An NFC business card is a physical card with a small chip embedded in it. Hold it against a phone and the phone opens a web page. That is the entire mechanism.
The chip stores a URL. It does not store a name, a phone number, a photograph or a contact file. Everything the other person sees lives on the page the link points to, on a server, not on the card in your hand.
That distinction is worth being precise about, because almost every question people ask about these cards has the same answer once you know it.
What is actually stored on the chip
The chip is an NFC tag holding data in a format called NDEF, which is the standard structure NFC readers expect. For a business card, that data is normally a single URI record: one web address, typically well under a hundred characters.
Tags used for this purpose usually offer somewhere between 144 and 888 bytes of usable memory. A URL uses a fraction of it. There is no room for a meaningful amount of personal data and no reason to put any there.
So if you lose the card, what you have lost is a piece of plastic or paper carrying a web address. Whoever finds it can visit the same page anyone you handed the card to could visit.
How the tap works
The chip has no battery. It is passive, meaning it does nothing at all until a phone comes close enough to power it through its own radio field. The phone energises the chip, the chip returns its stored record, and the phone acts on it.
The working range is a few centimetres. This is not a limitation anyone is trying to fix. Short range is why the interaction is deliberate: a card has to be held against a specific part of a specific phone, so it cannot be read across a room or from a pocket in a crowd.
Nothing is paired, nothing is installed, and no account is created on either side.
Which phones can read one
Android phones with NFC hardware have read tags in the background for years.
On iPhone the picture is split, and the split matters if you hand cards to strangers.
iPhone XS, XS Max and XR, released in 2018, and every model since, read NDEF tags in the background with no app. When the phone is awake, iOS detects the tag and shows a banner that opens the URL in Safari.
iPhone 7, 8 and X have the hardware but not background reading. Their owners can use the NFC Tag Reader in Control Center, added in iOS 14, or an app. In practice this means a small share of people you meet will not get the automatic banner.
That is why every serious implementation prints a QR code on the card as well. The QR code opens the same page through the camera, which works on effectively any modern phone. NFC is the fast path, not the only one.
Can it be cloned or hacked
A standard NFC tag can be read by anyone with a phone, and unless it has been locked, it can be rewritten. This sounds alarming and mostly is not, for a simple reason: the tag contains a public web address. Copying a public URL achieves nothing that visiting the page would not.
The risk worth taking seriously is the opposite direction. An unlocked tag can be overwritten to point somewhere else, which is a phishing concern rather than a data-theft one. Tags issued for business use should be locked read-only at production, which prevents rewriting.
The question that comes up in security reviews is usually put as: what happens if an employee loses their card? The accurate answer is that they lost a link. Nobody gained access to anything, because the card never held anything.
The chip holds a link and nothing else. There is no personal data on the card itself, and a lost card is a link that can be switched off. How that data is stored and protected is covered on our security page.
Why the link matters more than the chip
Most writing about NFC cards concentrates on the hardware, which is the least interesting part. Chips are a commodity. Anyone can produce a card with a working tag in it.
What determines whether the card is useful in a year is what sits at the other end of the link.
If the URL points at a page that can be updated, the printed card survives a job title change, a new phone number and a rebrand, because none of those facts were ever printed. If it points at something static, the card is a printed card with extra steps.
And if the URL points at a record the organisation controls, rather than one the individual controls, then it can also be changed when the individual leaves. That is the difference between a card someone bought for themselves and a card an employer issued. Same chip, same tap, completely different behaviour on the day it matters.
I work in this category, so weigh that last point accordingly. The technical facts above stand on their own.
What an NFC card does not do
It does not track the person you handed it to. The default interaction is one-directional: you share your details, and the other person remains anonymous unless they choose to fill something in.
It does not need an app on either side. If a product requires the recipient to install something, that is a decision the vendor made, not a property of the technology.
It does not replace the exchange. Someone still hands something to someone else. What changes is that the details arrive in the phone during the conversation, rather than waiting to be typed in later by a person who has already moved on. Why that matters more than the card itself is the subject of Your business card was never meant to be kept.
NFC or QR code?
Both open the same page. The difference is how the other person gets there.
- NFC: hold the card near the top of the phone and the page opens. No camera, no app. It needs the physical card and a phone that reads tags in the background, which covers almost every phone in use today.
- QR code: point the camera and tap the link. It works on virtually any smartphone, and unlike a chip it also works from a screen: a slide, a stand graphic or a video-call background.
So the practical answer is both on the same card. NFC is the faster gesture across a table; the QR code is the fallback for older phones and the only option once the card is a picture rather than an object.
The short version
A chip in a card holds one web address. A phone held against it opens that address. Everything else people attribute to NFC business cards, good or bad, is a property of the page at the end of the link and of who controls it.
Want NFC cards that point at a record your company controls? Book a demo and we will show you how DBC1 issues and switches them off.
