How does a Flipper Zero relay attack work?

How the relay actually defeats proximity checks

A relay attack works by extending the communication path, not by breaking the credential itself. One device captures the short-range exchange from the legitimate token, then forwards it in real time to another device near the reader. The reader sees a valid response within the expected timing window and assumes the authorised card, badge, or tag is physically present.

That matters because many proximity systems treat “nearby” as a security signal. If the protocol does not strongly bind the credential to the physical environment, the attacker can preserve enough of the original exchange to pass as legitimate, even though the real token is elsewhere.

Where Flipper Zero fits in the attack chain

Flipper Zero is used as a convenient relay component, not as the thing that creates the weakness. In practice, the attacker needs one endpoint positioned close to the target credential and another positioned close to the reader. The device or its companion setup forwards the interaction so the access system receives what looks like a normal tap, scan, or badge presentation.

The practical limitation is latency and protocol behaviour. Relay attacks are most effective when the underlying system tolerates small delays and does not require strong cryptographic proof of liveness or origin. If the access decision depends mainly on proximity, the attacker can often preserve the user experience while defeating the control.

Why proximity-only controls fail, and what stops them

Proximity is a convenience signal, not a strong trust signal. Systems that rely on “close enough” without mutual authentication, challenge-response, or transaction binding are easier to relay because the reader is validating presence rather than verifying that the credential is operating in the expected context. The same weakness appears across cards, badges, key fobs, and NFC tags when the protocol is designed for speed and simplicity over resistance to relay.

Stronger designs make the credential prove itself cryptographically, rather than merely answering a read request. That is why mutual authentication, per-transaction freshness, and reader-side validation are more effective than distance alone. For practical guidance on reducing this class of weakness, compare the proximity assumption with the stronger access-control and authentication patterns in NIST Cybersecurity Framework 2.0, NIST SP 800-63 Digital Identity Guidelines, and NIST AI Risk Management Framework when proximity-based assurance is part of an automated trust decision.

Risk and Threat Considerations

Relay attacks turn a physical-access assumption into a remote-abuse path. The main risk is that a system can grant access to a credential that is valid but not truly present, which undermines entry controls, badge accountability, and any downstream trust decision that assumes local possession.

Failure mechanism: The attacker preserves the legitimate credential exchange while relocating the transport path, so the reader accepts a relayed interaction as though the token were local.

Impact: Door access, badge checks, and NFC-based approvals can be bypassed without cloning the credential, which makes detection harder and can reduce confidence in access logs and physical control boundaries.

Practitioner Guidance

What to verify: Confirm whether the control decision depends on proximity alone, or whether the reader and token also perform mutual authentication and freshness checks. If the answer is “proximity first, cryptography second,” treat relay resistance as incomplete.

What to prioritise: Focus first on the systems where physical presence gates privileged access, such as secure areas, admin badges, and NFC-enabled entry points. Those are the places where relay abuse creates the highest operational and security impact.

Common mistake: Teams often assume “encrypted NFC” automatically means relay-resistant. Encryption helps protect content, but it does not by itself prove that the credential is physically near the reader at the time of use.

Practitioner takeaway: Relay resistance is about proving local, fresh, cryptographic participation, not just recognising a valid token. If the architecture cannot distinguish a nearby credential from a forwarded one, the proximity control is only partially trustworthy.

Related resources from NHI Mgmt Group

• Why does Zero Trust lower breach impact when remote work and decentralised infrastructure expand the attack surface?
• How do Zero Trust and PAM work together in attack surface management?
• How does Flipper Zero work?
• How does Keyless Entry Relay Attack work?