Week 4 · Access control

NFC at 13.56 MHz

Contactless cards, tags and toys all share one frequency: 13.56 MHz. This module maps the NFC world, shows what the Flipper genuinely reads and copies, and quietly kills the "it can clone my credit card" myth.

⏱ 50 min Gear: an NFC tag or card you own App: NFC

Goal

By the end of this module you can read an NFC tag or card that belongs to you, tell the difference between a tag the Flipper copies fully and one it only reads partly, and explain — calmly, to the friend who's convinced a Flipper can drain a bank account — why that's not how any of this works.

NFC stands for near-field communication. Like the 125 kHz fobs in Module 6, it's near-field and short-range and the card is usually passive. But it lives up at 13.56 MHz, it's built on real international standards, and some of its cards can hold secret keys and do actual cryptography. That last part is why "can the Flipper clone this?" has a genuinely different answer for every card type — and why the honest answer is often "it can read it, but it can't copy the part that matters."

HF: the 13.56 MHz world

Radio people group frequencies into bands. The three you now care about sit far apart:

LF — low frequency — 125 kHz, the old prox fobs from Module 6.
HF — high frequency — 13.56 MHz, where all NFC lives. This module.
UHF-ish Sub-GHz — 300–928 MHz, the CC1101 radio and everything in Modules 1–5.

They aren't a little apart; they're orders of magnitude apart. Here's the same three worlds on a single (logarithmic) scale, so you can see just how much ground separates a door fob from a garage remote:

Three tiny points on a huge scale. NFC (13.56 MHz) sits roughly a hundred times higher than an LF fob and a factor of ~20–70 below the Sub-GHz band. Different frequency, different app, different physics.

NFC is short-range by design, and for the same reason 125 kHz was: it's near-field. The reader and card couple through the field between them rather than sending a wave across the room, so a practical read happens over a couple of centimetres. That's a deliberate security property — you have to intend to tap. It's why "someone across the café read my card" makes for a good scare story and a poor physics lesson.

The whole NFC family is built on ISO/IEC 14443, a standard with an A and a B variant that differ in low-level signalling. You rarely need to care which is which — the Flipper figures it out — but it's why one reader can talk to cards from a dozen different makers.

Cards you'll meet

"NFC card" is a category, not a thing. What matters for you is how much the card can keep to itself. Here are the four you'll actually run into, from dumbest to smartest:

Card	Brains	What's on it	Can the Flipper copy it?
NTAG / Ultralight	Simple memory	A UID plus a few hundred bytes of open storage. No real crypto.	Usually yes — read the data, write it to a matching blank.
Mifare Classic	Weak crypto	Data split into sectors, each locked by a key. The cipher is old and broken.	Sometimes — only if the keys are known/recoverable. No keys, no full copy.
DESFire	Strong crypto	Sectored data behind modern encryption (AES).	No — you can see it exists and read its UID, not its protected contents.
EMV bank card	Strong crypto	Some public fields; the secrets that authorise a payment never leave the chip.	No — reads limited public data only. Covered below.

UID, keys, and why "read" isn't "clone"

Every ISO 14443 card has a UID — a unique identifier it announces to any reader, much like the EM4100 number from last module. Reading a UID is trivial and unprotected. But on the smarter cards the UID is just the doorbell; the valuable data sits behind keys. Mifare Classic famously has weak, decades-old crypto, so with the right keys its sectors can be read and copied — but a card whose keys you don't have is a card you can't fully clone. DESFire uses real modern encryption and simply doesn't hand over its protected contents to anyone without the key. The pattern to hold onto: reading a card's UID tells you almost nothing about whether you can copy the card.

"But the Flipper read it fine!"Seeing a card's type and UID on screen is the beginning of the story, not proof you copied it. A DESFire badge reads instantly — and copies not at all. Always check: did it capture the protected data, or just the front-door UID?

What the Flipper can do

The NFC app follows the same rhythm as everything else in this course: read, save, emulate. The catch is that how far each step gets depends entirely on the card in your hand.

Read. Tap the card to the back of the Flipper. It identifies the type (Ultralight, Classic, DESFire, EMV…) and reads what it's allowed to — always the UID, and as much protected data as the keys permit.
Save. Store the capture on the SD card. For a simple tag that's the whole tag; for a locked card it's whatever was readable.
Emulate. Present the saved data to a reader. This works cleanly for simple tags and for cards you captured completely; for anything key-protected you didn't fully read, emulation won't satisfy the real reader.

So the honest summary is: the Flipper reads many NFC cards, but full cloning depends on the card's crypto and whether the keys are available. Simple NTAG-style tags copy end to end. Mifare Classic copies only when its keys are known. DESFire and bank cards don't copy at all. None of that is a limitation of the Flipper so much as a fact about the cards.

Writing NTAG: the friendly end of NFC

Not all NFC is locked down, and the writable end is genuinely fun. NTAG chips are cheap, open, rewritable tags — the little stickers and discs you can program to open a URL, hold a text note, or store any small blob. A well-known example is toy figures: amiibo data is essentially an NTAG215 payload, and enthusiasts write that data onto blank NTAG215 tags they own to use with their own consoles. It's a clean illustration of the whole model — a tag with no crypto is just portable memory, and the Flipper can read it, save it, and write it to a blank of the same type.

✓

A pack of blank NTAG215 tags is the NFC equivalent of the T5577 blanks from Module 6: cheap, rewritable, and perfect for practising the full read → save → write loop on hardware that's entirely yours.

The bank-card myth

This is the one everyone asks about, so let's be precise. Hold a contactless credit or debit card (an EMV card) to the Flipper's NFC app and it will read something. What it reads is a small amount of public information the card is designed to expose — enough for a point-of-sale terminal to start a conversation. What it does not read, because the card never reveals it to anyone, is the material that actually authorises a payment.

Sometimes readable (public)

The card's presence and type
A card number and expiry in some cases
A list of recent-ish transaction traces on some cards

Never readable

The CVV and your PIN
The secret keys inside the chip
Anything that lets you pay as that card

Here's why "clone it and pay" is impossible: every contactless payment uses a one-time cryptogram that the chip computes with a secret key it will never surrender. The terminal and the bank check that cryptogram. A copy of the public fields can't produce a valid one, so an emulated card is refused. The Flipper can be a curious reader of the front page; it cannot forge the signature inside. Reading a few public bytes is not "having your card."

Own it, and only it Read your own cards. Even where a payment card exposes a number, using that number is fraud, full stop — and the chip won't let you pay with a clone anyway. Transit passes and building badges are a subtler trap: some are copyable, but duplicating a card you don't control (or dodging a fare) can be a crime regardless of whether the technology cooperates. The rule from Module 6 carries straight over: learn on tags and cards that are yours.

Lab

Lab 7.1

Read your own tag, then note what really copied

Gear: an NFC tag or card you own — ideally a blank NTAG plus one card you carry (transit, gym, or an old hotel key you kept)

Open the NFC app and choose NFC → Read.
Tap your card flat to the back of the Flipper. Note the type it reports (Ultralight/NTAG, Mifare Classic, DESFire, EMV…) and the UID.
Save the capture with a clear name.
Now read a blank NTAG tag you own. Because it has no crypto, this one reads completely.
Try Emulate on the NTAG capture — a simple tag emulates cleanly. Then look back at the card you read in step 2 and ask: did the Flipper capture its protected data, or only the UID and type?
Write one sentence in your notes: for each item, read fully, read partially, or UID only — and why.

✓You've got it when: you've read at least two of your own NFC items, emulated a simple NTAG, and can point at one card and say "the Flipper only saw its UID — the rest is behind keys it doesn't have," and at another and say "that one copied end to end because it has no crypto."

Going deeper

My office badge is 13.56 MHz — can the Flipper copy it?

It depends entirely on the card. If it's a bare Ultralight/NTAG, likely yes. If it's Mifare Classic, only if the sector keys are known or recoverable. If it's DESFire, no — the protected data stays put. And separately from what's technically possible: a work badge is access you don't control, so copying it can breach policy or law even when the chip is cooperative. Practise on your own tags; the concepts transfer without the risk.

Why is Mifare Classic called "weak" if it still needs keys?

Because its cipher (an old proprietary one) has been thoroughly broken by researchers, so its keys are far easier to recover than a modern card's would be — the lock exists, but the tumblers are known. "Weak crypto" doesn't mean "no lock"; it means the lock is from an era before the attacks that defeat it were public. DESFire's AES-based design is the modern answer, and it's why security-conscious buildings migrated to it.

Is my phone's tap-to-pay the same as a card?

Same frequency, same near-field idea, even more locked down. Phone wallets add a secure element and one-time tokens on top of the EMV cryptogram, so there's even less useful data exposed to a curious reader and still nothing that lets anyone pay as you. The Flipper might notice a payment device is present; it cannot become one.

Check yourself

Verify the details

Read the primary sources: Flipper: NFC. Course review: 10 September 2026.