Which attacks actually threaten NFC transactions, and which mechanisms counter each

01 / FIELD NOTE

Keep the decision tied to the operating context.

NFC carries transactions that touch money, doors and identity, so the realistic question is not whether the technology is secure but which attacks actually threaten it and which mechanism answers each. The range of the radio link — a few centimetres — already stops one whole class of attack, because an adversary has to be physically present at the moment of the interaction; the threats that remain are the ones that work at arm’s length or later. Naming each attack against its layer is the way to see where the defence actually lives.

The first is passive eavesdropping: a listener stands near the interaction and captures the radio exchange. The attack is possible, and its use is limited — the attacker collects an encrypted transcript of a transaction that may never recur, and the value of the capture depends on what the protocol lets through. The defence is partly physical, partly protocol: range confines who can listen, and the cryptographic exchange means the captured bytes are noisy ciphertext rather than plain data. The attacker who records an authentication handshake ends with a transcript of a secret that never crossed the air.

The phishing tag is the attack that uses the tap as bait. An attacker places a rogue tag over or in place of a legitimate one; the phone taps it and the tag directs the browser to a site that looks like the legitimate one, or triggers an unwanted download. Nothing in the radio layer can stop this, because the tag is doing exactly what a tag does — carrying an address. The defence is on the device and in the habit of acting on a tap: an application that validates the address it was handed, a user who does not enter credentials into a page that appeared from a tap.

Data manipulation and corruption target the meaning of the exchange: an attacker alters what is transmitted so the transaction that lands is different from the one intended, or the command is rendered useless and the transaction stops. This depends on the attacker being inside the exchange, and the defence is integrity — authenticated protocols that detect an altered message and abort rather than execute. The phrase to hold on to is that the protocol is the layer that decides whether a corrupted frame is a message or a failure.

The man-in-the-middle attack sits between the two devices and relays, observes and alters — a data-corruption attack extended by an active presence. Its classic counter is mutual authentication, where each side proves to the other that it holds a credential, so the middleman cannot stand in for either side without being detected. The reason NFC does not make this trivial is again range: inserting yourself into a few-centimetre interaction is not the same as intercepting a signal in the open air.

Theft of the device is the attack that bypasses the radio layer entirely: a stolen phone waved at a reader, sometimes even powered off, used to make a purchase. The counter is behavioural rather than cryptographic — the payment function must be reachable only in a state that requires the owner’s passcode or an active phone. The lesson generalizes: no radio security survives a device whose owner cannot say no.

Signatures build the trust chain that keeps a tap meaningful. A signed message carries a certificate chain ending in a root certificate a device already holds, so a phone can verify the origin of the data it just read without consulting a central server — the chain of trust is verified, then the action is performed. The chain is only as strong as its root, and a compromised certificate can be revoked, which is why the chain is visible: the device shows whose signature it relied on.

The trusted-tag mechanism answers the replay of a static record. An ordinary tag stores a fixed address that can be copied onto a second tag; a trusted tag instead generates a fresh cryptogram on every interaction, so the address it hands over is a one-time statement validated by the server — a copied interaction proves invalid the moment it is replayed. The two layers compose: signatures prove the source of what was read, per-tap values prove the read was fresh, and the short range proves the reader was physically present.

The honest limit is that every counter-mechanism answers one attack at the price of one dependency. Range defends against distanced attackers but not the person standing in line; signatures depend on a root that must stay trusted; per-tap values depend on the server being reachable when the tap happens. Security here is not a property of the radio link alone but of the whole chain — radio, chip, device, server and the person holding the phone. The question each design has to answer is which attack it is paying to defend against, and which dependency it accepts in exchange.