What a Flipper Zero taught me about card security in Indonesia vs Singapore

Two contactless cards. Two countries' payment ecosystems. One pocket-sized tool. Here's what the radio frequencies reveal about everyday card security — without leaving my desk.

I've been curious about the security of contactless cards for a while. I happen to own two interesting ones: a Mandiri e-Money card — the Indonesian Bank Mandiri payment card used across transit, toll booths, and merchants — and a Singapore Tourist Pass (EZ-Link) I kept from a previous trip. Both live in my wallet. Both tap to pay. But are they equally secure?

I pulled out my Flipper Zero — a legitimate, open-source wireless security research tool — and scanned both cards. What took under two seconds per card told a surprisingly detailed story about the security architecture underneath each one.

What the Flipper Zero showed

Breaking down the protocols

What this means in practice

Both cards expose their UID over the air — this is by design in the NFC standard and largely unavoidable. But the more important question is: what else can a passive reader learn?

Key insight

The Mandiri e-Money card's multi-protocol nature is a double-edged sword. It ensures broad reader compatibility across Indonesian transit infrastructure, but it also means more attack surface. An older MIFARE Classic fallback mode is known to be vulnerable to the CRYPTO1 cipher attack — a weakness publicly documented since 2008.

The Flipper Zero is not the threat — it's the mirror

Let's be clear: the Flipper Zero is a legitimate security research tool. What I did was passive scanning — equivalent to looking at a card with a magnifying glass. No data was stolen. No transactions were replayed. No funds were at risk during this experiment.

But the point is this: if a hobbyist device can enumerate your card's full protocol stack in under two seconds from arm's length, a dedicated attacker with a directional antenna and a few hundred dollars of off-the-shelf equipment can do this from across a crowded coffee shop.

Singapore's edge

The EZ-Link system uses ISO14443-4B with what appears to be a proprietary application layer. The Flipper couldn't read anything beyond the UID — suggesting strong application-level encryption or a chip variant that isn't publicly documented. This combination of obscurity and encryption is more resilient than relying on a well-known MIFARE ecosystem alone.

What users and institutions should consider

The bigger picture

This isn't about Indonesia being "less secure" than Singapore. Both countries operate at massive scale with infrastructure that predates many modern NFC security standards. The Mandiri e-Money ecosystem has tens of millions of cards in circulation — migrating that is a huge logistical and financial undertaking.

What this experiment illustrates is that the security of contactless payment infrastructure is worth scrutinizing — especially as these cards carry real monetary value. The Flipper Zero community has done security researchers a favor by democratizing NFC testing. That visibility creates pressure on institutions to improve.

Final thought

A $200 open-source device revealing card protocol stacks in two seconds — sitting right at my own desk — is a wake-up call, not a catastrophe. The real risk isn't the Flipper Zero. It's the assumption that NFC cards in daily use are opaque black boxes that attackers can't inspect. They're not. And the sooner payment infrastructure is designed with that assumption in mind, the better.

#Cybersecurity#NFC#FlipperZero#Fintech#InfoSec#Indonesia#Singapore#ContactlessSecurity#RFID#SecurityResearch