NFC Explained: Range, Modes and Relay Attacks for the Security+ Exam

NFC — Near Field Communication — is the very short range wireless technology behind contactless payments, transit cards, and badge readers. Its defining characteristic is the one in its name.

NFC works at roughly 4 centimetres. That extremely short range is not a limitation — it is the security model.

You have to deliberately bring two devices almost into contact. That physical requirement is what makes tap-to-pay acceptable, and it is why NFC questions on exams keep coming back to range.

The Technical Facts

• Frequency: 13.56 MHz, the same band as high-frequency RFID.
• Range: about 4 cm in practice, with a theoretical maximum near 10 cm.
• Data rate: 106, 212 or 424 kbps. Slow, which is why NFC is often used to bootstrap a faster connection rather than carry the data itself.
• Standards: ISO/IEC 14443 and ISO/IEC 18092, governed by the NFC Forum.
• Power: a passive tag needs no battery. The reader's field induces enough current to power it, which is why a transit card or a hotel key works forever.

The Three Operating Modes

Reader/writer mode. An active device reads or writes a passive tag — scanning an NFC poster, reading an inventory tag, programming a smart label.

Card emulation mode. The device pretends to be a contactless smart card. This is how phone-based payment works: Apple Pay and Google Pay put the phone in card emulation mode so the payment terminal sees a card.

Peer-to-peer mode. Two active devices exchange data directly. Historically used for Android Beam-style sharing; largely superseded by using NFC to trigger a Bluetooth or Wi-Fi Direct handover, which is the "bootstrap a faster link" pattern.

NFC Versus RFID

This comparison is very likely to appear.

	NFC	RFID
Range	~4 cm	Centimetres to many metres depending on band
Communication	Two-way	Usually one-way, tag to reader
Frequency	13.56 MHz only	LF 125 kHz, HF 13.56 MHz, UHF 860–960 MHz
Typical use	Payments, access badges, pairing	Inventory, asset tracking, toll tags, livestock

The clean summary: NFC is a subset of high-frequency RFID that adds two-way communication and a deliberately tiny range. Every NFC device is an RFID device; the reverse is not true.

Security

The short range makes casual interception genuinely hard, but "hard" is not "impossible", and exams test the attack names.

• Eavesdropping. Possible with sensitive equipment at greater than nominal range — demonstrations have worked at a metre or more. Payment data is encrypted at the application layer, which is the real protection.
• Relay attack. The important one. Two attackers with radios relay the exchange between a victim's card and a distant terminal in real time, defeating the range assumption entirely. Distance bounding and transaction timing limits are the countermeasures.
• Skimming. A reader brought close to a card or phone in a pocket or bag. Contactless payment limits and the need for device unlock mitigate it.
• Tag tampering. A malicious NFC tag replacing a legitimate one — an NFC poster or restaurant table tag reprogrammed to point at a phishing site. Worth knowing because it is cheap and common.
• Data corruption or denial of service by jamming the field.

The practical defenses: keep NFC off when not needed, require device unlock before a transaction, use tokenization so the real card number is never transmitted, and be sceptical of unattended public NFC tags.

Worth stating plainly: tokenization is what actually protects mobile payments. The terminal receives a device-specific token, not the card number, so intercepting it yields nothing reusable. The short range is a convenience property; the cryptography is the control.

Security+ (SY0-701) Exam Tips

• NFC range is about 4 cm and the frequency is 13.56 MHz. Both are directly examinable.
• Know the attack names: eavesdropping, relay, skimming, tag tampering.
• A relay attack defeats the range assumption, which is why range alone is not a security control.
• Know it alongside the other short-range technologies: Bluetooth, RFID, Zigbee, infrared.
• Disabling unused radios is the standard mobile hardening recommendation.
• Tokenization is the control that makes contactless payment safe.

A+ and Network+ Angles

A+ (220-1201/1202) covers NFC as a mobile device connectivity option alongside Bluetooth and hotspot tethering, including enabling it, pairing, mobile payment setup, and troubleshooting a tap that does not register — usually a case being too thick, NFC being disabled, or the antenna position on the specific phone.

Network+ (N10-009) places it among personal area network technologies with Bluetooth, Zigbee and infrared.

Key Takeaways

• NFC operates at 13.56 MHz over roughly 4 centimetres.
• Three modes: reader/writer, card emulation, and peer-to-peer.
• It is a two-way subset of high-frequency RFID with deliberately minimal range.
• Passive tags need no battery — the reader's field powers them.
• Relay attacks defeat the short-range assumption, so range is not the security control.
• Tokenization protects contactless payments, not proximity.
• It is often used to bootstrap Bluetooth or Wi-Fi rather than carry data itself.

Related reading: Bluetooth attacks · RSSI