NFC Relay Attack.

A real-time man-in-the-middle attack that tunnels NFC traffic between a victim's card and a remote reader so the attacker can use the card from a distance. It belongs to the Cryptography category of cybersecurity.

A real-time man-in-the-middle attack that tunnels NFC traffic between a victim's card and a remote reader so the attacker can use the card from a distance.

An NFC relay attack uses two attacker devices, often modified smartphones, to forward NFC commands and responses in real time between a victim's contactless card or smartphone and a payment terminal or access reader located elsewhere. The card-side device, sometimes called the proxy or leech, sits near the victim and communicates with the terminal-side device, the ghost, over the Internet or a long-range radio link. Because the latency is below the typical timeout of EMV or transit protocols, the genuine card unknowingly authorizes a transaction or unlocks a door. Defences include distance bounding, proximity sensors, ambient sensor correlation, transaction limits without further authentication, and mandatory user gestures such as biometric confirmation.

Defences for NFC Relay Attack typically combine technical controls and operational practices, as detailed in the full definition above.

Common alternative names include: Contactless relay attack, Ghost-and-leech attack.