  Imagine when you line up in a store, the person in front of you can make you
pay her bill by using a passive wearable device that forces a scan of your
credit card without your awareness. An important assumption of today's
Near-field Communication (NFC) enabled cards is the limited communication range
between the commercial reader and the NFC cards -- a distance below 5~cm.
Previous approaches to attacking this assumption effectively use mobile phones
and active relays to enlarge the communication range, in order to attack the
NFC cards. However, these approaches require a power supply at the adversary
side, and can be easily localized when mobile phones or active relays transmit
NFC signals.
  We propose ReCoil, a system that uses wearable passive relays to attack NFC
cards by expanding the communication range to 49.6 centimeters, a ten-fold
improvement over its intended commercial distance. ReCoil is a magnetically
coupled resonant wireless power transfer system, which optimizes the energy
transfer by searching the optimal geometry parameters. Specifically, we first
narrow down the feasible area reasonably and design the ReCoil-Ant Colony
Algorithm such that the relays absorb the maximum energy from the reader. In
order to reroute the signal to pass over the surface of human body, we then
design a half waist band by carefully analyzing the impact of the distance and
orientation between two coils on the mutual inductance. Then, three more coils
are added to the system to keep enlarging the communication range. Finally,
extensive experiment results validate our analysis, showing that our passive
relays composed of common copper wires and tunable capacitors expand the range
of NFC attacks to 49.6 centimeters.
