Android Apps misusing NFC and HCE to steal payment data on the rise

Zimperium zLabs researchers have found more than 760 Android apps that misuse NFC and HCE to steal payment data, signalling a rapid rise in NFC relay fraud since April 2024. These malicious apps target banks, payment services and government portals worldwide, including Russian banks and regulators, as well as European banks such as PKO, ČSOB and NBS, Brazilian banks, Google Pay and others.

They impersonate trusted institutions to lure victims, and variants can function as paired “scanner/tapper” toolchains or as standalone data collectors that exfiltrate EMV data to Telegram channels, including device IDs, card numbers and expiry dates. Apps prompt users to set them as default NFC payment handlers while background services handle APDU exchanges.

Operators remotely control the apps via a command-and-control server, sending commands to log in, register the device, relay card terminal requests, provide PINs, check status, pair devices, push updates or send Telegram alerts, enabling fake transactions with minimal user involvement. According to Zimperium, since April 2024, over 70 C2 servers and dozens of Telegram bots have targeted over 20 institutions globally, mainly Russian banks.