How safe is NFC, and what can it expose?

What the physics rules out

A tag has no battery. It is powered by the field of the reader, and that field is useful across roughly two centimetres.

So every scenario that begins with somebody at the far side of a room, or walking past in a crowd, is asking the field to do something it cannot. The attacker has to be close enough that you would notice, and stay there while the exchange completes.

A tag also has no logic. It answers what it is asked and does nothing else, which means it cannot decide, cannot initiate, and cannot reach out to anything.

These two facts remove most of what gets written about NFC risk. What they do not remove is worth taking seriously.

What actually remains

The destination. A tag holds an address, and the page at that address behaves like any other page: it can log the visit, set identifiers, and record far more than the tag ever held. This is where the privacy question really lives.

Systems that trust a number. A tag announces an identifier to any reader that asks. Installations that authorise on that identifier are authorising on a value anybody standing next to the holder can obtain.

Content that should not be public. Anything written on a tag is readable by anybody who holds a phone to it, with no permission asked and no trace left.

And rewriting rather than copying. An unlocked tag on a wall can be overwritten by a passer by, which is a more practical attack than duplication and gets less attention.

The confusion that does the damage

Locking a tag and protecting a tag are not the same thing, and treating them as one causes more real losses than any attack.

Locking prevents alteration. It does nothing whatever about copying, because a copy is made by reading, and reading is exactly what a tag is for.

Similarly, an identifier feels like a secret and is not one. It is long, it looks random, and nobody publishes it, none of which makes it confidential.

Most disappointed deployments come from one of these two confusions rather than from a sophisticated adversary.

Judging a risk by what it is worth

Copying a tag requires proximity, a blank, and a reason. The first two are cheap; the third is where most fears fall apart.

A copy of a tag that opens a public page gains the attacker a public page. A copy of a badge that opens a door gains them the door. The same operation, wildly different consequences, and the difference is entirely in what sits behind the tag.

So the useful question is not whether your tag can be copied. It can. The question is what somebody would hold if they did.

Answer that first, and the protection that follows is proportionate rather than reflexive.