A contactless reader powers the card. It creates the radio field, sends commands into it, and the card answers by modulating that same field. That is why a reader cannot observe someone else's transaction: the moment it energizes, there are two fields and neither exchange completes.
One field, and only one side makes it#
Two minutes of physics, because everything else on this page follows from it. A contactless reader and a card are the two halves of a transformer. A coil driven at 13.56 MHz creates a magnetic field, and a second coil brought into that field has a current induced in it. That induced current is the card's entire power supply. The reader modulates its own carrier to send. The card cannot modulate anything, because it has no transmitter. It varies its impedance instead, and the reader sees that as a change in its own current.
The NFC Forum names the two positions in its own glossary, and the two definitions carry the distinction. Poll mode is where a device generates a carrier and probes for others. Listen mode is where it generates no carrier at all and waits for another device's field. A card is permanently in listen mode. So is a phone emulating one: the battery powers its processor, but it still adds nothing to the air.
Neither definition covers a sniffer, and that is not an oversight. A sniffer has no role in the protocol. It is a third party that must recover both directions of a conversation out of a field it did not create and cannot influence. One direction is a carrier; the other is a small variation in the load on that carrier. That is a much harder measurement than either participant has to make, which is why so few devices do it and why they cost what they cost.
- You want to
- Talk to a card
- Role
- Reader / initiator
- What that needs
- Any contactless reader. The easy case.
- You want to
- Look like a card to a terminal
- Role
- Target / emulator
- What that needs
- Hardware that can be a target, and a terminal willing to talk to it.
- You want to
- Watch a real transaction
- Role
- Passive sniffer
- What that needs
- A device that listens without energizing. This is the one a reader cannot do.
- You want to
- Change bytes in flight
- Role
- Man in the middle
- What that needs
- Two interfaces at once: a target facing the terminal, a reader facing the card.
The last row explains the shape of the hardware in the published research. A wedge sitting between a card and a terminal is two radios and a link, not one clever device. It presents as a card on one side and as a terminal on the other. That is also why the attacks built on it are described in terms of what each side believes: the two halves are talking to different things.
Where a sniffer has to stand#
Because it has to couple into somebody else's field without changing it, a sniffer is a physical problem before it is a software one. Its antenna goes between or immediately beside the two parties. It has to be close enough to pick up a load variation that the reader itself only just detects, and far enough not to detune the pair it is listening to. Orientation matters as much as distance. This is why published relay measurements always describe the geometry of the bench: the same equipment at a different angle is a different experiment.
That leads to a failure mode to recognize before it happens to you. A sniffer placed badly does not politely record nothing; it loads the field, and the transaction it was supposed to observe fails or degrades. From the terminal's side that looks like an ordinary bad tap, so the temptation is to move closer and try again, which makes it worse. If your captures correlate with declined transactions, the instrument is part of the experiment.
Different evidence, not just different hardware#
The choice is usually presented as a budget question, and it is not one. Each position produces a different kind of record, and the record you need is decided by the claim you are trying to support. A reader gives you a transcript of a conversation you conducted. That is excellent for questions about what a card will do, and worthless as evidence about what a particular terminal did on a particular day.
That middle box is where the technical fork and the legal one turn out to be the same fork. Passively observing an exchange you are authorized to observe adds nothing to the world: the transaction would have happened identically without you. Standing in as a card or as a terminal does not observe anything; it takes part. The bytes may look similar in your log; what you did is not similar at all.
The rule this course runs on#
The reasoning is not the one people assume. The data is regulated in most jurisdictions regardless of intent, so "it was for research" describes your motive rather than your legal position. And a transaction has more parties than the two in front of you. The cardholder, the merchant, the acquirer, the scheme and the issuer all have an interest in an exchange you might think of as happening between a card and a reader on a bench.
Scheme test cards exist so this question does not have to come up. They carry published, non-routable numbers, they behave like the real thing for everything this course teaches, and nothing you do with one touches a person's account. If you are choosing between an interesting experiment on your own live card and a dull one on a test card, do the dull one first. You will learn the same thing, and you will still have a clean answer if anyone asks.
PracticeA capture made against a scheme test card, and a good demonstration that a test card is not a toy: this one records a replay being attempted and the terminal noticing. Everything in it was learned from the most defensible position on this page.Open in the workbench →