NFC Relay Attacks

What Is a Relay Attack?

A relay attack is a man-in-the-middle attack where the attacker does not need to break any cryptography. Instead, they simply extend the physical range of a short-range communication protocol by relaying messages between the legitimate parties, who believe they are communicating directly with each other.

Think of it this way: NFC is designed to work at a distance of a few centimeters. This short range is supposed to guarantee that the cardholder is physically present at the terminal. A relay attack defeats this proximity guarantee by placing a proxy device near the victim's card and another proxy device near the terminal, with a fast wireless link between them.

The card thinks it is talking to a nearby reader. The reader thinks it is talking to a nearby card. In reality, the card and reader might be in different cities. All the cryptography - the dynamic tokens, the encrypted challenges, the session keys - works perfectly. The authentication succeeds because the relay faithfully forwards every message. The security fails because the proximity assumption is violated.

This makes relay attacks uniquely dangerous. They do not require breaking encryption or stealing keys. They defeat the security model by attacking the one thing that contactless protocols assume but cannot cryptographically verify: physical proximity.

How NFC Relay Attacks Work

sequenceDiagram
    participant Card as Victim's NFC Card
    participant Mole as Mole Device
    participant Link as Relay Channel
(BLE/WiFi/4G)
    participant Proxy as Proxy Device
    participant Terminal as Payment Terminal
    
    Note over Card,Mole: Location A - Near victim
    Note over Proxy,Terminal: Location B - At terminal
    
    Terminal->>Proxy: SELECT PPSE
    Proxy->>Link: Forward command
    Link->>Mole: Forward command
    Mole->>Card: SELECT PPSE
    Card->>Mole: PPSE Response
    Mole->>Link: Forward response
    Link->>Proxy: Forward response
    Proxy->>Terminal: PPSE Response
    
    Terminal->>Proxy: SELECT AID
    Proxy->>Link: Forward
    Link->>Mole: Forward
    Mole->>Card: SELECT AID
    Card->>Mole: AID Response + PDOL
    Mole->>Link: Forward
    Link->>Proxy: Forward
    Proxy->>Terminal: AID Response + PDOL
    
    Terminal->>Proxy: GET PROCESSING OPTIONS
    Proxy->>Link: Forward
    Link->>Mole: Forward
    Mole->>Card: GPO
    Card->>Mole: Cryptogram + Response
    Mole->>Link: Forward
    Link->>Proxy: Forward
    Proxy->>Terminal: Cryptogram + Response
    
    Note over Terminal: Transaction Approved
    Note over Card: Card never left victim's pocket

NFC relay attack on a contactless payment - the card never leaves the victim's pocket while a transaction completes at a remote terminal

An NFC relay attack requires two devices and a communication channel between them:

The mole device: Placed near the victim's NFC card. This device acts as a fake NFC reader, powering the victim's card and intercepting its responses. It can be a modified phone, a custom NFC reader, or purpose-built hardware. The mole needs to be within NFC range of the victim - typically a few centimeters, though this can be extended somewhat with a larger antenna.

The proxy device: Placed at the target terminal (payment terminal, door reader, etc.). This device acts as a fake NFC card, presenting the relayed responses from the victim's real card to the terminal. It uses card emulation mode to impersonate the victim's card.

The relay channel: A fast communication link between the mole and proxy devices. This can be Bluetooth, WiFi, cellular data, or even the internet. The only requirement is that the round-trip latency is fast enough that the terminal does not time out.

The attack flow is straightforward:

1. The terminal sends a command to what it believes is the cardholder's card (actually the proxy device)
2. The proxy forwards the command over the relay channel to the mole
3. The mole relays the command to the victim's actual card
4. The card computes the correct response (including any cryptographic operations)
5. The mole captures the response and sends it back over the relay channel to the proxy
6. The proxy presents the response to the terminal

Every cryptographic check passes because the actual card performed the computation with its real keys. The terminal sees a perfectly valid transaction.

Technical Deep Dive

Latency Requirements

The critical technical constraint for relay attacks is latency. NFC protocols have timing requirements, and if the relay adds too much delay, the transaction may fail.

ISO 14443 defines a Frame Waiting Time (FWT) that sets the maximum delay between the reader sending a command and the card responding. The FWT is configurable per card, with typical values ranging from about 5 milliseconds to over 4 seconds. Most contactless payment cards use relatively generous FWT values - often 300ms or more for complex operations like cryptogram generation.

This means the relay only needs to add less than a few hundred milliseconds of round-trip latency - well within the capability of Bluetooth (under 10ms), WiFi (under 5ms), or even a cellular connection (typically 20-80ms). Even a relay over the internet with a geographically distant server is often fast enough.

Protocol Transparency

A relay attack needs to be transparent to both the card and the terminal. This means the relay must handle the low-level NFC protocol details correctly:

Collision detection: The proxy must respond to the terminal's anti-collision commands with the UID or ATQA/SAK values from the victim's card, relayed from the mole.

Data framing: ISO 14443 data frames must be relayed intact, including CRC bytes and parity.

Timing: The proxy must meet the terminal's FWT requirements despite the relay latency.

In practice, the most straightforward implementation relays data at the application layer (APDU commands and responses) rather than the raw radio layer. This simplifies the relay but means the proxy must handle the initial anti-collision and activation independently, then begin relaying at the APDU level.

Hardware Approaches

Researchers have demonstrated relay attacks using several hardware approaches:

Modified smartphones: Two Android phones with NFC, one running a reader app (mole) and one running an HCE card emulation app (proxy), connected over WiFi or Bluetooth. This is the simplest approach and has been demonstrated by multiple research groups. The NFCGate app (from TU Darmstadt) is an open-source implementation of exactly this.

Custom hardware: Purpose-built relay devices using NFC transceiver chips (PN532, PN7150) connected to microcontrollers with Bluetooth or WiFi modules. Custom hardware can achieve lower latency and better reliability than smartphone-based relays.

Wired relay: For proof-of-concept demonstrations, researchers have used wired connections (USB, Ethernet) between two NFC interfaces. This eliminates wireless latency variability and makes the relay extremely fast, but is less practical for real attacks.

Relay Attacks on Contactless Payments

Contactless payment is the highest-profile target for relay attacks. The attack scenario is compelling: one attacker gets close to the victim (in a crowd, on public transit, in a queue) while a confederate makes a purchase at a store's payment terminal.

The Attack Scenario

The mole attacker carries a device (possibly hidden in a bag or large phone case) that can power and communicate with the victim's contactless card through clothing or a wallet. The card does not need to be removed - most contactless cards will respond to a reader through several centimeters of material.

Meanwhile, the proxy attacker presents their device at a payment terminal. The terminal initiates a contactless payment sequence. Every message is relayed to the victim's card, which computes the correct cryptogram for the transaction. The payment goes through. The victim's card has authorized a purchase they know nothing about.

Why Cryptography Does Not Help

EMV contactless payments use dynamic cryptograms - each transaction generates a unique authorization code using the card's secret keys. This prevents simple replay attacks (capturing and reusing a previous transaction). But relay attacks do not replay old transactions. They create genuine new transactions authorized by the real card in real time.

The card has no way to know that it is talking to a relay rather than a legitimate terminal. The cryptographic protocol provides authentication (the card proves it has the right keys) and integrity (the transaction data cannot be modified in transit) but it does not provide distance bounding - it cannot verify how far away the terminal actually is.

Relay Attacks on Access Control

Physical access control is arguably a more concerning target than payment because the consequences can include physical intrusion rather than just financial loss.

Many modern access control systems use NFC-compatible credentials - DESFire, SEOS, or mobile credentials on smartphones. These credentials use strong cryptography and are resistant to cloning. But they are just as vulnerable to relay attacks as payment cards.

The attack scenario: one attacker gets close to the target employee (in the parking lot, at a coffee shop, in the elevator) and relays their badge credentials to a confederate standing at the building's door reader. The reader performs mutual authentication with the relayed credential, the door opens, and the confederate walks in.

This attack defeats even high-security credentials like DESFire EV3 or HID SEOS, which are otherwise very resistant to cloning. The cryptography is strong, but the proximity assumption is weak.

Demonstrated Attacks and Research

NFC relay attacks are not theoretical - they have been demonstrated repeatedly by security researchers:

2010 - Hancke, Mayes, Markantonakis: Early practical demonstration of NFC relay using custom hardware. Showed that the attack was feasible with off-the-shelf components and modest technical skill.

2012 - Roland and Langer: Demonstrated relay attacks on contactless payment cards using two Android phones. Showed that the relay latency of a Bluetooth connection was well within EMV timing requirements.

2015 - NFCGate (TU Darmstadt): Released an open-source Android app for NFC relay research. NFCGate uses two phones connected over a server, making relay attacks accessible for security research and demonstration purposes.

2019 - Multiple research groups: Demonstrated relay attacks over the internet with latency under 200ms, showing that the mole and proxy could be in different countries while still completing transactions within EMV timing requirements.

Various physical penetration tests: Security firms have reported using relay attacks against access control systems during authorized penetration testing engagements. The attacks typically succeed against any NFC-based credential that does not implement distance bounding.

Countermeasures

graph TD
    subgraph Distance_Bounding["Distance Bounding"]
        DB1["Ultra-tight timing\nmeasurement"]
        DB2["Speed-of-light\ndistance calculation"]
        DB3["Rejects relayed\nresponses as too slow"]
        DB1 --> DB2 --> DB3
    end
    subgraph Transaction_Limits["Transaction Limits"]
        TL1["Low-value cap\n(e.g., $100)"]
        TL2["PIN required\nabove threshold"]
        TL3["Cumulative limits\nforce PIN periodically"]
        TL1 --> TL2 --> TL3
    end
    subgraph User_Verification["User Verification"]
        UV1["Biometric on phone\n(Face ID/fingerprint)"]
        UV2["PIN/pattern unlock\nbefore NFC active"]
        UV3["User must actively\ntap - not passive"]
        UV1 --> UV2 --> UV3
    end
    subgraph Shielding["Physical Shielding"]
        SH1["RFID-blocking wallet"]
        SH2["Faraday sleeve"]
        SH3["Card only active\nwhen removed"]
        SH1 --> SH2 --> SH3
    end
    subgraph Behavioral["Behavioral Analysis"]
        BA1["Location mismatch\ndetection"]
        BA2["Velocity checking"]
        BA3["Unusual transaction\npattern alerts"]
        BA1 --> BA2 --> BA3
    end

Layers of countermeasures against NFC relay attacks - no single measure is sufficient alone

Defending against relay attacks is challenging because the attack does not break any cryptographic protocol. Several countermeasure approaches exist, each with trade-offs:

Distance Bounding

Distance bounding protocols attempt to cryptographically verify the physical distance between a reader and a card by measuring the round-trip time of challenge-response exchanges. Since electromagnetic signals travel at the speed of light, a relay that adds even a few meters of distance adds measurable delay at nanosecond precision.

The challenge is that NFC hardware typically cannot measure timing with nanosecond precision. The ISO standard for distance bounding (ISO/IEC 13157-2) exists, but practical implementation in commodity NFC hardware is limited. NXP's MIFARE DESFire EV3 includes proximity checking features, and Mastercard has published a relay resistance protocol specification, but widespread deployment is still in progress.

Transaction Amount Limits

Contactless payment networks impose transaction limits - typically $100-$250 depending on the country and card network. Transactions above this limit require a PIN or chip-and-PIN verification that cannot be relayed through a simple NFC relay. These limits cap the potential damage from a successful relay attack but do not prevent it.

Some card networks also impose cumulative limits, requiring periodic PIN verification after a certain number of consecutive contactless transactions or a cumulative spending threshold.

Mobile Device Authentication

Mobile payment solutions like Apple Pay and Google Pay offer a significant advantage over physical cards: they require user authentication (fingerprint, face recognition, or PIN) before activating the NFC interface. A relay attacker cannot trigger Apple Pay on a victim's phone without the victim's active participation.

This is one of the strongest practical countermeasures. A physical contactless card is always "on" - it will respond to any reader that powers it. A phone only activates NFC card emulation when the user explicitly authorizes it.

RFID Shielding

RFID-blocking wallets, sleeves, and Faraday pouches physically prevent the card from being powered by an attacker's mole device. The card is electrically shielded until the user deliberately removes it. This is a simple, effective countermeasure for physical cards - we cover the physics behind this in our Faraday cages article.

Behavioral Analytics

Payment networks use behavioral analysis to detect relay attacks after the fact. If a card is used at a terminal in New York and then 30 seconds later at a terminal in London, that is a strong indicator of relay fraud. Transaction velocity, geographic patterns, and merchant patterns can flag suspicious activity.

Attack Limitations

Relay attacks have practical limitations that make them harder to execute than they might appear on paper:

Proximity to victim: The mole must get within NFC range (a few centimeters) of the victim's card. This requires physical proximity - standing next to someone in a crowd, brushing past them, or reaching near their wallet. This is not impossible but it is not trivial.

Card orientation and distance: NFC coupling is sensitive to antenna alignment. The mole device's antenna must be close to and roughly parallel to the card's antenna. Achieving this through clothing and wallet materials can be unreliable.

Timing coordination: The mole and proxy attackers must coordinate their actions - the mole must be near the victim's card at the same moment the proxy is at the terminal. This requires real-time communication between the attackers.

Financial limits: Transaction amount limits cap the potential gain from payment relay attacks. The risk-to-reward ratio may not favor the attacker, especially given the availability of other fraud methods.

Forensic trail: The payment terminal records the transaction, including merchant identity and timestamp. The proxy attacker may be captured on the merchant's security cameras. This makes relay fraud riskier than purely remote fraud methods.

Conclusion

NFC relay attacks represent a fundamental challenge for any security system that uses contactless communication and assumes physical proximity. The attack is elegant in its simplicity - it does not break cryptography, does not steal keys, and produces perfectly valid authenticated transactions. It simply defeats the proximity assumption by extending the communication range.

For physical security professionals, the lesson is clear: NFC credentials are not immune to relay attacks regardless of their cryptographic strength. DESFire EV3 and HID SEOS are excellent at preventing cloning, but relay attacks bypass cloning entirely. Defense requires layered countermeasures: distance bounding where available, user authentication, transaction limits, behavioral monitoring, and physical shielding.

For individuals, the practical countermeasure is simple: use mobile payments (which require your active authentication) instead of physical contactless cards, or carry your cards in an RFID-blocking wallet.

The BLEShark Nano is a compact multi-protocol tool for wireless security research, supporting BLE 5.0 and 2.4GHz WiFi analysis for exploring the wireless interactions that surround us.

Get the BLEShark Nano - $49.99

This article is for educational purposes only. Conducting relay attacks on payment systems or access control systems without explicit authorization is illegal and may violate multiple laws including the Computer Fraud and Abuse Act and local equivalents.