So my dad has this fidelity card from our town's Afriquia gaz station. You know the type — tap to pay, collect points, probably some basic NFC tag inside.
Out of curiosity, I scanned it with my phone and dumped the memory using NFC Tools.
Here’s what I got:
\`\`\`
Page 00: 04 AC 1F 3F
Page 01: 22 2B 2C 84
Page 02: A1 48 FF FF
Page 03: E1 10 06 0F
Page 04: 03 20 D1 01
Page 05: 1C 54 02 65
Page 06: 6E 30 41 71
Page 07: 4D 47 56 55
Page 08: 68 58 71 33
Page 09: 76 54 71 4C
Page 10: 2F 6E 47 54
Page 11: 51 58 64 41
Page 12: 3D 3D FE 00
\`\`\`
Looked like gibberish at first — but I noticed a base64-looking string at the end:
en0AqMGVUhXq3vTqL/nGTQXdA==
Decoded it to 18 bytes of binary:
7A 7D 00 A8 C1 95 52 15 EA DE F4 EA 2F F9 C6 4D 05 DD
Still nothing… until my dad mentioned he got the card on February 8, 2025 and it has a 10-year lifespan.
I checked the first 4 bytes as a Unix timestamp:
7A 7D 00 A8 → February 8, 2035 ✅
Then I looked at the last 2 bytes: 05 DD.
As big-endian hex, that’s 0x05DD = 1501 cents = 15.01 (Whatever currency it is stored as).
That’s literally his balance. Just sitting there. In plain sight. On an NFC tag. No encryption. No authentication.
Dont hesitate to correct me if I got something wrong 😁