, including aspects of cloning)
    – AnoE
    Commented Nov 23, 2023 at 15:53

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .