Security assumptions that need testing
Two distinct threats sit under the broad heading of NFC security: spoofing and relay attacks. They work differently, demand different defences, and matter to different degrees depending on what your NFC tags are being used for.
Spoofing means creating a fake tag that presents the same identifier or data as a legitimate one. An attacker reads your tag, copies its NDEF record or UID onto a blank tag, and places the copy where visitors will scan it. For a museum exhibit label or a retail product sign, the practical risk is that someone redirects visitors to a malicious URL, replaces product information, or defaces content. The original tag remains untouched; the attack targets the user's expectation of what they will see after tapping.
Relay attacks are structurally different. Instead of copying data, the attacker intercepts a live conversation between a legitimate reader and a legitimate tag or card, forwarding the signals over a longer distance. A common real-world pattern involves two devices: one placed near the victim's contactless card in a pocket or bag, and another held near a payment terminal or access reader. The terminal believes it is talking to the card directly because the relay forwards the challenge-response handshake in real time. The tag does not need to be cloned; it just needs to be within range of the first relay device.
The critical distinction for operational planning is that spoofing attacks the content of the interaction, while relay attacks attack the proximity assumption—the idea that because a tag is close enough to be read, it must be physically present at the reader. NFC's designed range of a few centimetres provides some protection, but relay hardware deliberately extends that range, sometimes by tens of metres.
Why the Threat Level Varies by Use Case
For informational tags in museums, galleries, retail environments and event venues, spoofing is the more relevant concern. If a tag simply points a visitor's phone to a web page, the worst realistic outcome of a spoof is a redirected URL. Annoying and potentially harmful, but not a transactional loss.
For access control fobs, event wristbands with ticketing credentials, or any NFC token that unlocks something physical or grants entry, relay attacks become the primary threat. The attacker does not need to understand the credential format; they only need to bridge the gap between the legitimate token and the reader.
Preventive and detective controls
Understanding where each attack type applies helps you allocate security effort proportionally rather than applying the same measures everywhere.
Exhibit and product information tags. A museum placing NFC tags beside exhibits, or a retailer using them on shelf edges, faces a spoofing risk. Someone could peel off a legitimate tag, replace it with a copy pointing to a phishing page, or simply stick a fraudulent tag nearby. The mitigation here is partly physical—tamper-evident backing, secure mounting that makes removal obvious—and partly procedural, such as regular visual checks of tag placement. Because these tags serve public information, the consequence of a successful spoof is reputational rather than financial.
Event wristbands and access tokens. NFC wristbands used for festival entry, VIP area access, or staff zones carry a higher-stakes relay risk. An attacker with relay equipment near the entry gate could let an unauthorised person through by relaying signals from a legitimate wristband held by someone else nearby. Defences in this scenario typically sit in the reader and backend system—distance bounding protocols, timeout thresholds, and requiring the token to complete the handshake within a time window consistent with true NFC range—rather than in the tag itself.
Staff and facility access control. Office buildings and venues using NFC cards or fobs for door access face the same relay pattern seen in contactless payment attacks. The practical response combines physical security awareness (not holding doors open, reporting suspicious devices near readers) with system-level controls such as requiring a second factor or using reader hardware designed to detect timing anomalies in the handshake.
Dynamic QR as a comparison point. Where NFC tags point to dynamic QR-managed URLs, the server-side redirect logic adds a layer of control. Even if a tag is spoofed to present a different URL, a backend system can validate the request origin, flag anomalies, or require the tag's registered identifier to match an active campaign. This does not prevent the spoof itself but limits what the attacker can achieve.
Maintain security through the lifecycle
Mistaking Short Range for Immunity
The most persistent misconception is that NFC's few-centimetre range makes relay attacks impractical. Commercial relay equipment has been demonstrated working over significant distances. Range helps, but it is not a defence on its own. Treat NFC range as a factor that raises the difficulty of an attack, not one that eliminates it.
Conflating Spoofing with Relay
Treating these as the same problem leads to misapplied controls. Locking a tag against writes (covered in the neighbouring article on write protection) prevents someone from changing its content in situ, but it does nothing to stop an attacker placing a separate spoofed tag next to it. Similarly, relay defences such as distance bounding are irrelevant to a spoofing attack where the fake tag is genuinely at the reader. Map the control to the specific threat.
Assuming All Tags Carry Equal Risk
Not every NFC deployment needs relay-attack mitigation. A tag that does nothing more than open a web page about a painting cannot be relayed in a meaningful way—there is no credential to exploit. Applying payment-grade security to an informational tag adds cost and complexity without a corresponding reduction in risk. Classify your tags by what they unlock or grant, then match the security level to the consequence of compromise.
Overlooking the Reader Side
Security discussions often focus on the tag, but relay attacks exploit the reader's inability to verify true physical proximity. When evaluating access control or ticketing systems, ask the supplier specifically how the reader distinguishes a direct tap from a relayed handshake. Look for documented support for timing-based proximity checks, not just assurances that the system is "secure by design."
Key Checks Before Deployment
- Classify each tag type by what happens if its data is copied or its signal is relayed. Informational, transactional, and access-granting tags need different treatment.
- Ask access-control and ticketing suppliers what relay-defence mechanisms their readers implement, and request documentation rather than verbal assurances.
- Plan physical inspections for publicly accessible tags, particularly in environments where visitors can linger near exhibits or shelving without being challenged.
- Consider whether dynamic URL management on the server side can limit the damage of a spoofed informational tag by validating the tag identifier against an active asset list.
- Review whether a second factor—a PIN, a visual check by staff, or a time-limited credential—is proportionate for high-value access points.
Limitations to Keep in Mind
No practical NFC system can be made entirely immune to a determined, well-resourced attacker with physical access to the environment. The goal is to raise the effort and cost of an attack above what is worthwhile for the asset being protected. For a museum exhibit label, that bar is low; for a facility access system, it should be substantially higher. Be wary of suppliers who claim their NFC setup is "unspoofable" or "relay-proof" without explaining the specific mechanisms and their known limitations.
