Near-field communication (NFC)

Near-field communication is a short-range wireless technology that works when two devices are brought within a few centimetres of each other. It grew out of radio-frequency identification and is standardised in ISO/IEC 18092 and related standards, compatible with the contactless smart card standard ISO/IEC 14443. An NFC device can read or write a passive tag, emulate a contactless card, or exchange data with another NFC device. Common uses include contactless payment, building access badges, transit tickets and tapping to start a Bluetooth pairing.

The short range is a design feature, not a security control. An attacker with a suitable antenna can eavesdrop from further away than the nominal range, and a relay attack can pass messages between a victim’s card and a distant reader so that a transaction completes without the victim knowing, a form of man-in-the-middle attack. NFC itself adds little protection to what it carries. Security comes from the application above it, for example payment schemes that use a cryptographic challenge and response so that a captured exchange cannot simply be sent again in a replay attack.

Exam relevance: a scenario is likely to describe a contactless card read without the owner’s knowledge. Candidates are expected to reject the idea that short range means safe, and to look for protection at the application layer.