Can someone steal your data from an NFC business card?

Someone cannot realistically steal your data from an NFC business card that stores only a web link, because there is nothing private on the chip to take. The chip holds a public address, reading it takes a phone held a few centimetres away, and the page it opens shows only what you chose to publish. The real risks are different from the ones people imagine: a tampered or swapped tag that sends visitors to a fake page, and personal details you put on a public card without thinking. This guide explains NFC business card security in plain language, what is and is not possible, and the safeguards worth using whether you carry the card or tap someone else's.

The short answer

A well-set-up NFC business card is a low-risk object. An NFC card does not hold your bank details, your Emirates ID, your passwords or your contacts. On a MyInfo card the chip stores one thing: the address of your digital card, such as myinfo.ae/yourname. Anyone who reads it learns only what they would learn by looking at the front of a printed card and typing the address, since the page behind it is public by design.

That does not mean NFC has no security questions. Technology that talks over the air can be misused, and the honest picture has three parts: what the chip stores, how far it can be read, and how the chip or the link could be tampered with. We take them in turn, with named sources, and we separate genuine risks from myths. If you are still learning the basics, how an NFC business card works is a good first read.

What is actually on the chip

Most business cards use an NXP NTAG chip, commonly the NTAG213. NXP's product page lists 144 bytes of user memory for it, a 7-byte unique serial number set at the factory, data retention of 10 years and up to 100,000 write cycles. Memory that small cannot hold a profile, a photo or a contact list. It holds a short record, and on a MyInfo card that record is your link. We compare the chips in NTAG213 vs NTAG215 vs NTAG216 for business cards.

The unique serial number is not a secret. It identifies the chip, not you, and it can be read by any reader. The chip has no battery, no GPS and no microphone, and it cannot send anything on its own. It only responds when a phone's magnetic field powers it, which is why a card in your wallet is silent until someone deliberately holds a reader against it.

What a stranger learns when they tap

If someone taps your card, their phone reads the link, shows a prompt, and opens your page in the browser. That is all. The page shows the details you published: your name, photo, company, buttons and any links you added. If your card is public, the same information is visible to anyone who gets the link or finds the card through a search engine or the card directory. Our post on what is public on a digital business card explains that in full.

The takeaway is practical. The privacy question for an NFC card is rarely "can the chip be hacked?" and more often "what did I put on the page?" If a mobile number, home address or ID detail would worry you in a stranger's hands, take it off the card. Keep your personal number off your card shows how.

Tap range: why skimming from across a room is not the problem

NFC is built for very short distances. The NFC Forum describes a typical range of up to about 2 cm, and a certified compliant range of 5 mm. Other references quote about 4 cm. NXP says its NTAG chips can communicate at up to 100 mm depending on field strength and antenna geometry, so a well-designed reader and card can work a little further than the minimum. In daily life, you tap with the card almost touching the phone.

Security researchers do discuss eavesdropping, meaning listening to the radio exchange from further away with specialist equipment. Wikipedia's summary of NFC security says the distance depends on multiple parameters and is typically less than 10 metres for active devices, and only about 1 metre for passive devices such as tags. It also notes that plain NFC is not protected against eavesdropping on its own. For a business card, that is a smaller issue than it sounds, because the only data on the air is a public web address that you were about to share anyway. There is nothing confidential to overhear.

The same applies to the idea of "skimming" a card through a wallet or bag. Skimming is a real concern for payment cards, where the chip answers with data that has value. A business card chip answers with a link. Someone reading it learns your public address, which they could have found by asking you.

Relay attacks and payment cards: a different threat

You may have read about relay attacks, in which an attacker forwards the exchange between a victim's card and a reader in real time. Wikipedia notes that because NFC devices usually include ISO/IEC 14443 protocols, such attacks are feasible and can be built with two NFC-enabled phones. The risk is real for payment and access cards, where a relayed exchange can authorise something. It does not apply in the same way to a business card, because there is no payment or door to authorise, only a link to a public page.

The lesson is not to be complacent about NFC in general, but to keep each use in its box. Your bank card and your business card both use short-range radio, yet they store very different things and protect very different assets. Do not put anything sensitive on a business card chip, and never store passwords, PINs or ID numbers on any NFC tag.

The real risk: tampered and swapped tags

This is where attention belongs. Kaspersky has warned about maliciously tampered NFC tags. SecurityBrief reports two methods: reprogramming existing tags that were left unlocked, and physically replacing tags in busy places such as transport hubs and cafes. The goal is to send people to phishing pages, trigger downloads or exploit weaknesses in a phone's NFC handling. A second write-up of the same warning notes that such attacks go unnoticed because tags are small, passive and physically unassuming.

For a business card this has two practical implications:

• Your card in your wallet is hard to tamper with, because you keep it with you. The risk is low.
• A stand or sticker in a public place, such as a reception desk, a stall, a restaurant table or a shop counter, is easy for someone to overwrite or cover with a fake. This is the case to protect.

Notice that the attack does not steal data from your chip. It changes where the chip points, and the damage lands on the people who tap. That is why protection matters for your clients' sake as much as yours.

Locking, passwords and checking your chip

The best defence is built into the chip. NXP's NTAG family supports a permanent, irreversible read-only lock, and a reversible password option with a limit on failed attempts. Once locked, a tag cannot be reprogrammed by a stranger, which is exactly what Kaspersky recommends businesses do with tags that the public can reach.

Locking has a trade-off. You cannot rewrite a locked chip either, so test the link on at least two phones first, and write the address carefully, with https:// and the correct spelling. With MyInfo, changing your details never requires rewriting the chip, so you lose very little by locking a stand. Ask whoever programs your cards whether they lock the chip, or follow our guide to program an NFC card step by step and decide for yourself.

Also inspect public tags from time to time. A sticker that has been placed over yours, a card that looks scuffed, or a stand that has been moved are all signs to check. Tap your own stand with a phone and confirm the address that appears matches your own.

What happens on the phone when you tap

Modern phones are designed so that a tap does not silently run something. On iPhone, Apple documents that background tag reading, available on iPhone XS and later, shows a notification each time a tag is read, and the user taps the notification before the data goes to an app. It works only while the phone is in use, and it is unavailable in several situations, such as when the camera is in use or Airplane mode is on. On Android, NFC can be switched off in settings, and the phone normally shows what it is about to open.

That gives visitors a moment to check. The page that opens in the browser should show myinfo.ae and the card name in the address bar. If a tag opens a different domain, or asks for a login, a payment or an app download you did not expect, close it. Our post on what happens when someone taps your card walks through the visitor's side step by step.

What MyInfo does, and what is up to you

MyInfo gives you tools to control what the card exposes, and it is honest about the rest. Cards are public by default, which is the point of a business card. On Premium, a card can be set to private and protected with a six-digit access code, so visitors see a prompt first; follow make a card private and read about privacy and private cards. The bypass setting can send visitors straight to one destination, such as your contact file. Photos you upload are stripped of hidden data such as location. Leads sent through your card are visible only to you in your dashboard. And you can edit or remove anything on your card at any time.

What MyInfo cannot do is protect a physical tag that someone else overwrites, or a number you chose to publish. Those depend on how you lock the chip, where you place it and what you put on the page. For a plain-language view of the legal side, see PDPL and your digital business card.

Safeguards for card owners

In the UAE the places where cards change hands, such as exhibitions, malls, hotel lobbies and business centres, are busy and public. A stand left on an unattended counter in such a place is more exposed than a card handed over in a meeting. If you run a stall at an exhibition, treat the stand as part of your booth: put it where staff can see it, check it at the start of each day, and keep a printed QR code next to it so that anyone who is unsure can use the camera instead.

1. Put only public details on the card. Assume anyone can see it. Use a work number and email if you prefer.
2. Write your own link and test it. Confirm the address is spelled correctly and opens your card on an iPhone and an Android phone.
3. Lock chips on stands in public places, after testing. Wallet cards can stay unlocked.
4. Keep stands where staff can see them, and check them regularly for stickers placed over them.
5. Add a QR code and a printed address so visitors can check what they are opening; see NFC vs QR code business cards.
6. Use a private card with an access code for VIP audiences, as in private cards for clients and VIP events.
7. Buy from sellers who name the chip and write your link, as covered in questions to ask before you buy an NFC business card in Dubai.

Safeguards for people who tap a card

• Look at the web address before entering anything. A business card page should never ask for a password or card payment.
• Be wary of a tag in a public place that looks stuck on, scuffed or out of place.
• Keep your phone updated, as Kaspersky advises, and consider turning off NFC when you do not need it.
• If something looks wrong, close the page and ask the person for their link directly.

Frequently asked questions

Can someone read my NFC business card from a distance?

Not in any way that matters. NFC is designed to work within a few centimetres, and the NFC Forum describes a typical range of up to about 2 cm. Researchers describe eavesdropping at greater distances with special equipment, but the only data on a MyInfo card chip is a public web address you meant to share. There is nothing confidential on it to steal, so keep sensitive details off the card itself.

Can an NFC business card be hacked or rewritten?

An unlocked chip can be rewritten by anyone with an NFC writing app who holds a phone to it, which could redirect people to a fake page. That is why stands in public places should be locked after testing and checked regularly. A card in your wallet is far less exposed. Your MyInfo account is a separate matter, protected by email one-time codes, and changing the chip never changes your page.

Start with a card you are happy to be seen: create your free MyInfo card.