NFC Relay Attacks: Wireless Tap Physical Access Bypass

TL;DR

NFC relay attacks use two devices to wirelessly forward contactless card signals, allowing attackers to unlock doors from hundreds of meters away while the legitimate card remains in the victim’s pocket. Traditional proximity cards offer no protection—the attack works in real-time with zero cryptographic bypass required. Defense requires distance-bounding protocols, anti-relay cards, or abandoning NFC for biometric/PIN-based access.

Table of Contents

• How NFC Relay Attacks Work
• Attack Range and Equipment
• Why Cryptography Doesn’t Stop Relay Attacks
• Real-World Attack Scenarios
• Detection Methods
• Defensive Countermeasures
• Summary
• Sources
• Important Links

How NFC Relay Attacks Work

NFC relay attacks exploit the fundamental assumption of proximity-based authentication: if a card responds to a reader, it must be physically close. This assumption is false when attackers use relay devices.

The Attack Chain

Component 1: Reader-Side Device (Mole) Positioned near the target access control reader. This device:

• Mimics a legitimate NFC card
• Receives challenges from the reader
• Forwards them wirelessly to the card-side device

Component 2: Card-Side Device (Proxy) Positioned near the victim’s card (in pocket, bag, or wallet). This device:

• Mimics a legitimate NFC reader
• Sends the relayed challenge to the victim’s card
• Captures the card’s response
• Forwards it back to the reader-side device

Communication Channel: The two devices communicate via WiFi, Bluetooth, or 4G/5G, enabling attacks across buildings or even cities.

Attack Flow

Step 1: Positioning Attacker places reader-side device near the target door’s card reader (hidden in ceiling tile, fake smoke detector, or handheld device).

Step 2: Victim Proximity Accomplice with card-side device approaches the victim in a public space (coffee shop, subway, building lobby).

Step 3: Authentication Relay

1. Attacker presents reader-side device to access control reader
2. Reader sends authentication challenge
3. Challenge is wirelessly forwarded to card-side device
4. Card-side device transmits challenge to victim’s card via NFC
5. Victim’s card responds (unaware it’s not talking to a legitimate reader)
6. Response is relayed back to the reader-side device
7. Reader-side device presents response to access control reader
8. Door unlocks

Total time: 50-100 milliseconds—fast enough that the reader detects no anomaly.

Why This Works

No cryptographic vulnerability required: The attack doesn’t break encryption, clone cards, or exploit software flaws. It simply extends the physical distance over which legitimate authentication occurs.

Victim’s card behaves normally: From the card’s perspective, it responded to a nearby reader. From the reader’s perspective, it authenticated a nearby card. Both are correct—the attacker simply bridged the distance.

No evidence of compromise: Access logs show the victim’s card was used at the correct time. Physical security teams see no indication of attack.

Attack Range and Equipment

NFC relay attacks are not theoretical—researchers and attackers have demonstrated practical implementations with off-the-shelf hardware.

Commercial Attack Tools

Proxmark3 RDV4

• Open-source RFID research tool
• NFC relay capability with custom firmware
• Range: 10-15 meters per device (20-30 meters total relay distance)
• Cost: $300-$500

Chameleon Mini/Tiny

• Pocket-sized NFC emulator
• Relay mode available in community firmware
• Range: 5-10 meters
• Cost: $50-$100

Custom ESP32-Based Relays

• Built using commodity WiFi/Bluetooth modules
• Extended range via directional antennas
• Range: 100+ meters per device (200+ meters total)
• Cost: $20-$50 in components

Maximum Demonstrated Range

Local relay (same building):

• WiFi relay: 300+ meters through walls
• Bluetooth relay: 100 meters line-of-sight
• 4G/5G relay: Unlimited—attacker in different city

2019 Research Demonstration (ETH Zurich): Researchers relayed a car key fob signal across 100 meters to unlock and start a Tesla Model S. Total equipment cost: $600.

2023 Physical Access Bypass (Security Conference Demo): Badge relay attack executed across 500 meters using 4G relay devices. Victim in conference hall, attacker at secured data center entrance. Door unlocked in 87 milliseconds.

Detection Difficulty

Reader logs show normal behavior:

• Correct card ID authenticated
• Authentication time within normal range (50-100ms)
• No failed authentication attempts
• No indication of relay

Video surveillance shows no tampering:

• No visible cloning equipment
• No physical contact with victim’s card
• No unusual behavior near access reader

Why Cryptography Doesn't Stop Relay Attacks

Modern access control systems use encrypted challenge-response authentication. This provides zero protection against relay attacks.

Challenge-Response Authentication Flow

Step 1: Reader sends challenge

Reader → Card: "Prove you have the secret key. Here's a random challenge: 0x7B3A92F1"

Step 2: Card computes response

Card internal: HMAC-SHA256(SecretKey, Challenge) = 0xA4E9...

Step 3: Card sends response

Card → Reader: "Here's my signed response: 0xA4E9D2C8"

Step 4: Reader verifies

Reader: "Response matches expected value. Access granted."

Why Relay Bypasses This

Attacker doesn’t need the secret key: The relay devices forward the challenge and response bit-for-bit. The card performs the cryptographic operation correctly—it just happens to be communicating through an extended range relay.

Encryption validates authenticity, not proximity: The cryptography proves “this response came from a card that knows the secret key.” It does not prove “this card is physically close to the reader.”

Timing requirements are loose: Most access control systems allow 100-500ms for authentication. Relay devices introduce 10-50ms latency—well within acceptable bounds.

Example: MIFARE DESFire EV3

MIFARE DESFire EV3 is marketed as highly secure:

• AES-128 encryption
• Mutual authentication
• Anti-cloning protection
• Secure messaging

Still vulnerable to relay attacks: All encryption happens correctly. The attacker never sees plaintext challenges or keys. The relay is transparent—just extending the RF communication range.

Real-World Attack Scenarios

NFC relay attacks are documented in multiple domains beyond building access.

Automotive Key Fob Relay

UK 2023 Statistics:

• 89% of car thefts involved keyless entry relay attacks (National Motor Vehicle Theft Reduction Council)
• Luxury vehicles particularly targeted (Range Rover, Tesla, BMW, Mercedes)

Attack execution:

1. Victim parks car in driveway, takes key fob inside home
2. Attacker positions device near front door/window to relay fob signal
3. Accomplice at car captures relay, unlocks doors, starts engine
4. Vehicle stolen in under 60 seconds

No alarm activation: Car sees legitimate key authentication.

Payment Card Relay

EMV contactless payment cards (Visa payWave, Mastercard PayPass):

Attack scenario:

1. Victim’s contactless payment card in wallet/pocket
2. Attacker with card-side device in crowded subway/elevator
3. Relay to payment terminal at store 500 meters away
4. Transaction completes, victim unaware

Transaction limits:

• Most cards allow contactless payments up to $50-$250 without PIN
• Multiple relay attacks possible before victim notices unauthorized charges

2022 Research (University of Birmingham): Demonstrated contactless payment card relay with 95% success rate on Visa and Mastercard cards. Average relay latency: 47ms.

Building Access Scenarios

Scenario 1: Tailgating Enhancement Attacker enters building behind authorized employee but doesn’t have badge access to secured areas. Accomplice with card-side device positions near employee in lobby. Attacker uses relay to unlock server room/executive suite.

Scenario 2: After-Hours Access Employee leaves building at 5 PM with badge in bag. Attacker with relay equipment positions near employee’s car in parking lot at 11 PM. Accomplice at building entrance uses relay to access facility.

Scenario 3: Supply Chain Attack Contractor with temporary badge access to loading dock. Relay device installed in hidden location near secure R&D wing reader. Badge works despite contractor being nowhere near R&D area.

Detection Methods

Detecting relay attacks requires measuring authentication timing or analyzing signal characteristics.

Distance-Bounding Protocols

Concept: Measure round-trip authentication time at speed-of-light precision. If authentication takes too long, the card must be too far away.

Implementation:

Reader: "Challenge sent at T0"
Card: "Response received at T1"
Calculation: Distance = (T1 - T0) * speed_of_light / 2

If calculated distance > 10cm, reject authentication.

Challenge: Requires hardware support in both cards and readers. Legacy systems cannot be retroactively upgraded.

Standards implementing distance-bounding:

• ISO/IEC 14443 (with distance-bounding extension)
• EMV Contactless Specifications v3.0+
• NXP MIFARE Plus EV2 (relay attack detection mode)

Signal Strength Analysis

RSSI (Received Signal Strength Indicator) monitoring:

NFC operates at 13.56 MHz with typical range of 4-10cm. Relay devices forward signals but cannot perfectly replicate power levels.

Detection method:

• Measure signal strength during authentication
• Establish baseline RSSI for legitimate cards
• Reject authentication if RSSI is abnormally low (indicating relay)

Limitation: Sophisticated relay devices with power amplification can mimic normal RSSI values.

Anomaly Detection via Machine Learning

Training data:

• Legitimate authentication patterns (timing, RSSI, frequency)
• Known relay attack samples

Detection features:

• Authentication latency distribution
• Signal strength variations
• Frequency spectrum analysis
• Multi-factor timing correlation

2024 Research (NIST): ML-based relay detection achieved 97.3% true positive rate with 1.8% false positive rate in controlled lab environment. Performance degrades in real-world noisy RF environments.

Behavioral Detection

Access pattern analysis:

• Employee badge used at front door at 8:00 AM
• Same badge used at executive suite at 8:00:15 AM
• Physical distance: 200 meters
• Walking time: ~2 minutes

Anomaly: Badge authenticated at two distant locations in 15 seconds—physically impossible.

Limitation: Requires sophisticated access control management system with location tracking and timing analysis. Many legacy systems lack this capability.

Defensive Countermeasures

Eliminating relay attack risk requires changing authentication technology or implementing anti-relay countermeasures.

Replace NFC with Relay-Resistant Technology

Option 1: Biometric + PIN

• Fingerprint or facial recognition
• Requires PIN for high-security areas
• No wireless signal to relay

Option 2: Wired Smart Cards

• Contact-based chip cards (not contactless)
• Requires physical insertion into reader
• Relay attacks physically impossible

Option 3: Mobile Credential with Bluetooth Range Verification

• Smartphone-based access using Bluetooth Low Energy
• Requires app to be actively opened and button pressed
• Bluetooth RSSI monitoring detects relay attempts

Cost: Significant. Requires replacing all readers and cards. Estimated $50-$150 per door for hardware, plus card reissuance costs.

Implement Anti-Relay Cards

NXP MIFARE Plus EV2 (with relay detection):

• Hardware distance-bounding support
• Requires compatible readers
• Rejects authentication if round-trip time exceeds 500 microseconds

HID Seos with SIO (Secure Identity Object):

• Multi-layer authentication with timing verification
• Mutual authentication between card and reader
• Anti-relay mode available in firmware

Cost: Moderate. Cards cost $5-$15 each vs $1-$3 for standard proximity cards. Readers cost $200-$500 vs $100-$200 for legacy models.

Multi-Factor Authentication

Badge + PIN:

• Even if badge is relayed, attacker lacks PIN
• Requires PIN pad at each reader (cost: $300-$600 per door)

Badge + Mobile Push Notification:

• Card authentication triggers push notification to employee’s phone
• Employee must approve access request
• Detects unauthorized relay attempts

Limitation: User friction. Employees dislike entering PINs or approving notifications for routine access.

Physical Security Measures

Shield card when not in use:

• RFID-blocking wallets or sleeves
• Prevents card-side relay device from communicating with card
• Cost: $10-$30 per employee

Employee awareness training:

• Recognize suspicious individuals with handheld devices near entry points
• Report unusual behavior (someone loitering near card readers)
• Understand relay attack risk and defensive behaviors

RF shielding in high-security areas:

• Faraday cage construction around sensitive facilities
• Prevents wireless relay signals from entering/exiting
• Cost: High ($10,000+ per secured room)

Access Control Policy Changes

Time-based restrictions:

• Badges only work during employee’s assigned shift
• After-hours access requires secondary authentication

Location-based restrictions:

• Badge can only unlock doors in employee’s authorized zones
• Prevents lateral movement via relay

Anomaly alerting:

• SOC receives real-time alerts for suspicious access patterns
• Rapid authentication at distant locations triggers investigation

Summary

NFC relay attacks represent a fundamental flaw in proximity-based authentication: the assumption that a responding card must be physically close is trivially defeated by wireless relay devices.

Key Takeaways:

• Relay attacks forward legitimate authentication in real-time, bypassing all cryptographic protections
• Attack range extends to hundreds of meters with WiFi/Bluetooth relay, or unlimited with cellular relay
• Legacy proximity cards (MIFARE Classic, HID Prox) offer zero protection—even modern encrypted cards are vulnerable without anti-relay features
• Detection requires hardware support for distance-bounding or signal timing analysis
• Effective defense requires replacing NFC with relay-resistant technology or implementing anti-relay cards with compatible readers

Defensive Strategy:

• Immediate: Issue RFID-blocking sleeves to employees, implement time/location-based access restrictions
• Short-term: Deploy behavioral anomaly detection in access control system
• Long-term: Migrate to anti-relay cards (MIFARE Plus EV2, HID Seos) with distance-bounding readers

When to Worry:

• High-value facilities secured only with contactless badges
• Executive areas accessible via single-factor NFC authentication
• Access control system lacks timing or location-based anomaly detection
• Employees carry badges in unshielded wallets/bags in public areas

When You’re Protected:

• Multi-factor authentication (badge + PIN or biometric)
• Anti-relay cards with distance-bounding readers deployed
• Access control system alerts on impossible timing/location patterns
• Physical security monitoring detects suspicious loitering near readers
• RFID-blocking sleeves issued to all badge holders

Cost-Benefit Analysis:

NFC relay attacks are cheap, fast, and leave no forensic evidence. Organizations relying on proximity cards for high-security areas must implement anti-relay countermeasures immediately.

Sources

1. ETH Zurich - Relay Attacks on Passive Keyless Entry and Start Systems (2019)

2. University of Birmingham - Practical Relay Attack on Contactless Payment Cards (2022)

3. NIST - Relay Attack Detection Using Machine Learning (2024)

4. National Motor Vehicle Theft Reduction Council - Vehicle Theft Statistics UK (2023)

5. NXP Semiconductors - MIFARE Plus EV2 Relay Attack Protection (2024)

6. HID Global - Seos Technology Security White Paper (2023)

7. ISO/IEC 14443 - Contactless Cards Standard with Distance Bounding (2023)

8. Proxmark3 - Open Source RFID Research Tool (2024)

9. SANS - Physical Security: RFID and NFC Attacks (2023)

10. MITRE ATT&CK - T1200: Hardware Additions (2024)

11. Chameleon Mini - RFID Emulator Documentation (2024)

12. EMV Contactless Specifications v3.0 - Relay Resistance Protocol (2023)

Important Links

1. NXP MIFARE Plus EV2 Anti-Relay Cards - Hardware relay protection

2. HID Seos Credentials - Secure identity with anti-relay

3. RFID-Blocking Wallets and Sleeves - Physical card shielding

4. Proxmark3 RDV4 - RFID security research tool

5. Silent Pocket RFID-Blocking Products - Faraday cage wallets and bags

6. Access Control Anomaly Detection Software - Behavioral analysis

7. Bluetooth-Based Mobile Credentials - Relay-resistant mobile access

8. ISO/IEC 14443 Standard Documentation - Contactless card specifications

9. NIST Physical Access Control Systems Guide - Federal access control standards

10. Chameleon Tiny RFID Emulator - Compact NFC research device