What is Host Card Emulation?

Host Card Emulation (HCE) is a feature in a mobile device that allows it to emulate a contactless payment card, in software, using NFC. This is great for reach and speed to market—you are no longer dependent on access to the secure element. However, the risk increases if the provisioning of tokens to devices and lifecycle controls are not robust. Attackers will target weaknesses in device security, fraudulent token provisioning, and compromised merchant terminals which can exfiltrate data or redirect funds.

Defenses: robust device binding, attestation (when available), step‑up during wallet enrollment, and detection of anomalous token provisioning (new device, rapid retries, high‑risk ASNs). Continuously monitor merchant terminals for tampering or firmware drift. Treat HCE tokens as you would cards‑on‑file at checkout—use context to score, not just token validity.

For high‑exposure flows such as new payees or large first payments, layer identity verification and adjust the edge according to your payment fraud prevention strategy. Convenience should never outpace control.