Android versions: A living history from 1.0 to 15

Apple Wallet Re-enables Adding Cards Via NFC — What You Need To Know

For still unknown reasons, Apple disabled the "Tap to Provision" feature in the Apple Wallet app last week. However, for just as vague reasons, the feature was turned back on two days before the big iOS 18 update hit iPhones.

The re-enabled feature was seen by Aaron Perris on X (h/t 9to5Mac) in the back-end code. It remains unclear why Apple was turning off and back on again.

The "Tap to Provision" feature is inelegantly named, but it allows you to add a new debit or credit card to Apple Pay via NFC. Tapping your NFC-supported card to your iPhone will let you add a card without taking a photo of the card and uploading it to the app or typing in the numbers.

You will receive an approval code from your bank via text message or another verification method to complete adding your new cards, just like you would with other methods.

Apparently, this tapping method via NFC will be the new default way of putting new cards in your Apple Wallet in iOS 18. 

We have read reports, including from 9to5Mac, claiming people have struggled to add cards using the NFC method. Or it didn't work for some debit or credit cards. One comment claimed it doesn't work for American Express and Discover cards, but Visa and Mastercard work okay.

If that is an ongoing issue with the Tap to Provision feature, Apple may have disabled it to try fixing it. We'll see how it fares now that more iPhone owners can access it within the next few days. 

Get instant access to breaking news, the hottest reviews, great deals and helpful tips.

I tried it with a Mastercard, and it worked fine, but your mileage may vary. It was a little picky and required me to tap the card to the very top of the iPhone before it read it. 

Apple Wallet is getting a number of new features with iOS 18 beyond Tap to Provision. At least one is NFC-based with the new "Tap to Cash," which lets you send money to your friends by bringing your iPhone close to theirs. The money transfer is authenticated using the usual iPhone security methods — FaceID, Touch ID or passcode. 

It should also work with Apple Watches as the feature is apart of the new watchOS 11 update as well. You can additionally find the Tap to Cash control via the revamped Control Center, allowing you to initiate transfers more quickly.

More from Tom's Guide

Today's best Apple iPhone 16, Apple iPhone 16 Pro, Apple iPhone 16 Plus, Apple iPhone 16 Pro Max, Apple iPhone 15, Apple iPhone 15 Pro, Apple iPhone 15 Plus and Apple iPhone 15 Pro Max deals

How Do NFC Tags And Readers Work? Here's Everything You Need To Know

Oliver Cragg / Android Authority

NFC, or near field communication, is a popular wireless technology that allows you to transfer data between two devices that are in close proximity to each other. It's often used as a faster and more secure alternative to QR codes for other short-range applications like Google Pay. Practically, there's not much to the technology — you have electronic reader devices that allow you to read data from various NFC tags.

That said, NFC tags are surprisingly versatile and tend to be useful in situations where you might want to transfer small amounts of data effortlessly. After all, tapping a surface takes less time and effort than using Bluetooth pairing or entering Wi-Fi passwords. Many digital cameras and headphones have embedded NFC tags these days that you can simply tap to quickly initiate a wireless connection.

If you've ever wondered how NFC tags and readers work, this article is for you. In the following sections, we'll take a quick look at how they work as well as how you can read and write data to a tag using your smartphone.

QUICK ANSWER

NFC tags and readers communicate wirelessly with each other over very short distances. Tags store a small amount of data on them that is sent to the reader in the form of electromagnetic pulses. These pulses represent 1s and 0s, allowing the reader to decode what's stored on the tag.

JUMP TO KEY SECTIONS

How do NFC tags work?

Edgar Cervantes / Android Authority

NFC tags come in a variety of shapes and sizes. The simplest ones are often built in the form of a square or circular sticker, and you'll even find one embedded inside most credit cards. NFC tags that come in the form of a sticker have a simple construction — they consist of a thin copper coil and a small storage space on a microchip.

The coil allows the tag to wirelessly receive power from the NFC reader through a process known as electromagnetic induction. Essentially, whenever you bring a powered NFC reader near the tag, the latter gets energized and transmits any stored data within its microchip to the device. Tags may also use public-key encryption if sensitive data is involved to prevent spoofing and other malicious attacks.

Since the basic structure of an NFC tag is pretty straightforward, you could fit the requisite hardware into a whole host of form factors. Take hotel keycards or access cards in general. These are also typically just plastic cards with some copper windings and some memory on a microchip. The same principle applies to NFC-equipped credit and debit cards, which contain thin copper traces running along the card's perimeter.

NFC tags come in various form factors, ranging from small stickers to credit card-like plastic cards.

It's worth noting that powered NFC smartphones are also capable of acting as an NFC tag. Unlike RFID, which supports only one-way communication, NFC can facilitate bi-directional data transfer. This allows your phone, for example, to emulate an embedded NFC tag like the ones used for contactless payments. These are much more advanced devices, of course, but the basic mode of operation is still the same.

Types of NFC tags

Oliver Cragg / Android Authority

Most NFC tags follow the ISO 14443 standard for wireless, proximity-based data transmission. There are five sub-types too, conveniently labeled type 1 through 5. Type 1 tags are the least advanced, as they are only capable of storing less than one kilobyte of data. That's only a few hundred characters of text — so such a tag has enough memory to hold a URL or Wi-Fi password, but not much else. Transfer speeds aren't particularly great either, at around 100kbps.

At the other end of the spectrum, Type 5 NFC tags are capable of holding 32KB in memory. They can also transfer data roughly four times faster than Type 1 tags. That's still not a lot of data, compared to a typical microSD card of the same physical size. However, it's more than enough for use-cases like ticketing and access control. These types of tags may also offer additional features such as tamper resistance and improved interference handling capabilities.

NFC tags vary in terms of their memory capacity and read speeds.

As you'd expect, however, more advanced NFC tags cost more to manufacture as well. Considering how little data is often transferred through this medium, most applications are sufficiently served by the more primitive types. Type 1 and 2 tags, which are a lot more common, cost just a few cents if purchased in bulk.

NFC tags allow for both read and write operations, so you can reuse them as you see fit. This further drives down the cost of deployment for large-scale use cases.

Do AirTags and other smart tags use NFC?

Rita El Khoury / Android Authority

You may have heard of personal object trackers like the Apple AirTag and Samsung's Galaxy SmartTag+. Even though their names would have you believe that they are NFC tags, these trackers rely on different wireless protocols with a longer range instead.

Bluetooth Low Energy, for instance, works over several feet and doesn't require proximity or contact like NFC does. Another up-and-coming wireless technology is ultra-wide band (UWB). In a nutshell, devices can use UWB to achieve positional awareness, allowing you to locate an AirTag with centimeter-level accuracy. Premium smartphones released after 2019 include UWB support.

That said, Apple's AirTags also include an NFC tag containing the owner's contact information. If you find a lost tracker, simply tap any NFC-compatible smartphone against it. Or if you have an extra one lying around, you can repurpose the tag for automation, as we'll discuss in a later section.

What is an NFC reader?

Xiaomi

So far, we've only discussed NFC tags, but what about readers? Well, we've already established that NFC readers supply power and read data from passive tags. In order to achieve this, NFC readers need a power source to pass an electric current through a coil of their own. This generates an alternating magnetic field in the reader's immediate vicinity. Bringing a tag in this magnetic field's range finally results in inductive coupling between the two coils, thanks to Faraday's law of induction.

Contactless payment terminals are perhaps the most widely available NFC readers. Public transport access gateways are a close second. In both instances, you are issued a unique NFC tag in the form of a card or token, or an app like Google Pay. Meanwhile, the readers are typically fixed devices with an active connection to power and data, sometimes via a battery and Wi-Fi connection respectively.

How do NFC readers work?

Once the tag gets power from the reader through inductive coupling, the actual data transfer process is rather simple. Readers can detect how an NFC tag modulates the electromagnetic field. A technique known as Manchester coding is used to determine binary values (zeros and ones) from the electromagnetic pulses. Finally, these binary values get converted into human-readable text. Don't worry, though — you don't need to know any of this to actually use an NFC tag or reader in the real world.

NFC tags: How to read and write data

Robert Triggs / Android Authority

As mentioned previously, most mid-range and premium smartphones contain NFC hardware these days. That makes reading an existing NFC tag pretty simple, just use the back of your smartphone to make physical contact with it. Depending on the tag's contents, a pop-up should automatically appear on your device and prompt you to complete an action. For example, a tag containing a URL as its payload will bring up a web browser. Elsewhere, tags embedded within headphones will automatically initiate Bluetooth pairing.

As for writing or overwriting data, keep in mind that not all NFC tags are capable of read-write operation. Certain tags, like those programmed for access control, may have write protection to prevent tampering or unauthorized modification. If you'd like to purchase rewritable NFC tags, check out unbranded NFC stickers and cards like the NTAG 213 and 215. They can be purchased off the shelf from electronics retailers or even general websites like Amazon.

You can program most off-the-shelf NFC tags to include whatever data or text you want using just your smartphone.

With a rewritable NFC tag, you can program it to do anything you want using your smartphone. Apps like NFC Tools will allow you to write a contact, Bluetooth pairing information, website link, or Wi-Fi configuration to a tag. For a more advanced example, you could combine NFC tags with an automation app like Tasker on Android or Shortcuts on iOS to perform actions like turning on a light.

FAQs How do I program NFC tags?

You can use an NFC-equipped smartphone with an app like NFC Tools to program a tag.

How do I make an NFC tag?

An NFC tag contains a lot of tiny circuitry, so it's not possible to build one yourself. That said, you can buy blank NFC tags at electronics stores and Amazon.

You might like

Comments

Android Malware Steals Payment Card Data Using Previously Unseen Technique

Enlarge d3sign reader comments 77

Newly discovered Android malware steals payment card data using an infected device's NFC reader and relays it to attackers, a novel technique that effectively clones the card so it can be used at ATMs or point-of-sale terminals, security firm ESET said.

ESET researchers have named the malware NGate because it incorporates NFCGate, an open source tool for capturing, analyzing, or altering NFC traffic. Short for Near-Field Communication, NFC is a protocol that allows two devices to wirelessly communicate over short distances.

New Android attack scenario

"This is a new Android attack scenario, and it is the first time we have seen Android malware with this capability being used in the wild," ESET researcher Lukas Stefanko said in a video demonstrating the discovery. "NGate malware can relay NFC data from a victim's card through a compromised device to an attacker's smartphone, which is then able to emulate the card and withdraw money from an ATM."

Lukas Stefanko—Unmasking NGate.

The malware was installed through traditional phishing scenarios, such as the attacker messaging targets and tricking them into installing NGate from short-lived domains that impersonated the banks or official mobile banking apps available on Google Play. Masquerading as a legitimate app for a target's bank, NGate prompts the user to enter the banking client ID, date of birth, and the PIN code corresponding to the card. The app goes on to ask the user to turn on NFC and to scan the card.

Further Reading Novel technique allows malicious apps to escape iOS and Android guardrails ESET said it discovered NGate being used against three Czech banks starting in November and identified six separate NGate apps circulating from non-Google Play sources between then and March of this year. Some of the apps used in later months of the campaign came in the form of PWAs, short for Progressive Web Apps, which as reported Thursday can be installed on both Android and iOS devices even when settings (mandatory on iOS) prevent the installation of apps available from non-official sources.

The most likely reason the NGate campaign ended in March, ESET said, was the arrest by Czech police of a 22-year-old they said they caught wearing a mask while withdrawing money from ATMs in Prague. Investigators said the suspect had "devised a new way to con people out of money" using a scheme that sounds identical to the one involving NGate.

Stefanko and fellow ESET researcher Jakub Osmani explained how the attack worked:

The announcement by the Czech police revealed the attack scenario started with the attackers sending SMS messages to potential victims about a tax return, including a link to a phishing website impersonating banks. These links most likely led to malicious PWAs. Once the victim installed the app and inserted their credentials, the attacker gained access to the victim's account. Then the attacker called the victim, pretending to be a bank employee. The victim was informed that their account had been compromised, likely due to the earlier text message. The attacker was actually telling the truth – the victim's account was compromised, but this truth then led to another lie.

To "protect" their funds, the victim was requested to change their PIN and verify their banking card using a mobile app – NGate malware. A link to download NGate was sent via SMS. We suspect that within the NGate app, the victims would enter their old PIN to create a new one and place their card at the back of their smartphone to verify or apply the change.

Since the attacker already had access to the compromised account, they could change the withdrawal limits. If the NFC relay method didn't work, they could simply transfer the funds to another account. However, using NGate makes it easier for the attacker to access the victim's funds without leaving traces back to the attacker's own bank account. A diagram of the attack sequence is shown in Figure 6.

Enlarge / NGate attack overview. ESET

The researchers said NGate or apps similar to it could be used in other scenarios, such as cloning some smart cards used for other purposes. The attack would work by copying the unique ID of the NFC tag, abbreviated as UID.

"During our testing, we successfully relayed the UID from a MIFARE Classic 1K tag, which is typically used for public transport tickets, ID badges, membership or student cards, and similar use cases," the researchers wrote. "Using NFCGate, it's possible to perform an NFC relay attack to read an NFC token in one location and, in real time, access premises in a different location by emulating its UID, as shown in Figure 7."

Enlarge / Figure 7. Android smartphone (right) that read and relayed an external NFC token's UID to another device (left). ESET

The cloning could all occur in situations where the attacker has physical access to a card or is able to briefly read a card in unattended purses, wallets, backpacks, or smartphone cases holding cards. To perform and emulate such attacks requires the attacker to have a rooted and customized Android device. Phones that were infected by NGate didn't have this requirement.

A Google representative wrote in an email: "Based on our current detections, no apps containing this malware are found on Google Play. Android users are automatically protected against known versions of this malware by Google Play Protect, which is on by default on Android devices with Google Play Services. Google Play Protect can warn users or block apps known to exhibit malicious behavior, even when those apps come from sources outside of Play."

---