Can a bank card be cloned by tapping it?
No. A contactless card does not hand over a reusable secret. Each transaction involves a value computed for that transaction, so capturing one exchange gives an attacker something that has already been spent. That is the property the whole scheme is built around, and it is why card cloning moved elsewhere.
Why a recording is worthless
The design principle is that the card never repeats itself. Each transaction carries a value that is specific to that transaction, and a value already used is a value that will be refused.
So an attacker who records a complete exchange holds a transcript of something that has happened. Replaying it does not produce a second payment.
The precise mechanism belongs to the EMV contactless specifications published by EMVCo, rather than to a general guide.
What is useful here is the shape of the answer, because it explains why an entire category of feared attack does not work: cloning depends on repetition, and payment cards were designed not to repeat.
What a reader can obtain
Less than people expect and more than nothing. An application on a phone can typically obtain some of what is printed on the face of the card.
That is information the card displays to anybody who looks at it, which is worth remembering before concluding that reading it constitutes a breach.
What is not obtained is anything that would authorise a payment, because that is exactly what the design withholds.
The guide to what a payment terminal receives goes into what actually crosses during a purchase.
Where the real fraud went
Away from the card. When duplicating the physical object stopped working, fraud moved to routes that never need it: details entered on a website, accounts taken over, people persuaded to authorise things themselves.
This is why the practical advice about card fraud is almost never about the card in your pocket.
It is also why the contactless anxiety is misdirected. The tap is the strongest link in the chain and it attracts the most worry.
What is worth doing
Check statements, which catches everything regardless of how it happened, and report anything unrecognised promptly.
Understand that a card in a wallet next to other cards may fail to work rather than be at risk, which is an interference problem and not a security one.
Treat shielding products as addressing a small threat. They function; the question is whether the threat justifies them.
And keep the card in sight during a payment, which addresses the ordinary risks that have nothing to do with radio.
Frequently asked questions
Can somebody record my card and replay it?
No. The value exchanged is specific to that transaction, so a replay presents something already used.
Can an application read my card?
It can typically obtain some of what is printed on the face of it, which is information the card already displays.
Should I use a shielded wallet?
It works, against a threat that is small. Decide on that basis rather than on the strength of the marketing.
Why is there so much worry about it then?
Because tapping feels passive. In practice the tap is the strongest link, and fraud moved to routes that never touch the card.