What Is NFC?
Table of Contents
NFC Basics
Near-Field Communication (NFC) is a set of short-range wireless communication protocols operating at 13.56MHz. If you have tapped a phone to pay for coffee, scanned a tag at a museum exhibit, or held your badge against a door reader, you have used NFC.
NFC is technically a subset of High-Frequency (HF) RFID. It operates at the same 13.56MHz frequency and shares much of the same underlying physics. But NFC adds specific protocols, standardized data formats, and peer-to-peer capabilities that make it more than just another RFID technology.
The NFC Forum, an industry consortium founded by Nokia, Philips (now NXP), and Sony in 2004, maintains the NFC specifications. These specifications define everything from the radio interface to the data formatting standards that allow different NFC devices to interoperate reliably.
NFC's defining characteristic is its very short range - typically 4cm or less, with a theoretical maximum around 10cm. This short range is not a limitation but a design feature. It provides a degree of physical security (you have to be very close to interact) and makes the user interaction intuitive: touch or tap the thing you want to interact with.
How NFC Works at the Physical Layer
graph TD
subgraph NFC_Communication["NFC Physical Layer"]
Initiator["NFC Initiator"] -->|"13.56MHz EM Field"| Coupling["Inductive Coupling\n< 10cm range"]
Coupling -->|"Powers passive device\nor establishes link"| Target["NFC Target"]
end
subgraph Active_Mode["Active Communication"]
A_Init["Device A\ngenerates field"] -->|"Sends data"| A_Target["Device B\nlistens"]
A_Target -->|"Generates own field"| A_Init
A_Note["Both devices have\npower sources"]
end
subgraph Passive_Mode["Passive Communication"]
P_Init["Reader/Phone\ngenerates field"] -->|"Powers tag +\nsends commands"| P_Target["NFC Tag\nno battery"]
P_Target -->|"Load modulation\nbackscatter"| P_Init
P_Note["Tag powered entirely\nby reader's field"]
end
NFC_Communication --> Active_Mode
NFC_Communication --> Passive_Mode
NFC physical layer showing active and passive communication modes
NFC uses inductive coupling between two loop antennas. The initiating device generates a 13.56MHz alternating magnetic field through its antenna coil. When another NFC device or tag enters this field (within a few centimeters), energy transfers from the initiator's coil to the target's coil through mutual inductance - the same principle that makes a transformer work.
NFC supports two communication modes at the physical layer:
Passive communication: Only the initiator generates the RF field. The target device (typically a tag or card) draws its power from this field and communicates by modulating the load on the initiator's antenna - a technique called load modulation. This is identical to how passive RFID works. The tag has no battery; it runs entirely on harvested RF energy.
Active communication: Both devices generate their own RF field when transmitting. Each device turns off its field when listening. This mode requires both devices to have a power source (like two smartphones communicating) and supports higher data rates.
NFC supports three data transfer speeds inherited from its underlying standards: 106 kbps (NFC-A, based on ISO 14443A), 212 kbps (NFC-F, based on FeliCa), and 424 kbps (also NFC-F). The most common speed for access control and payment is 106 kbps using the NFC-A modulation scheme.
The Three Operating Modes
graph TD
subgraph Reader_Writer["Reader/Writer Mode"]
RW_Device["NFC Device\n(Phone/Reader)"] -->|"Read data from"| RW_Tag["NFC Tag"]
RW_Device -->|"Write data to"| RW_Tag
RW_Examples["Examples:\n- Scan product tag\n- Read smart poster\n- Write URL to tag\n- Read transit card"]
end
subgraph Card_Emulation["Card Emulation Mode"]
CE_Terminal["POS Terminal /\nAccess Reader"] -->|"Reads emulated card"| CE_Phone["Phone acts as\nNFC Card"]
CE_SE["Secure Element\n(eSE / HCE / SIM)"]
CE_Phone --- CE_SE
CE_Examples["Examples:\n- Contactless payment\n- Mobile transit pass\n- Digital building badge\n- Digital car key"]
end
subgraph P2P["Peer-to-Peer Mode"]
P2P_A["Device A"] <-->|"Bidirectional\ndata exchange"| P2P_B["Device B"]
P2P_Examples["Examples:\n- Android Beam (deprecated)\n- Bluetooth/WiFi handover\n- Contact sharing\n- Small file transfer"]
end
The three NFC operating modes - each serves a fundamentally different use case
NFC devices can operate in three distinct modes. This versatility is what sets NFC apart from plain RFID.
Reader/Writer Mode
In reader/writer mode, the NFC device acts like a traditional RFID reader. It generates the RF field, powers passive NFC tags, and reads or writes data. Your phone reading an NFC tag on a product package, a museum exhibit, or a smart poster operates in this mode.
The NFC Forum defines a standard data format called NDEF (NFC Data Exchange Format) for storing data on tags. NDEF messages contain one or more NDEF records, each with a type and payload. Common NDEF record types include URLs, plain text, MIME media types, and smart poster records. This standardization means any NFC phone can read any NDEF-formatted tag, regardless of manufacturer.
Reader/writer mode also supports reading non-NDEF tags, including MIFARE Classic and DESFire cards. This is how apps like NFC Tools or TagInfo can analyze the contents of access control cards and transit passes.
Card Emulation Mode
In card emulation mode, the NFC device behaves like an NFC tag or contactless smart card. An external reader cannot distinguish between a physical card and a phone in card emulation mode - they respond with the same protocols.
This is the mode that enables mobile payments (Apple Pay, Google Pay), mobile transit passes, and digital building access badges. Your phone pretends to be a contactless card, and the reader treats it as one.
Card emulation can be implemented in two ways:
Secure Element (SE) based: The card emulation runs on a dedicated secure chip inside the phone (the embedded Secure Element or eSE). This chip is tamper-resistant hardware, similar to the chip in a physical smart card. Apple Pay uses this approach - the payment credentials live on the Secure Element, not in regular phone memory.
Host Card Emulation (HCE): The card emulation runs in software on the phone's main processor. Android supports HCE, which allows any app to emulate an NFC card without needing access to a hardware Secure Element. The trade-off is that software-based emulation is potentially less secure than hardware-based, since the main processor is more vulnerable to software attacks.
Peer-to-Peer Mode
In P2P mode, two NFC devices exchange data bidirectionally. Both devices are active (powered) and take turns transmitting and receiving. The protocol used is called LLCP (Logical Link Control Protocol), which provides connection-oriented and connectionless data transport.
Android Beam was the most visible P2P NFC application - you could tap two Android phones together to share URLs, contacts, or photos. Google deprecated Android Beam in Android 10, partly because the transfer speeds were slow and partly because Bluetooth and WiFi Direct offered better alternatives for file sharing.
P2P mode's most practical remaining application is connection handover - using NFC to bootstrap a faster wireless connection. Tapping two devices together can automatically negotiate a Bluetooth or WiFi Direct connection, using NFC only for the initial key exchange and pairing parameters.
NFC Standards and Tag Types
The NFC ecosystem involves several overlapping standards:
ISO 14443: The foundational standard for contactless smart cards at 13.56MHz. Defines two communication interfaces - Type A (used by MIFARE, DESFire, most payment cards) and Type B (used by some government ID cards). NFC is built on top of ISO 14443.
ISO 18092 (NFCIP-1): The core NFC standard defining the communication modes and data exchange protocols between NFC devices.
ISO 15693: A 13.56MHz standard for vicinity cards with longer read range (up to 1.5 meters) but lower data rates. Some NFC devices can read ISO 15693 tags, but it is not part of the core NFC specification.
FeliCa (JIS X 6319-4): Sony's contactless technology, dominant in Japan for transit (Suica, PASMO) and electronic money. NFC-F is the NFC interface to FeliCa.
The NFC Forum defines five tag types:
Type 1: Based on the Innovision Topaz chip. Simple, low-cost, 96 bytes to 2KB storage. Read/write capable. Rarely used in practice.
Type 2: Based on NXP NTAG and MIFARE Ultralight. The most common NFC tag type. 48 bytes to 888 bytes storage. Used in product tags, smart posters, and IoT applications. Very inexpensive.
Type 3: Based on Sony FeliCa Lite. Higher data rates (212/424 kbps). Primarily used in Japan. More expensive than Type 1 or 2.
Type 4: Based on ISO 14443 (compatible with DESFire). Supports encryption and larger storage (up to 32KB). Used for more complex applications requiring security.
Type 5: Based on ISO 15693. Longer read range. Used in industrial and pharmaceutical tagging.
Mobile NFC: Android and iOS
NFC is built into virtually every modern smartphone, but Android and iOS implement it very differently.
Android NFC
Android has supported NFC since version 2.3 (Gingerbread, 2010) and has the most open NFC implementation of any mobile platform. Android provides full read/write access to NFC tags, supports Host Card Emulation (HCE) for any app, and exposes low-level NFC APIs that allow developers to work with raw ISO 14443 commands.
For security researchers, Android's open NFC stack is valuable. Apps like NFC Tools, TagInfo, and MIFARE Classic Tool can read card UIDs, dump NDEF data, analyze card types, and even interact with MIFARE Classic sectors (on phones with compatible NFC chipsets).
Android also supports reading and writing NDEF tags, which makes it straightforward to program NFC tags for automation, marketing, or IoT applications.
iOS NFC
Apple was slower to open NFC capabilities to developers. iPhone 6 introduced NFC hardware in 2014, but it was locked to Apple Pay. Over subsequent iOS versions, Apple gradually expanded access:
iOS 11: Added NDEF tag reading (but not writing) through the Core NFC framework.
iOS 13: Added NDEF writing, ISO 7816 (smart card commands), MIFARE support, and ISO 15693. Also introduced background tag reading - iPhones can now scan NFC tags without opening an app.
iOS 14+: Expanded Core NFC with additional tag types and improved background reading.
Apple Pay uses the Secure Element for card emulation, and Apple tightly controls which apps can use card emulation mode. Third-party apps cannot freely emulate NFC cards on iOS, which limits some security research applications but also provides stronger security for payment and access credentials.
NFC vs RFID: What Is the Difference?
This is one of the most common questions, and the answer is straightforward: NFC is a specific type of RFID.
RFID is the broad category of technologies that use radio frequency electromagnetic fields to identify tags. RFID spans frequencies from 125kHz (LF) through 13.56MHz (HF) to 860-960MHz (UHF) and beyond. It includes everything from livestock ear tags to warehouse inventory systems to highway toll transponders.
NFC is specifically:
- HF RFID at 13.56MHz only
- Very short range (under 10cm by design)
- Supports three operating modes (reader/writer, card emulation, P2P)
- Has standardized data formats (NDEF)
- Supports active communication between two powered devices
- Governed by NFC Forum specifications
Every NFC interaction is an RFID interaction, but most RFID interactions are not NFC. A 125kHz HID ProxCard being read by an access control reader is RFID but not NFC. A UHF inventory tag being scanned in a warehouse is RFID but not NFC. Your phone reading a smart poster tag is both RFID and NFC.
The key differentiator is the P2P capability and card emulation mode. Traditional RFID is always a reader-tag relationship. NFC allows device-to-device communication and lets a powered device pretend to be a passive tag. These capabilities are what make NFC useful for smartphones and interactive applications.
Security Considerations
NFC's short range provides some inherent physical security - an attacker generally needs to be within a few centimeters to interact with an NFC device. But "few centimeters" is not zero, and several attack vectors exist:
Eavesdropping: While NFC's intended range is under 10cm, the RF signal can be detected at greater distances with sensitive receivers and directional antennas. Research has demonstrated NFC eavesdropping at distances up to 10 meters for the reader's signal and about 1 meter for the tag's response. The asymmetry exists because the reader's signal is much stronger than the tag's load-modulated response.
Relay attacks: An attacker can relay NFC communication over a longer-distance channel (Bluetooth, WiFi, or cellular), effectively extending the range of an NFC transaction. This is a significant threat to contactless payment and access control systems. We cover this in detail in our article on NFC relay attacks.
Data manipulation: In theory, an attacker could modify data in transit between NFC devices, though the short range and timing requirements make this difficult in practice.
Malicious tags: NFC tags can be programmed to redirect phones to phishing URLs, trigger unwanted actions, or exploit vulnerabilities in NFC parsing code. Social engineering attacks using malicious NFC tags placed in public locations (parking meters, ATMs, transit stations) have been documented.
The security of an NFC transaction depends heavily on the application layer. Apple Pay and Google Pay use tokenization and dynamic cryptograms that make eavesdropped data useless for replay attacks. A simple NDEF URL tag has no security at all. The NFC layer provides the communication channel; the application layer must provide the security.
Real-World NFC Applications
NFC has found its way into a wide range of applications:
Contactless payments: Apple Pay, Google Pay, and Samsung Pay use NFC card emulation to turn phones and watches into payment devices. Contactless credit and debit cards also use NFC (specifically ISO 14443).
Transit: Many public transit systems support NFC phones as virtual transit cards. London's TfL, Tokyo's Suica, and many others allow phone-based NFC payment for transit.
Access control: Digital building badges stored on phones, digital car keys (BMW, Tesla, Apple CarKey), and hotel room keys are increasingly using NFC.
Smart tags: Product authentication (verifying genuine products), interactive marketing (tap a poster to get a coupon), equipment pairing (tap to configure a Bluetooth speaker), and IoT automation (tap a tag to trigger a smart home scene).
Identity: Many modern passports and national ID cards contain NFC chips that store biometric data and can be read by NFC-equipped phones for identity verification.
Conclusion
NFC is a focused, short-range subset of HF RFID that has become the standard for contactless interaction between smartphones and the physical world. Its three operating modes - reader/writer, card emulation, and P2P - give it versatility that traditional RFID lacks.
Understanding NFC is foundational for anyone working in physical security, mobile development, or IoT. The technology is everywhere, embedded in billions of phones and cards, and its role continues to expand as more physical credentials and interactions go digital.
For hands-on wireless protocol exploration, the BLEShark Nano supports BLE 5.0 and 2.4GHz WiFi analysis - a compact tool for building your understanding of the wireless technologies that surround us.
Get the BLEShark Nano - $36.99+
This article is for educational purposes. NFC security research should only be conducted on systems you own or have explicit authorization to test.