Which device should I buy to work on payment cards?

There are three different jobs here and they are not interchangeable, which is the thing nobody tells you before the first purchase. Talking to a card yourself is the easy one, and almost any reader does it. Watching a real terminal talk to a real card without disturbing either is a different problem and needs different hardware. Sitting in the middle and changing bytes as they pass is a third.

Decide the layer before you decide the device#

Radu and colleagues state the division this course uses throughout, and they state it in a footnote because to them it is obvious. Level 1 is the ISO 14443 radio protocol, Level 2 is the exchange of bytes encoded as APDUs, and Level 3 is the EMV application protocol on top of those. Nearly every purchase people regret is a tool bought for the wrong layer. So the first question is not which device but which layer your question lives at.

The layer sets the price, not the other way round. Most of what this course teaches happens at Level 3, where a very cheap reader is enough. A question about how long a card took to answer cannot be asked at Level 3 at any price, because the layers underneath have already absorbed the timing.

What each one will stop you doing#

Product pages list what a device can do. The column that decides a purchase is the other one, and nobody prints it. Read this table right to left.

Device
SIMtrace2
Reaches
The contact interface, which nothing else on this list reaches. It sits in the slot between a chip and a terminal and traces what passes. Osmocom firmware answers as a SIM. A published T=1 block layer extends the card emulation so it can also answer an EMV terminal, which most of them require. Osmocom open hardware, sold assembled by sysmocom, schematics published.
Will not do
Anything contactless: it is a contact device only. Its own documentation says USB pass-through into a virtual machine is unsupported because the timing is too tight, though it has been run that way from the course VM without trouble.
Device
An Android phone
Reaches
Level 3. Its NFC stack sends APDUs to a card you hold against it, which covers a surprising amount of this course.
Will not do
Anything below the application layer, and anything the platform's own NFC service decides not to hand you.
Device
ACR122U
Reaches
Level 3 and most of Level 2. A PC/SC and CCID reader built on the NXP PN53x family, so both stacks talk to it.
Will not do
Sniffing. It is a reader, not a listener, and it cannot watch someone else's transaction.
Device
PN532 breakout
Reaches
The same job with direct access to the chip's own command set over UART, I2C or SPI, and it can be a target as well as an initiator.
Will not do
Being convenient. You choose the bus, wire it, feed it 3.3 V and configure the host side yourself.
Device
Contact reader (PC/SC)
Reaches
Level 3 over the contact interface, where the card is powered by the slot and nothing can be lost to a bad tap.
Will not do
Anything contactless. It is also the cheapest thing on this list and the one most people skip.
Device
Proxmark3
Reaches
Level 1. Reading, writing, snooping, replaying and emulation across the 125/134 kHz and 13.56 MHz bands.
Will not do
Being cheap or forgiving. Client and firmware must match exactly, and the RDV4 and the hobbyist boards are not the same purchase.

Device	Reaches	Will not do
SIMtrace2	The contact interface, which nothing else on this list reaches. It sits in the slot between a chip and a terminal and traces what passes. Osmocom firmware answers as a SIM. A published T=1 block layer extends the card emulation so it can also answer an EMV terminal, which most of them require. Osmocom open hardware, sold assembled by sysmocom, schematics published.	Anything contactless: it is a contact device only. Its own documentation says USB pass-through into a virtual machine is unsupported because the timing is too tight, though it has been run that way from the course VM without trouble.
An Android phone	Level 3. Its NFC stack sends APDUs to a card you hold against it, which covers a surprising amount of this course.	Anything below the application layer, and anything the platform's own NFC service decides not to hand you.
ACR122U	Level 3 and most of Level 2. A PC/SC and CCID reader built on the NXP PN53x family, so both stacks talk to it.	Sniffing. It is a reader, not a listener, and it cannot watch someone else's transaction.
PN532 breakout	The same job with direct access to the chip's own command set over UART, I2C or SPI, and it can be a target as well as an initiator.	Being convenient. You choose the bus, wire it, feed it 3.3 V and configure the host side yourself.
Contact reader (PC/SC)	Level 3 over the contact interface, where the card is powered by the slot and nothing can be lost to a bad tap.	Anything contactless. It is also the cheapest thing on this list and the one most people skip.
Proxmark3	Level 1. Reading, writing, snooping, replaying and emulation across the 125/134 kHz and 13.56 MHz bands.	Being cheap or forgiving. Client and firmware must match exactly, and the RDV4 and the hobbyist boards are not the same purchase.

Reader, card, or neither#

Underneath the product names there are only three positions a 13.56 MHz device can occupy, and the radio decides which. The NFC Forum names two of them in its own glossary. Poll mode is where a device generates a carrier and probes for others. Listen mode is where it generates no carrier and waits for someone else's field. A card is in listen mode. So is a phone emulating one.

The third position is not in that glossary at all, because it is not a role in the protocol: a sniffer is neither of the two parties. It has to recover both sides of a conversation from a field it did not create, and that is a hardware problem rather than a software one. That is why the list of devices that can do it is so much shorter than the list that cannot.

Three positions, and every device is a purchase of one or more of them. Almost everything cheap buys the first. Some things buy the second. The third is what you are paying for when a device costs ten times the others.

There is a second axis that catches people out, and it has nothing to do with any of the above. Contact and contactless are different interfaces on the same card, and a device for one does not touch the other. Two of the five captures in this site's corpus are contact traces. If you buy only a contactless reader you cannot reproduce them, and a contact reader costs less than a meal.

The exchange you are trying to join#

Draw the thing before deciding what to buy. Below is the beginning of an ordinary contactless transaction. A reader lets you replace the left-hand lane. Emulation hardware lets you replace the right-hand one. A sniffer lets you keep both lanes as they are and read what crosses between them, which is a different product and a different budget.

The first five moves of a contactless transaction. The first three are Level 1 and happen whether or not anybody is paying; the last two are the first thing you will write yourself. No third party appears in this drawing, and that is why observing it takes hardware that a reader is not.

What the money buys#

Spend in the order the questions arrive. Do the early modules with the corpus and the workbench on this site, which cost nothing and are already decoded. Then buy a contactless reader and a contact reader together, because between them they cover every capture here and most of what you will want to try against your own cards. Buy the sniffer when a specific question needs one.

PracticeBefore buying anything, spend twenty minutes here. This is a real contactless transaction, already decoded, and working through it will tell you what you want far better than any specification sheet will.Open in the workbench →