NFC attacks grow by 188% in 2026 and make victims transfer money voluntarily

The number of NFC-based attacks aimed at Android smartphones to steal money has increased by 188 percent in the first four months of the year, with a greater presence of the reverse modality, which is more difficult to detect, which results in the victims voluntarily transferring money to the attackers.

NFC, near field communication, technology allows data to be exchanged between devices in close proximity to each other wirelessly. It is the one that facilitates contactless payments with the mobile phone in the establishments’ dataphones and the use of the public transport card by simply bringing it close to the access turnstiles.

Cybercrime has found a way to exploit this technology for its own purposes, with attacks linked to different families of Android malware that use NFC techniques, including SuperCard X, PhantomCard, NGate and other malicious modifications of the NFCGate tool.

By requiring the victim to bring their Android phone close to another device to complete the scam, cybercriminals, who have previously contacted them through a messaging app, convince them to download malware, for example, hidden in a financial application.

In this case, once the ‘malware’ has infected the victim’s device, they only have to bring their bank card close to the ‘smartphone’ and enter the PIN so that the attackers can obtain the data and thus steal their money.

However, from the security firm Kaspersky they indicate that there is another modality that is growing in popularity, because “it is much more difficult to detect and combat, since it is the victims themselves who voluntarily transfer the money to the accounts of cybercriminals and these operations can appear completely legitimate,” explained the chief security expert at Kaspersky, Sergey Golovanov.

This other modality is called reverse NFC and requires the use of social engineering to convince the victim to download a malicious application and make it their primary contactless payment method on their mobile.

This application generates an NFC signal that ATMs interpret as if it were the attackers’ card. It is complemented by asking the victim to deposit money into a supposedly secure account using their infected phone, which in reality means that the money ends up directly in the hands of the attackers.

The use of these techniques has resulted in a 188 percent increase in NFC attacks against Android smartphones in the first four months of 2026 compared to the same period of the previous year.

According to Kaspersky telemetry data, collected in the report ‘Financial sector threat landscape in 2025′, this company’s cybersecurity solutions blocked 35,600 attacks linked to different families of NFC malware, compared to the block of just over 12,300 attacks in 2025.

Although the security firm indicates that this type of attack has a greater incidence in Russia, it also points out that users in other regions, especially in Europe and Latin America, are also beginning to suffer NFC-based attacks.

To protect yourself from them, it is advisable to avoid installing applications from unofficial sources, such as those received through messengers, social networks, SMS or during phone calls, and not to follow instructions from strangers at ATMs, regardless of who they say they are.

The number of NFC-based attacks targeting Android smartphones to steal money has increased by 188 percent so far this year, with a greater presence of the reverse modality, which is more difficult to detect, which results in the victims voluntarily transferring money to the attackers.

NFC, near field communication, technology allows data to be exchanged between devices in close proximity to each other wirelessly. It is the one that facilitates contactless payments with the mobile phone in the establishments’ dataphones and the use of the public transport card by simply bringing it close to the access turnstiles.

Cybercrime has found a way to exploit this technology for its own purposes, with attacks linked to different families of Android malware that use NFC techniques, including SuperCard X, PhantomCard, NGate and other malicious modifications of the NFCGate tool.

By requiring the victim to bring their Android phone close to another device to complete the scam, cybercriminals, who have previously contacted them through a messaging app, convince them to download malware, for example, hidden in a financial application.

In this case, once the ‘malware’ has infected the victim’s device, they only have to bring their bank card close to the ‘smartphone’ and enter the PIN so that the attackers can obtain the data and thus steal their money.

However, from the security firm Kaspersky they indicate that there is another modality that is growing in popularity, because “it is much more difficult to detect and combat, since it is the victims themselves who voluntarily transfer the money to the accounts of cybercriminals and these operations can appear completely legitimate,” explained the chief security expert at Kaspersky, Sergey Golovanov.

This other modality is called reverse NFC and requires the use of social engineering to convince the victim to download a malicious application and make it their primary contactless payment method on their mobile.

This application generates an NFC signal that ATMs interpret as if it were the attackers’ card. It is complemented by asking the victim to deposit money into a supposedly secure account using their infected phone, which in reality means that the money ends up directly in the hands of the attackers.

The use of these techniques has resulted in a 188 percent increase in NF attacks against Android smartphones in the first four months of 2026 compared to the same period of the previous year.

According to Kaspersky telemetry data, collected in the report ‘Financial sector threat landscape in 2025’, this company’s cybersecurity solutions blocked 35,600 attacks linked to different families of NFC malware, compared to the block of just over 12,300 attacks in 2025.

Although the security firm indicates that this type of attack has a greater incidence in Russia, it also points out that users in other regions, especially in Europe and Latin America, are also beginning to suffer NFC-based attacks.

To protect yourself from them, it is advisable to avoid installing applications from unofficial sources, such as those received through messengers, social networks, SMS or during phone calls, and not to follow instructions from strangers at ATMs, regardless of who they say they are.