Is it possible to clone an RFID/NFC card using a simple RFID reader, for future reuse and impersonation?

If it is a basic data providing tag, then it can be cloned. If it is a secure tag, it is far more difficult.

For secure cards used for payments and authentication, a private key is loaded on to the card and the card never discloses it. The public key is kept by the bank or whoever needs to be able to verify that the card was used. If, for example, the card is used for a payment, the vendor's terminal feeds information about the transaction to the card and asks the card to sign the transaction. The card signs the transaction and returns the signature to the reader. This signature allows the vendor to prove to the credit card company that the card was used for that transaction, but it doesn't give the vendor the information needed to clone the card.

There are potentially ways to etch off layers of the card and directly access the circuitry that holds the keys, but such methods are unreliable and difficult to execute, particularly since a good secure tag should be designed to be tamper resistant.

There are some attacks against older protocols that should be going out of use now, but generally speaking, a good, modern, secure tag should not be cloneable. That is the entire point of using this kind of technology rather than a magnetic strip (which is easily cloneable.)


NFC devices which do not use either public key crypto, encrypted tokens or HMAC tokens or similar cryptographic mechanisms where there is a secret that never leaves the device, they can all be impersonated. Simple devices often just have a static string of data which they broadcast.

Many newer NFC devices as well as most enterprise grade devices since basically forever use cryptography which prevents impersonation.

However, some of the new credit cards lack this type of cryptography. But from what I understand most of them now implements cryptography as defined by the EMV security standards.

Then there's also the issue of that some of the variants like some Mifare variants are crackable due to sidechannel attacks against the cryptography. IIRC most newer ones aren't vulnerable, but I'm not entirely sure on the current state on this.