Phones
Your phone is a reader, a card and a wallet — sometimes all in the same minute.
Almost every modern phone has an NFC controller: a 13.56 MHz radio and an antenna, usually in the middle of the back on Android and along the top edge on an iPhone. It's the same HF technology as a contactless card, and a phone can sit on either side of the conversation.
#Three jobs, one antenna
| Mode | The phone is… | You've done it when… |
|---|---|---|
| Reader/writer | the reader, powering a tag | tapping an NFC sticker, reading a passport, setting up a YubiKey |
| Card emulation | the card, answering a reader | paying at a till, taking the train, opening a door |
| Peer-to-peer | both, taking turns | Android Beam, now mostly retired in favour of Bluetooth and Wi-Fi |
#As a reader
A phone is a decent HF reader, and only an HF reader. There's no LF coil and no UHF radio, so a 125 kHz badge or a clothing tag is invisible to it, whatever app you install. Within HF:
- Android gives apps fairly low-level access. They can talk ISO 14443, ISO 15693 and FeliCa, and send raw commands.
- iPhone started out reading only NDEF, and Core NFC now allows a lot more, but apps have to declare up front what kinds of cards they'll talk to.
- Both read NDEF tags in the background: tap a sticker with a URL and a notification pops up without opening any app.
#As a card
When a phone pretends to be a card, it's running a smart-card applet. The question is where that applet lives:
- Secure element: a separate tamper-resistant chip, like the one in a bank card, wired to the NFC controller. Apple Pay works this way. The keys live in hardware that even the phone's own OS can't read.
- Host card emulation (HCE): since Android 4.4, an ordinary app can answer the reader itself. Google Wallet uses this for payments, with short-lived keys topped up from the cloud.
Apple kept card emulation to itself for years and began opening it to other apps in 2024, region by region.
#It's not your card number
Phone wallets use tokenisation: the wallet gets its own device account number tied to your card. Each tap also produces a one-time cryptogram (see Contactless credit cards). A shop's terminal never sees your real card number, and a phone that's lost can have its token switched off without cancelling the card.
#It's not a fixed UID either
Phones in card-emulation mode usually present a random UID that changes from tap to tap. That's good for privacy, and it's also why access systems that only check UIDs can't simply "add a phone". The phone has to carry a proper credential.
#Phones as keys
The same card-emulation trick now opens far more than ticket gates. The whole topic has its own page, Mobile credentials, and everything a wallet holds is on Mobile wallets; the short version:
- Transit: many wallets have an "express" mode that taps through gates without unlocking the phone. Recent iPhones can still do it for a few hours after the battery dies.
- Office badges and student IDs: wallet-based credentials, often built on the same smart-card technology as modern plastic cards. See Public-key cards.
- Car keys: an industry standard (CCC Digital Key) uses NFC as the close-range fallback, and ultra-wideband (UWB) for walk-up unlock.
- Doors and locks in general: Aliro, from the Connectivity Standards Alliance, aims to give phones one common way to act as an access credential over NFC, Bluetooth and UWB, instead of every lock maker inventing its own.
With Proxmark3
With a payment card in your phone's wallet, hold the phone on the HF antenna
and run hf 14a info a few times. Watch the UID change on every read.
With Flipper Zero
NFC → Read a phone that's showing a wallet card, then read it again. The UID is different each time: that's the random-UID behaviour in action.
With Your phone
For reading tags, see the phone as a tool: apps like NXP TagInfo and NFC Tools turn it into a pocket HF reader.