Direct and reverse NFC relay attacks being used to steal money | Kaspersky official blog
Source Kaspersky Security Blog
Description
How to protect your Android device from NFC relay attacks exploiting NFCGate.
Impact
For European organizations, especially financial institutions and mobile payment service providers, these NFC relay attacks pose a significant risk of financial fraud and reputational damage. End users’ compromised bank cards can lead to unauthorized withdrawals and payments, increasing chargebacks and operational costs for banks. The attacks exploit Android devices, which are widely used across Europe, potentially affecting a large user base. Retailers and ATM operators may face increased fraud incidents, complicating transaction verification and dispute resolution. The malware’s ability to intercept or delay bank alerts can hinder timely fraud detection and response. Additionally, the rise of malware-as-a-service models lowers the barrier for attackers, increasing the frequency and scale of attacks. Organizations may also face regulatory scrutiny under GDPR and PSD2 if customer data or payment security is compromised. The social engineering aspect means that even well-secured environments can be vulnerable if users are not adequately trained. Overall, these attacks threaten the confidentiality and integrity of payment credentials and the availability of secure payment services.
Defensive guidance
European organizations should implement multi-layered defenses beyond generic advice: 1) Financial institutions must enhance user education campaigns focusing on NFC relay attack tactics, emphasizing never to install apps from unofficial sources or tap cards on phones. 2) Banks should monitor for unusual transaction patterns consistent with relay attacks, such as simultaneous geographically disparate transactions or atypical ATM usage. 3) Mobile payment providers should enforce app integrity checks and restrict NFC access to verified applications only, possibly integrating behavioral analytics to detect suspicious NFC activity. 4) Encourage users to regularly verify and maintain their default NFC payment method settings and promptly remove unknown apps with NFC or accessibility permissions. 5) Deploy endpoint security solutions on Android devices that can detect and block malicious apps exploiting NFCGate or similar frameworks. 6) Collaborate with telecom providers to identify and block command-and-control servers used by these malware variants. 7) ATM operators should implement additional authentication mechanisms beyond NFC taps, such as biometric verification or transaction limits for contactless withdrawals. 8) Financial regulators should issue guidelines on NFC payment security and mandate incident reporting to improve threat intelligence sharing. 9) Organizations should maintain updated threat intelligence feeds to detect emerging NFC relay malware variants and adapt defenses accordingly. 10) Encourage users to use physical cards for ATM transactions and official banking apps for payments rather than third-party apps.
References
Community reviews
Related threats
- Multiple Lenovo Tablets shipped with a known private test key for Android Verified BootHighVulnerability
- YuanKong RAT: the Android remote-control service that stamps its operators' names into every buildMalware
- Android gets AI defenses against messaging scams, fake callsNews
- Novel Android RAT ‘Hirudo’ Replaces Banking Apps With Trojanized CopiesMalware
- VU#410595: Google BoringSSL Name Constraints Bypass in SAN Validation LogicMediumVulnerability