it

Shambix

Firm specialized in digital consulting, business & marketing strategy, web & mobile development.

Via Tornabuoni 4, Florence, Italy

Copyright © 2009 > 2025 Shambix

NFC & Digital Wallet Payments: are they really safe?

By 2025, NFC (Near Field Communication) payments, digital wallets, and contactless technologies have revolutionized how we pay.

But as adoption has surged, so has a rapidly evolving threat landscape.

Let’s explore the real risks, the benefits, and the hard data behind mobile payments—and offer practical advice for both everyday users and tech professionals.

Table of Contents

Current Attack Trends & Known Exploits (2025)

Malware groups and rogue apps are more sophisticated than ever. In 2025, we saw large-scale attacks including:

  • SuperCard X – A malware campaign targeting NFC payments in Italy and Europe, focusing on real-time NFC relay attacks and social engineering.
  • NGate – Malware relaying NFC data from victims’ phones to attackers at ATMs, primarily impacting Czech banks.
  • PhantomCard – A Brazilian attack, camouflaging as “card protection” apps to capture NFC card data.
  • RatOn – A new Android banking trojan, combining overlay and relay techniques for high-impact fraud in Czech and Slovak markets.
  • AntiDot – A scalable MaaS platform for Android, using accessibility services for broad-based mobile payment theft.

And relay attacks like Ghost Tap are now globally commercialized, exploiting stolen credentials to make remote fraudulent purchases using the victim’s cards.
For details on relay exploits, see studies by Surrey & Birmingham Universities (USENIX, DEFCON 2025) and research exposed by Scienmag.

Additional threats include:

How NFC & Digital Wallets Protect You

Modern phone-based payments (Apple Pay, Google Pay, Samsung Pay) combine these layers:

  • Tokenization: Your actual card number is never stored or transmitted. Each payment uses a single-use random token, useless if stolen (Nuvei Guide).
  • Biometric or PIN Authentication: Each transaction is verified on-device, whether via fingerprint, face scan, or secure PIN (NMI Guide).
  • Hardware Security Elements: Apple Pay stores tokens in dedicated hardware (“Secure Element”), making attacks via app malware nearly impossible (IEEE Apple Pay vs Google Wallet Security Analysis).
  • Remote Device Controls: If you lose your device, you can remotely disable payments instantly (Sumsub Guide).

If used properly, these protections mean the vast majority of fraud schemes must rely on social engineering, malware distribution, or user mistakes (CyberDefenseMagazine). As a result, official and merchant-supported devices are favored over third-party apps (Tencent Cloud Techpedia).

Physical Card Risks & Fraud Stats

Data from the last 24 months shows traditional cards are more vulnerable than ever:

  • Physical card skimming and cloning continues to affect hundreds of thousands of cardholders annually, especially at ATMs, gas stations, and retail (Yahoo Finance UK, Jim.com).
  • Magstripe and EMV chip cards broadcast actual card data every time (Coinlaw, Jupiter Money).
  • Debit card compromises rose 96% in 2023. Nearly 315,000 compromised in the US alone (FICO Skimming Data).
  • Contactless (EMV chip) cards reduce some risks but still require no authentication under the payment limit: a lost card can be used instantly for tap-and-go (Scienmag).

For more on physical vs digital payment tech, see NMI Biometrics Guide and Nuvei Tokenization Guide.

Demystifying Common Mobile Payment Myths

Myth: “NFC is easily eavesdropped or skimmed.”
Reality: Range is limited (<3cm in most cases), and messages are encrypted and/or tokenized (GroundLabs).

Myth: “If I lose my phone, anyone can pay.”
Reality: Not unless you disable all device locks and biometric security. Remote wipe and disable features make mobile wallets more secure than cards (Tencent Cloud Techpedia, NMI Guide).

Myth: “Contactless cards and terminals always enforce payment limits and PIN checks.”
Reality: Recent research shows offline terminals can be tricked into accepting huge contactless payments without authentication (Scienmag, USENIX).

Myth: “All NFC is equally secure, no matter the app or card.”
Reality: Hardware security modules, proper tokenization, and official apps are crucial; rogue cards (e.g., MiFare Classic) remain highly vulnerable (SEC-Consult CVE-2025-8699 Advisory).

Myth: “Phones can initiate payments silently.”
Reality: All major wallet apps (Apple, Google, Samsung) require on-device authentication before transaction (Sumsub Guide).

Practical Advice

  • Never root or jailbreak devices used for payments.
  • Always enable biometric authentication or strong PIN locks.
  • Install payment apps only from official app stores.
  • Enable real-time transaction alerts on your banking/payment apps.
  • Only tap to pay on trusted, PCI-DSS-compliant terminals.
  • Be skeptical of unsolicited SMS/calls about your bank; don’t install any “security” app unless it’s directly from your bank’s official channels.
  • Immediately lock, wipe, or disable your device remotely if lost or stolen.

For IT professionals and merchants: Regularly audit terminal settings, update firmware, and configure all card readers to enforce the latest authentication protocols. Check the latest advisories (see SEC Consult advisory).

Platform Security: Apple Pay vs Google Pay vs Samsung Pay

  • Apple Pay: Data is isolated in the Secure Element hardware. Biometric security mandatory for every purchase. No known large-scale breaches as of 2025.
  • Google Pay: Uses Host Card Emulation (HCE), so data passes through Android OS, with risks if device is rooted/jailbroken. App and Google Play Protect help mitigate these.
  • Samsung Pay: Combines NFC and MST for legacy compatibility, includes Knox security and tokenization; root detection disables wallet on compromised devices.

See in-depth comparative analysis in this IEEE review.

Other platforms and regional systems (e.g., Brazil’s Pix, various European mobile money apps) largely follow similar architecture. Hardware, tokenization, biometrics, and remote admin are universally key.

For most users, NFC payments (with digital wallets) are currently safer than physical cards—when best practices are followed.

The main risks to consumers come from malware, relay attacks, and social engineering rather than weaknesses in the protocols themselves.
Physical card fraud, skimming, cloning, and loss remain more prevalent—and involve less friction for criminals. Modern chip cards (EMV) are far superior to magstripe, but still lack dynamic tokenization and biometric protections of mobile wallets.

Key Takeaways:

  • Use mobile wallets for daily transactions; keep one chip card as backup.
  • Never install payment apps outside official stores or click links in suspicious messages.
  • Enable biometric/PIN locks and real-time notifications for peace of mind.
  • Don’t panic about NFC “hacking”—use approved apps, keep your system updated, and stay informed about emerging threats.

Further Reading & Sources:

Stay safe, stay secure—and enjoy the ease of modern payments, with eyes open to the evolving risks.

The Author

Jany Martelli

Computer Scientist, Solutions Architect, IT Consultant, Developer, Professor.
Graduated in Computer Science, Tech Professional since 2009. I work every day with companies worldwide, from SME to corporate. From digital business consulting, to the development of custom IT solutions like web and mobile apps, to creating the optimal digital corporate tech environment and cloud infrastructure: I help companies work better and faster, with custom digital tools and comprehensive innovation strategies.