Are NFC business cards safe? What someone can read, copy or change
Before handing a chip to strangers, or approving cards for a team, it is fair to ask what could go wrong. Here is exactly what is on the chip, how close a phone has to be, and the two questions worth asking any seller.
Yes, for what a business card does. The chip holds only a link - the same one printed in your QR code - and a phone must almost touch it to read it: the NFC Forum gives a typical range of up to 2 cm. Anyone who reads or copies it gets your public link, nothing more. What matters is what your profile shows, and whether the chip is locked against rewriting.
Sources: NFC Forum
₹1,699 card, once · profile from ₹199/year · your logo printed free · usually arrives in 7-10 days
What is actually on an NFC business card's chip?
One web link, stored in a standard format, and nothing else: no name, no number, no photo. Type any link below to see the exact bytes a phone reads from a chip carrying it. Everything personal lives on the page the link opens, which you control from your account.
The first bytes say "one record, a web link"; one byte stands for "https://"; then come the letters of the rest of the link; the last byte marks the end.
The format is the standard one for links on NFC tags, in which common beginnings such as https:// are stored as a single byte. How much of a chip a link uses is worked out in NFC full form, and how the tap works end to end in how NFC business cards work.
Three worries about NFC cards, answered
Reading a card from across a room isn't possible at the ranges NFC is built for. Copying one gives the copier a link they could already scan from the QR code. Rewriting is the one real risk, and NXP's chips have two locks against it: a permanent read-only setting and a password.
Skimming at a distance
The NFC Forum puts typical range at up to 2 cm and Android at 4 cm or less. NXP's figure for its chip is up to 100 mm, "depending on" field strength and antenna design. A business card in a pocket is not read from across a room.
Copying the chip
A copy carries the same public link. For a payment or door card that matters; for a business card, the link is meant to be shared. NXP chips also carry an "ECC-based originality signature" that proves a chip is genuine.
Rewriting the link
An unlocked chip can be rewritten by any phone with a writing app. NXP's NTAG chips offer a "field programmable read-only locking function" and "32-bit password protection". Ask any seller, us included, whether cards ship locked.
Is it safe for someone to tap your card?
Tapping a card opens a web link in the phone's browser, like scanning a QR code; nothing installs and nothing runs on its own. On an iPhone XS or later a notification appears first, and a locked iPhone asks to be unlocked before the link opens. The sensible habit is the same as with QR codes: look at the address before you type into the page.
- iPhone. Apple's note: "iPhone XS and later support background tag reading." The link appears as a notification the person chooses to open.
- Android. The phone reads tags while the screen is unlocked and opens the link in its browser, where the address is shown.
- Unknown tags. A tag in a public place can carry any link, just as a sticker can cover a QR code. The US Federal Trade Commission warns that scammers hide harmful links in QR codes; treat an unfamiliar tag the same way.
What happens if you lose an NFC business card?
Very little. Whoever finds it can open your public profile, as anyone you handed a card to can. On Beeps, a replacement carries the same link, so every card you have already given out keeps working. One printed card can't be switched off on its own, but the page it opens is yours to edit at any moment.
Order a replacement
It carries the same link as the lost card, so nothing you have shared breaks.
Check what your profile shows
If the card is lost somewhere you would rather not be found, take your mobile number or address off the profile for a while. Every card opens the updated page at once.
Leave the link alone
The link on the chip and the QR code is permanent, which is what keeps every card already in people's wallets working.
The chip warranty covers a chip that stops working in normal use for 1 year from delivery; loss and physical damage are not covered. For teams, the way a company keeps a card's link when someone leaves is in digital business cards for teams.
Your profile, not the chip, decides what people see
Because the chip is only a pointer, safety comes down to the page it points to and the account that controls it. Show what you would print on a paper card and no more, protect the account with two-factor login, and on Beeps Pro you can put a password on the profile itself.
- Show what you'd print anyway. A work number and email, not a home address.
- Lock the account. Beeps accounts support two-factor login with an authenticator app.
- Password-protect the page if you need to. Password protection is a Pro feature, ₹299 a year.
- Know what is recorded. Every page and API call is served over HTTPS, and we do not sell personal information; analytics never name the person who tapped. More in can a card tell you who opened it?
NFC card safety: questions
Can someone steal my data from my NFC business card?
There is no data on it to steal beyond your profile link - the same link printed in your QR code and shared every time you hand the card over. Your name, number and photo live on the web page that link opens. To read even the link, a phone has to be held within a few centimetres: the NFC Forum gives a typical range of up to 2 cm.
Sources: NFC Forum
Can an NFC business card be hacked or cloned?
Copying a business card chip gives the copier your public link, which they could already get from the QR code. Rewriting is the risk worth asking about: a chip left unlocked can be rewritten to point elsewhere. NXP's NTAG chips can be locked read-only or protected with a 32-bit password, so ask the seller what they do.
Sources: NXP Semiconductors
What happens if I lose my Beeps card?
Nothing on it is private: whoever finds it can open your public profile, as anyone you gave it to can. A replacement card carries the same link, so every card already shared keeps working. A single printed card cannot be switched off on its own, but what the link opens is your profile, which you can edit at any time.
Is it safe to tap an NFC tag I don't know?
Treat it like an unknown QR code. A tag can carry any link, and a phone opens links in its browser, so look at the web address before you type anything into the page. Regulators warn about harmful links hidden in QR codes, and the same care applies to a tag.
Sources: US Federal Trade Commission
Does the chip in my card wear out?
It has no battery and no moving parts. NXP rates its NTAG chips for 10 years of data retention and 100,000 write cycles, and a business card is read, not rewritten. A Beeps card's chip has a 1-year warranty from delivery against failure in normal use.
Sources: NXP Semiconductors
Sources
Facts about other companies and the wider market come from the pages below, as published by them. Each was read on the date shown. Beeps Card prices come from our own pricing page.
- NFC Forum, NFC Technology - Technical Overview. Checked .
- Android Developers, Near field communication (NFC) overview. Checked .
- NXP Semiconductors, NTAG 213/215/216: NFC Forum Type 2 Tag compliant IC with 144/504/888 bytes user memory. Checked .
- Android Developers, NdefRecord (API reference). Checked .
- Apple Developer, Adding Support for Background Tag Reading. Checked .
- US Federal Trade Commission, Scammers hide harmful links in QR codes to steal your information. Checked .