What Are NFC Relay Attacks—and Why They’re Surging
NFC relay attacks are smartphone security threats where criminals abuse Near Field Communication signals and malware to capture or redirect contactless payment data, tricking victims into handing over their card details or transferring money through seemingly legitimate mobile transactions. According to Kaspersky telemetry, NFC relay attacks on Android smartphones used to steal funds surged by 188% in the first four months of 2026 compared with the same period in 2025. From January to April 2026, Kaspersky cybersecurity solutions blocked 35,600 NFC-based Android attacks, up from over 12,300 a year earlier. These attacks target both mobile wallets and contactless cards, turning the convenience of tap‑to‑pay into a new contactless payment fraud channel. As threat actors refine their tools and sell them as malware‑as‑a‑service, Android payment security can no longer be treated as an afterthought.
How Criminals Weaponise Direct NFC Attacks
The first major category of NFC relay attacks is known as direct NFC. Here, attackers approach victims through messaging apps, posing as bank staff or service providers and claiming they need to verify the user’s identity or account. The victim is persuaded to install a fake financial app that is, in reality, Android malware from families such as SuperCard X, PhantomCard, NGate, or modified NFCGate tools. Once installed, the malware prompts the victim to tap their contactless credit card or debit card against the infected phone and enter the card PIN. The malware then captures the card data and PIN and sends them to the attackers, who can clone cards or abuse digital payment services. Because the victim believes they are dealing with a trusted party, this form of contactless payment fraud often succeeds without any obvious warning signs.
Reverse NFC: The Harder-to-Spot Mobile Wallet Scam
Reverse NFC attacks flip the usual flow of money, making them harder to detect and dispute. In this scheme, criminals distribute a malicious Android app and use social engineering to convince victims to set it as the primary contactless payment method on their smartphone. The application generates an NFC signal that ATMs recognise as the attackers’ card, not the victim’s. Victims are then instructed to visit an ATM and deposit money into a so‑called secure or temporary account using their phone. In reality, the funds are credited to accounts controlled by the scammers. Kaspersky experts note that reverse NFC has become more common than direct NFC, and that this newer pattern is harder to fight because “victims themselves transfer money to the attackers’ accounts and such transactions are hard to distinguish from legitimate ones.”
Practical Steps to Improve Android Payment Security
You can reduce your exposure to NFC relay attacks with a few disciplined habits. Disable NFC on your Android phone when you are not using contactless payments; this limits the attack surface for tools that try to trigger NFC payment flows. For physical contactless cards, use RFID‑blocking wallets or sleeves so that criminals cannot read card data from a distance with relay devices. Avoid installing apps from links sent over messaging apps, social media, or SMS, and never set an unknown app as your default payment method. Be wary of anyone asking you to tap your card to your phone or perform unusual operations at an ATM. A reputable security app can add another layer of defence by blocking known NFC relay malware and phishing sites before they compromise your mobile wallet or banking apps.
How Banks and Phone Makers Are Responding
Financial institutions and smartphone vendors are working to contain these growing smartphone security threats. NFC relay malware has already been packaged into malware‑as‑a‑service offerings, which makes it easier for more criminals to join in, so payment providers are under pressure to strengthen authentication and transaction checks for contactless payment fraud. This includes stricter verification of new contactless payment methods, tighter limits or extra checks for risky NFC transactions, and smarter detection of unusual ATM deposits linked to mobile wallets. Phone makers are also improving Android payment security by hardening the operating system, tightening NFC APIs, and promoting secure elements or tokenisation that reduce the value of stolen card data. While these defences continue to evolve, users remain a crucial line of protection, and staying alert to social engineering tricks is as important as any technical safeguard.
