I Built a Flutter Package That Reads Credit Card Data via NFC — Here's How

Abidi Ahmed — Fri, 06 Mar 2026 13:02:51 +0000

A deep dive into building emv_nfc_reader, an open-source Flutter plugin that extracts card numbers, cardholder names, transaction history, and more from EMV chip cards using NFC.

Have you ever wondered what data lives inside your credit card's chip? Beyond the card number printed on the front, EMV chips store a wealth of information — transaction counters, security flags, bank identifiers, and even a history of your recent purchases.

I built emv_nfc_reader — an open-source Flutter plugin that lets you tap a physical credit card against your Android phone and extract all of this data in seconds. In this article, I'll walk you through what the package does, how it works under the hood, and how you can integrate it into your own Flutter project.

🔍 What Can You Actually Extract?

When you tap a card, emv_nfc_reader returns a Map<String, String> containing over 20 data fields:

Category	Fields
Card Identity	PAN (Card Number), Expiry Date, PAN Sequence Number
Cardholder Info	Cardholder Name, Language Preference, Country Code
Bank Details	IBAN, BIC, Application Label
Security Counters	Transaction Counter (ATC), PIN Tries Remaining, Last Online ATC
Transaction History	Date, Amount, Currency of recent transactions
Proprietary Data	Issuer Application Data (IAD), Form Factor Indicator, Card Transaction Qualifiers

Important: This library reads only publicly accessible data from the chip. It cannot extract PINs, CVVs, or private cryptographic keys. EMV security is designed to make that impossible.

🚀 Getting Started in 3 Minutes

Step 1: Add the Dependency

dependencies:
  emv_nfc_reader: ^1.0.3

Step 2: Add NFC Permission

In your android/app/src/main/AndroidManifest.xml:

<uses-permission android:name="android.permission.NFC" />
<uses-feature android:name="android.hardware.nfc" android:required="false" />

Step 3: Read a Card

import 'package:emv_nfc_reader/emv_nfc_reader.dart';

final reader = EmvNfcReader();

final cardData = await reader.startReading();
if (cardData != null) {
  print('Card Number: ${cardData['pan']}');
  print('Expiry: ${cardData['expiry']}');
  print('Holder: ${cardData['cardholder']}');
  print('Transactions Used: ${cardData['atc']}');
}

That's it. Three lines of setup, one function call, and you have the card's data.

🏗️ How It Works Under the Hood

If you're curious about the EMV protocol, here's a simplified view of what happens during a single tap:

Phase 1 — Discovery

The phone sends a SELECT command for the PPSE (Proximity Payment System Environment). The card responds with a list of available applications (Visa, Mastercard, Amex, etc.).

Phase 2 — Application Selection

The library selects the highest-priority application and sends a GET PROCESSING OPTIONS (GPO) command. This is the "handshake" where the card and terminal agree on the transaction parameters.

The Visa Challenge: Many Visa cards require carefully crafted Terminal Transaction Qualifiers (TTQ). Getting the right byte combination (F620C000) was one of the trickiest parts of this project. Without it, the card simply refuses to respond.

Phase 3 — Record Reading

Using the Application File Locator (AFL) from the GPO response, the library reads each record from the card's internal file system. This is where the PAN, expiry date, and cardholder name live.

Phase 4 — Advanced Extraction

Finally, the library sends GET DATA commands for fields that aren't included in the standard records:

80 CA 9F 17 → PIN Try Counter
80 CA 9F 36 → Application Transaction Counter
80 CA 5F 53 → IBAN
80 CA 9F 4D → Log Entry (for transaction history)

📊 Real-World Example: Building a Card Scanner App

Here's a more complete example showing how to build a premium-looking card scanner UI:

class _CardScannerState extends State<CardScanner> {
  final _reader = EmvNfcReader();
  Map<String, String>? _card;

  Future<void> _scan() async {
    try {
      final data = await _reader.startReading();
      setState(() => _card = data);
    } catch (e) {
      // Handle NFC errors
    }
  }

  @override
  Widget build(BuildContext context) {
    return Column(
      children: [
        // Visual credit card widget
        if (_card != null) CreditCardWidget(
          pan: _card!['pan'] ?? '****',
          expiry: _card!['expiry'] ?? '--/--',
          holder: _card!['cardholder'] ?? 'CARD HOLDER',
        ),

        // Data sections
        if (_card != null) ...[
          InfoRow('Transaction Count', _card!['atc'] ?? 'N/A'),
          InfoRow('PIN Tries Left', _card!['pinTry'] ?? 'N/A'),
          InfoRow('IBAN', _card!['iban'] ?? 'N/A'),
        ],

        ElevatedButton(
          onPressed: _scan,
          child: const Text('Tap Your Card'),
        ),
      ],
    );
  }
}

💡 What I Learned Building This

1. Every Card Brand is Different

Visa, Mastercard, and Amex all implement the EMV specification slightly differently. Visa's qVSDC protocol embeds the PAN inside the GPO response (Tag 57), while Mastercard stores it in separate record files. The library handles both transparently.

2. Banks Control What You See

Some fields (like IBAN and Cardholder Name) are entirely optional. Many European banks include them, while North American banks often strip them out for privacy. Your app should always handle null values gracefully.

3. The Chip Never Reveals Its Secrets

EMV chips use a "Secure Element" — a tamper-resistant hardware module that stores private keys. Even with physical access to the chip, you cannot extract these keys. This is why EMV cards can't be cloned like magnetic stripes. The chip signs each transaction with a unique cryptogram, making replay attacks impossible.

🔮 What's Next?

I'm planning to add:

iOS Support via Core NFC
Card Art Detection — identifying the visual design based on the BIN
Offline Balance for prepaid cards that support it

🔗 Links

pub.dev: pub.dev/packages/emv_nfc_reader
GitHub: github.com/abidiahmedcom/emv_nfc_reader
Author Portfolio: https://abidiahmed.com

If you found this useful, give the package a ⭐ on GitHub and a 👍 on pub.dev. It helps other developers discover it!

Have questions or feature requests? Open an issue on GitHub or drop a comment below.

Tags: #flutter #dart #nfc #emv #mobile-development #open-source #android

Forem: Abidi Ahmed