I don't have an NFC-enabled device and I couldn't find any information about this in Google. What is it that protects me against an attacker with a portable NFC terminal charging payments by just bumping into me on the street? Do all NFC devices require user interaction to confirm payment?

I can see how a mobile phone might ask me to confirm the payment, but an NFC-enabled credit card is unlikely to have the input or output devices to prompt me for such a confirmation.

One major factor in NFC security is that near field is difficult to range-extend and so charge from a distance, but it has been demonstrated up to 115 cm. Which is not as crazy as the range extension for keyless car entry, but still significant.


3 Answers 3


The card is supposed to authenticate the reader, so that only legitimate (bank-issued) readers can access the card. This does not preclude a legitimate reader making fake payments, either because the merchant is dishonest or because the reader was stolen. The payment should be traceable though, and the bank should be responsible for any charge resulting of their lack of security.

Banks and other providers of financial services are waffling between always requiring a PIN (which is disruptive, and is vulnerable to terminal spoofing anyway) and not requiring a PIN for small transactions (which is risky, but practically required for use cases such as paying for a subway ticket when passing a fare gate).

Note the “supposed to”, “should”, etc. This is a new ecosystem, and the security expectations haven't crystallized yet. The security achieved by NFC cards and devices tends to be less than chip-and-PIN contact cards, but more than filling out the card number and expiration date on a web page.

  • 5
    This seems to be incorrect in that the card doesn't authenticate the reader at all. The reader does authenticate the card however. You can read the details off a card and get get a transaction approved by a card just using a PC or a phone, the card doesn't care where the commands are coming from.
    – Peanut
    Aug 5, 2013 at 17:32
  • 1
    I'd go for a system that requires me to simply press a button on the card while it's being processed. Just to confirm that someone is physically in possession of the card and intending to pay with it. This would preclude anyone charging me when it's in my pocket, without requiring a pin. A reasonable trade-off maybe?
    – RomanSt
    Apr 18, 2015 at 16:35

There is nothing to stop the NFC being read from a card in the UK according to this study conducted recently by a security firm called ViaForensics.

On a NFC enabled phone the article states that the NFC hardware is switched off when the screen is not lit.

original link (broken as of 2015-oct-27)

  • 2
    On an NFC-enabled phone, whether NFC is disabled when the screen is off is determined by power saving considerations, not by security considerations. One NFC use case requires NFC always-on (transportation), but this is a battery drain so vendors are divided as to what to do. Jun 28, 2012 at 18:15

you have to enter a pin to complete the transaction. source: http://www.google.com/wallet/how-it-works-security.html

  • 4
    How do you enter a PIN on a card?
    – curiousguy
    Jun 28, 2012 at 12:41
  • @curiousguy google.com/wallet/what-is-google-wallet.html
    – Thawab
    Jun 28, 2012 at 12:51
  • 3
    Not 100% correct @curiousguy the British bank Barclay's will ask for your pin to be typed into the NFC reader "occasionally". barclaycard.co.uk/personal/getting-more/contactless But that will be just to authorise a payment. I'm sure the information held on the NFC is probably still readable. Jun 28, 2012 at 14:05
  • 3
    @curiousguy - You need to stop being literal about everything. I don't even see the word "card" used in his answer. If a pin is required you would input it into the reader not the card.
    – Ramhound
    Jun 28, 2012 at 14:24
  • 1
    @Ramhound "I don't even see the word "card" used in his answer." No, but I see it in the question.
    – curiousguy
    Jun 28, 2012 at 15:34

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .