NFC vs QR vs RFID vs Bluetooth: The Complete Contactless Technology Comparison

Introduction: Four Technologies, One Badly Framed Question

Ask which contactless technology is “best” and you will get four confident answers from four people who are each describing a different problem. The warehouse manager will tell you RFID, because he reads two thousand cartons an hour through cardboard. The marketing lead will tell you QR, because she printed a code on a poster last Tuesday and it cost nothing. The product engineer will tell you Bluetooth, because his device needs to stream sensor data for eight hours. The person handing you a business card will tap it against your phone and say NFC, because your contact details appeared in under a second without either of you opening an app.

They are all right. That is the problem.

NFC, QR codes, RFID and Bluetooth Low Energy are not competitors in a single race. They are four fundamentally different mechanisms for moving small amounts of information across a short physical gap, and they differ in almost every dimension that matters: how far they reach, how much power they need, how much data they carry, what they cost per unit, how they behave when wet or dirty or dark, how easily they can be copied, and — critically — what the human being on the other end has to do.

This guide treats them as what they are: four tools with sharply different edges. We will go through each one at engineering depth, then compare them head to head across the criteria that actually decide deployments, then walk through the specific use cases where each is the correct answer and the specific ones where choosing it is a mistake you will pay for later.

Here is what we will cover:

• The physics and protocol foundations of each technology
• Range, power, data capacity and read speed, with real numbers
• Cost per unit at realistic volumes, and total cost of ownership
• Security threat models — what can actually be attacked, and how
• Phone and reader support in 2026, including the iOS caveats nobody mentions
• Analytics and measurability, which is where most comparisons go wrong
• A structured decision matrix by use case
• Hybrid deployments, where two technologies on one object beat either alone
• Where each technology is heading over the next three to five years

If your interest is specifically in professional networking rather than logistics or access control, the short version is at the end — but the reasoning in the middle is what will stop you buying the wrong thing.

Part One: The Four Technologies at a Glance

Before the detail, a reference table. Every number here is a realistic operating figure rather than a laboratory best case, and each is expanded on later.

Dimension	NFC	QR Code	RFID (UHF)	Bluetooth LE
Physical mechanism	Inductive coupling, 13.56 MHz	Optical pattern recognition	Backscatter radio, 860–960 MHz	Radio, 2.4 GHz ISM
Typical range	0–4 cm	10 cm – 5 m (camera dependent)	1–12 m	10–100 m
Power source in the tag	None (harvested)	None (it is ink)	None (harvested)	Battery (coin cell to Li-ion)
Data capacity	48 bytes – 8 KB on tag	~2–3 KB theoretical, ~300 bytes practical	96–512 bits EPC + user memory	Unlimited (streams from device)
Read speed	~100 ms	0.5–3 s including human aiming	100–1,000 tags/second	Connection ~100 ms, discovery 1–5 s
Bulk reading	No — one tag at a time	No	Yes, this is the entire point	Yes
Unit cost at 1,000	£0.10 – £0.60	£0.00 (printing only)	£0.05 – £0.25	£2 – £15
Reader cost	Every modern phone	Every phone with a camera	£300 – £3,000 dedicated	Every modern phone
Works in the dark	Yes	No	Yes	Yes
Works through packaging	Yes (non-metallic)	No	Yes	Yes
Line of sight required	No	Yes	No	No
Battery maintenance	Never	Never	Never	Every 6 months – 3 years
Cryptographic authentication	Yes (AES, SUN)	No (only what the URL points to)	Limited, varies	Yes (LE Secure Connections)
Native phone support	iPhone 7+, Android 4.4+	Universal	No	Universal
Intent required from user	Tap	Open camera, aim, tap notification	N/A (infrastructure reads it)	Pair or app in foreground

The most important row in that table is the last one. Almost every failed contactless deployment I have seen failed on user intent, not on technology. A QR code that requires four deliberate actions from a person who is not motivated will be ignored. An NFC tag that requires one action will be used. A BLE beacon that requires an installed app will reach the two per cent of the audience that installed the app.

Part Two: NFC in Depth

What it actually is

Near Field Communication is a subset of high-frequency RFID operating at 13.56 MHz, standardised primarily under ISO/IEC 14443 and ISO/IEC 18092. The defining characteristic is that it is a near field technology: it does not radiate a propagating radio wave in normal operation. Instead, the reader’s antenna coil generates an oscillating magnetic field, and the tag’s antenna coil sits inside that field and draws energy from it by induction — exactly the same principle as a transformer, with air between the windings.

This has three consequences that define everything about NFC.

First, the range is short and physically bounded. Magnetic field strength in the near field falls off with the cube of distance, not the square. Double the distance and you have roughly one eighth of the coupling. This is why NFC operates over centimetres rather than metres, and why the range cannot be meaningfully extended by turning up transmit power — you hit regulatory field-strength limits long before you hit useful distance.

Second, the tag needs no battery, ever. The chip runs entirely on harvested energy. A well-made NFC tag has no wear-out mechanism other than physical damage to the antenna or the chip bond. Tags manufactured in 2010 still work.

Third, proximity is authentication of a sort. Not cryptographic authentication, but intentional authentication: a tag cannot be read by accident from across a room. The person holding the phone had to deliberately place it within four centimetres. That single property is why NFC underpins contactless payment and why it is the correct choice for anything involving deliberate human exchange.

The tag side

An NFC tag is a silicon die a fraction of a millimetre across, bonded to an etched or printed antenna coil, laminated into a card, sticker, wristband or inlay. The chip contains a small amount of EEPROM — from 48 usable bytes on the cheapest NTAG213 up to 8 KB on higher-end parts — plus logic implementing the air interface and, on more capable chips, a cryptographic engine.

Data is stored in NDEF format (NFC Data Exchange Format), a compact, standardised container that both iOS and Android parse natively. The most common payload by an enormous margin is a single URI record: a URL. The tag says “go here”, the phone offers to go there, and everything interesting happens on the web page at the other end.

This is worth stating plainly because it is the single most common misunderstanding in the category: an NFC tag in a consumer product almost never stores the interesting data. It stores a pointer. The contact details, profile, product page or ticket lives on a server. That is why the same physical card can be reprogrammed with new information without being reissued — and why the durability question is about the antenna, not the content.

Read behaviour on phones

Modern iPhones (XS and later, running iOS 14+) read NDEF tags in the background with the screen on and unlocked — no app, no setting, no camera. A banner appears at the top of the screen; one tap opens the link. Android has done background reading since 4.4 and, on most devices, opens the URL with a single confirmation or none at all.

Older iPhones (7, 8, X) can read tags but require an app such as the built-in Shortcuts or the NFC reader in Control Centre. In practice, in 2026, the proportion of iPhones in circulation that cannot background-read is small and shrinking, but it is not zero, which is why a well-designed physical product carries a fallback.

Where NFC wins

• Deliberate, one-to-one, in-person exchanges
• Situations where opening a camera is socially awkward or physically inconvenient
• Anything requiring proximity as an implicit security control
• Products where the surface must stay clean and unbranded — the tag is invisible inside the material
• Applications where the destination must be changeable after the object is manufactured

Where NFC loses

• Any distance beyond a few centimetres
• Bulk reading — NFC’s anti-collision handles multiple tags in field, but the intended model is one tag, one tap
• Metal environments without a ferrite isolation layer
• Audiences using devices without NFC hardware, which in 2026 means a small but real slice of budget Android handsets and every iPad

Part Three: QR Codes in Depth

What it actually is

A QR code is not a radio technology at all. It is a two-dimensional optical barcode, standardised as ISO/IEC 18004, invented by Denso Wave in 1994 for tracking automotive parts. The pattern encodes data in a matrix of black and white modules with Reed–Solomon error correction, which is why a code with a logo punched through the middle still scans.

There is no chip, no power, no radio. There is ink. That is simultaneously its greatest strength and its hard ceiling.

Capacity and error correction

A version 40 QR code at the lowest error-correction level can hold 4,296 alphanumeric characters. In practice, nobody uses anything close to that, because the more data you encode, the denser the module grid, and the denser the grid, the larger the printed code has to be and the closer the camera must come. A realistic URL-bearing QR code holds 50 to 300 characters and prints legibly at 2 to 3 cm square.

Error correction comes in four levels — L (7%), M (15%), Q (25%) and H (30%) — describing how much of the code can be obscured while remaining readable. Level H is what allows a brand logo in the centre. Higher correction means more modules, which means a bigger or denser code. It is a direct trade.

The real-world failure modes

QR codes fail in ways that are easy to underestimate from a design mock-up:

• Low light. Camera autofocus and exposure struggle in dim bars, restaurants and evening events — exactly where a lot of consumer scanning happens.
• Glare and lamination. A glossy laminate under a spotlight reflects directly into the lens.
• Curved and flexible surfaces. Bottles, cups and fabric distort the module grid.
• Distance and size mismatch. Rule of thumb: minimum scanning distance is roughly ten times the code’s width. A 2 cm code needs the camera within about 20 cm.
• Damage and dirt. Level H tolerates 30% obscuration; a smeared or scratched code beyond that is simply gone.
• Human hesitation. This is the big one, and it is not technical. Scanning requires unlocking the phone, opening the camera, framing, waiting for recognition, and tapping a notification. Each step loses people.

Security: the uncomfortable part

A QR code is a plain-text pointer that anyone can generate and anyone can print. There is no cryptographic binding between the code and the entity that made it. “Quishing” — sticking a malicious QR code over a legitimate one on a parking meter, restaurant table or invoice — has become a mainstream fraud vector precisely because the attack requires a printer and a roll of adhesive labels.

Crucially, a human cannot visually verify a QR code. You can read a URL and judge it; you cannot look at a module grid and know where it goes. Some phones now preview the destination before opening, which helps, but the underlying problem is structural: the medium carries no proof of origin.

Where QR wins

• Zero marginal cost at any volume — it is printing
• One-to-many broadcast: posters, screens, packaging, TV, presentations
• Distance and scale flexibility — a code on a billboard scans from across a street if printed large enough
• Universal device support with no hardware requirement beyond a camera
• Digital delivery: a QR code can be emailed, displayed on a screen, or embedded in a PDF

Where QR loses

• Low-light and dirty environments
• Anything requiring proof of authenticity
• Interactions where friction matters and the user is not strongly motivated
• Situations where an unbranded, clean physical surface is part of the product
• Contexts where the destination must change after printing (unless you route through a redirect service, which most people do)

Part Four: RFID in Depth

The naming problem

“RFID” is an umbrella term covering several unrelated frequency bands with different physics, and confusing them causes real procurement errors. NFC is technically a subset of HF RFID, but the industry uses “RFID” colloquially to mean the non-NFC bands, especially UHF. Here is the honest breakdown.

Band	Frequency	Range	Typical use	Phone readable?
LF	125–134 kHz	1–10 cm	Animal tagging, legacy access fobs, immobilisers	No
HF	13.56 MHz	1–10 cm	NFC, library books, laundry, smart cards	Yes (NFC subset)
UHF	860–960 MHz	1–12 m	Retail inventory, logistics, asset tracking	No
Microwave	2.45 GHz	1–15 m	Toll roads, active tags	No

When someone says “should I use NFC or RFID?”, they almost always mean “should I use HF/NFC or UHF?” — and the answer is determined by whether a phone needs to read it.

How UHF differs physically

UHF RFID uses backscatter, not inductive coupling. The reader radiates a genuine far-field radio wave; the tag harvests energy from it, then modulates its own antenna’s reflectivity to encode data back into the reflected signal. The reader listens to its own reflection.

This buys you metres of range and the ability to read hundreds of tags per second through anti-collision protocols. It also introduces problems that do not exist in NFC:

• Multipath and nulls. Reflected waves interfere; there are physical dead spots where a tag will not read no matter how close the reader is.
• Water absorption. UHF is absorbed strongly by water and by anything with high water content — human bodies, liquid products, fresh produce.
• Metal detuning and reflection. Metal requires purpose-built on-metal tags with a spacer or ground plane.
• Read reliability is statistical, not binary. Industrial UHF deployments target read rates of 99%+ and design portals, antenna placement and tag orientation to get there. You do not “just read” a pallet; you engineer a portal.

Cost structure

UHF tags themselves are cheap — mass-produced inlays sit in the 4 to 12 pence range at volume, cheaper than most NFC tags because the antenna is smaller relative to capability and volumes are enormous. The cost is entirely on the infrastructure side: fixed portal readers, handhelds, antennas, middleware, and the integration work to make the data mean something. A serious retail deployment is a six-figure project in which the tags are a rounding error.

Where RFID wins

• Reading many items at once, quickly, without line of sight
• Inventory accuracy at scale — retail RFID routinely moves stock accuracy from around 70% to over 95%
• Automated processes with no human in the loop: portals, conveyors, gates
• Asset tracking across large physical spaces

Where RFID loses

• Any consumer-facing interaction, because no phone can read UHF
• Small deployments where reader cost cannot be amortised
• Environments dense with metal or liquid without careful engineering
• Anything where the user is expected to initiate the interaction

Part Five: Bluetooth Low Energy in Depth

What it actually is

Bluetooth Low Energy is a wireless personal area network protocol operating in the 2.4 GHz ISM band, introduced with Bluetooth 4.0 in 2010 and functionally unrelated to Classic Bluetooth despite the shared brand. It is a powered, two-way, connection-oriented technology. That single sentence separates it from everything else in this article.

BLE devices operate in two broad modes. In advertising mode, a device broadcasts small packets — 31 bytes of payload in the legacy format, up to 255 with extended advertising — at an interval typically between 100 ms and a few seconds. Anything listening nearby can hear them. This is how beacons, fitness trackers announcing presence, and Apple’s Find My network operate. In connected mode, two devices establish a link and exchange arbitrary data using GATT (Generic Attribute Profile), a structured client-server model of services and characteristics.

Power: the defining constraint

BLE needs a battery. This is the hinge on which most BLE decisions turn.

A CR2032 coin cell holds roughly 220 mAh. A beacon advertising once per second with modest transmit power draws on the order of 20–50 µA average, giving somewhere between one and three years of life depending on interval, transmit power, temperature and the honesty of the manufacturer’s datasheet. Shorten the advertising interval to 100 ms for faster discovery and you may cut that to months.

For a fleet of ten beacons in one building, replacement is an afternoon. For ten thousand assets across forty sites, battery management is an operational programme with its own budget, staff time and failure reporting. Anyone comparing BLE to NFC on unit price alone and ignoring this is comparing the wrong numbers.

The app problem

This is the second constraint, and in consumer contexts it is fatal more often than the battery.

An NFC tag or a QR code reaches any phone. A BLE beacon reaches only phones running software that is listening for it. On iOS, background BLE scanning for arbitrary devices is heavily restricted; an app must be installed, must have been granted Bluetooth and often location permission, and even then background behaviour is constrained. Android is more permissive but has tightened location-linked Bluetooth permissions substantially since Android 12.

The consequence is stark. The retail beacon boom of 2014–2017 collapsed almost entirely on this point: brands installed hardware to push offers to shoppers, then discovered that the addressable audience was only the small fraction of shoppers who had installed the retailer’s app, opened it, granted Bluetooth permission and left notifications on. The hardware worked perfectly. The funnel did not exist.

Where BLE thrives is precisely where that funnel does exist: a company’s own workforce with a mandated app, a device owner pairing their own accessory, or hardware talking to hardware with no consumer in the middle.

Where BLE wins

• Continuous or repeated communication rather than a single moment of exchange
• Two-way data: sensor telemetry, firmware updates, configuration, control
• Real-time location systems with metre-level accuracy across a building
• Anything requiring the tag to initiate contact rather than wait to be read
• Devices with their own power budget already — wearables, medical devices, industrial sensors

Where BLE loses

• One-off exchanges with strangers, where installing an app is inconceivable
• Cost-sensitive volume deployments — the cheapest credible beacon is roughly twenty times the price of a good NFC tag
• Disposable or embedded-in-print applications
• Any deployment where battery replacement logistics exceed the value of the data

Part Six: Head to Head on the Criteria That Decide Deployments

Range

This is the axis on which the four separate most cleanly, and the correct framing is not “more is better” but “how much do I want?”

NFC’s four centimetres is not a limitation to be worked around; it is a feature that guarantees intent. UHF RFID’s ten metres is essential for reading a pallet and useless for a business card. BLE’s hundred metres is what makes indoor positioning possible and what makes it unusable as a proof of physical presence, because a beacon detected does not mean a person standing in front of the thing.

QR sits oddly here because its range scales with print size. A code the size of a stamp needs 20 cm; a code on the side of a building scans from the pavement. That flexibility is genuinely unique among the four.

Cost at realistic volumes

Component	NFC	QR	UHF RFID	BLE
Tag/label at 1,000 units	£0.10–£0.60	Printing only	£0.05–£0.25	£2–£15
Tag at 100,000 units	£0.04–£0.15	Printing only	£0.03–£0.08	£1.50–£8
Encoding/programming	£0.01–£0.05 per unit	£0	£0.01–£0.03	Firmware development
Reader hardware	£0 (phones)	£0 (phones)	£300–£3,000 each	£0 (phones)
Ongoing cost	None	None	Reader maintenance	Battery replacement + labour
Integration effort	Low	Very low	High	Medium–high

The pattern is clear: QR is cheapest to deploy and cheapest to attack. NFC is cheap per unit with zero infrastructure because the readers are already in everyone’s pocket. UHF is cheap per tag and expensive per site. BLE is expensive per unit and expensive to maintain, and you pay that because you need capabilities the others do not have.

Security

Ranked honestly, from weakest to strongest for a naive implementation:

1. QR code. No authentication of any kind. Anyone can print a code pointing anywhere. The user cannot visually verify the destination. Overlay attacks are trivial and increasingly common.

2. Basic NFC (NTAG213/215/216 with an open URL). Contents are readable by anyone with a phone and clonable to another tag in seconds. Write-locking prevents modification of the original but not duplication. Better than QR only in that the attacker must physically replace an object rather than stick a label on it.

3. UHF RFID. Most EPC Gen2 tags broadcast a plain identifier to anyone with a reader, at range. Some support password-protected memory and a few support crypto, but the commodity tags in a retail supply chain are readable and, in many cases, cloneable.

4. BLE with LE Secure Connections. Elliptic-curve key exchange, AES-CCM encrypted links, address randomisation to prevent tracking. Genuinely strong when implemented correctly, and frequently implemented incorrectly — insecure “Just Works” pairing is common in cheap hardware.

5. NFC with cryptographic authentication (NTAG 424 DNA, DESFire EV3). AES-128 mutual authentication, and in the case of SUN messaging, a fresh cryptographic MAC generated on every single read, so a captured URL cannot be replayed and a cloned tag produces an invalid signature. Combined with the physical proximity requirement, this is the strongest of the four for authenticating a physical object.

The gap between item 2 and item 5 is the entire reason chip selection matters. If you are choosing hardware for anything where authenticity matters, the differences between NFC chip families are not a detail — they are the decision.

Analytics and measurability

This is where comparisons usually go wrong, because people compare the technology when they should compare the implementation.

• QR is measurable if the code points to a tracked URL. You get scan counts, timestamps, device type and referrer. You do not reliably get which physical code was scanned unless you generate unique codes per placement, which most people do not.
• NFC is measurable in the same way, and better: chips with a read counter and ASCII mirroring inject a per-tag identifier and an incrementing counter into the URL automatically. That means genuine per-object analytics without any manual code management, and a weak clone-detection signal for free.
• UHF RFID produces enormous volumes of read events but no user context. It tells you where an object is, not who engaged with it.
• BLE produces the richest data — dwell time, proximity, repeat visits, movement paths — for the small subset of users running your app.

For consumer-facing measurement, NFC and QR are effectively equivalent in what they capture, with NFC edging ahead on per-unit granularity and QR ahead on reach.

The human factor

Count the actions.

NFC: unlock phone (usually already unlocked), tap card, tap banner. Two to three actions, two seconds, no aiming.

QR: unlock phone, open camera, aim, hold steady, wait for detection, tap notification. Five to six actions, five to ten seconds, and it fails in poor light.

BLE: install app, grant permissions, open app or accept a background notification. Anywhere from three actions to an insurmountable barrier depending on whether the app already exists.

RFID: none, because the user is not involved.

Each additional action costs conversions. In face-to-face professional exchange, the difference between a two-second tap and a ten-second fumble is the difference between a contact captured and a moment lost — which is why tap-to-share cards replaced QR-printed cards in the professional networking category rather than the other way around.

Part Seven: The Decision Matrix by Use Case

Business cards and professional networking → NFC, with a QR fallback

The interaction is one-to-one, in person, at conversational distance, often in poor lighting, and social friction is the binding constraint. A tap is elegant; asking someone to open their camera and aim it at a card is not. NFC wins decisively.

The nuance is the fallback. A small minority of phones cannot background-read NFC, and a small minority of people will fumble the tap. A printed QR code on the reverse, or a short memorable URL, converts those cases instead of losing them. The best cards carry both and lead with the tap.

The second nuance is that the physical card is only half the product. What the tap opens matters more than how it opens: a profile you can edit after the cards are printed means a role change, a new number or a rebrand does not turn a box of cards into landfill.

Retail inventory and supply chain → UHF RFID

Nothing else can read a sealed carton of forty garments in two seconds without opening it. NFC cannot bulk read at range, QR requires line of sight per item, and BLE per item is economically absurd. This is the one category where the answer is unambiguous.

Event ticketing → QR, with NFC for premium and access control

QR wins because tickets are delivered digitally, displayed on screens, printed at home and forwarded to friends. NFC cannot be emailed. Where physical credentials already exist — staff passes, VIP wristbands, season cards — NFC or HF RFID is the better mechanism because it is faster at the gate and harder to screenshot.

Access control → NFC/HF RFID

Proximity as an implicit security control is exactly right for a door. Credentials should be DESFire-class with real cryptography, not legacy 125 kHz LF fobs or MIFARE Classic, both of which are cloneable with hardware that costs less than a meal out. BLE-based access has real advantages for mobile credentials and remote provisioning, and real drawbacks around battery, app dependency and relay attacks.

Product authentication and anti-counterfeiting → NFC with SUN

A cryptographically signed, per-read-unique URL from an NTAG 424 DNA chip is currently the strongest practical answer available to a consumer with only a phone. QR codes on packaging are copied by photographing them. Static NFC tags are cloned by reading and rewriting. Only a fresh cryptographic signature per read defeats both.

Restaurant menus and posters → QR

One-to-many broadcast, printed at zero marginal cost, replaced by reprinting. NFC tags on every table are a legitimate premium upgrade but rarely justify the cost, and QR’s ability to be scanned by multiple people simultaneously from across a table is a genuine advantage.

Asset tracking inside a building → BLE or UHF, depending on granularity

If you need to know which room, BLE real-time location wins. If you need to know which of ten thousand items passed through a doorway, UHF wins. If you need to know when a specific person deliberately inspected a specific asset, NFC on the asset with a phone-based inspection app wins, and costs a fraction of both.

Wearables, medical devices and sensors → BLE

Continuous two-way data with a device that already has power. Not a contest.

Part Eight: Hybrid Deployments — Where Two Beat One

The framing of this article has been comparative, but the most robust real-world deployments rarely choose one technology. They layer.

NFC + QR on the same object

The canonical hybrid, and the correct default for any consumer-facing physical product. NFC is the primary path — fast, frictionless, no aiming. QR is the fallback for phones without NFC, for users who prefer it, and for anyone who cannot find the tap point. Both can resolve to the same URL, so analytics stay unified and there is nothing extra to maintain.

Design notes that matter: place the QR code where it does not compete visually with the primary surface, and make the tap point discoverable. A small NFC glyph or a subtle “tap here” cue increases first-time success rates dramatically, because most people do not know where the antenna sits inside a card. Cards built this way tend to convert on the first attempt rather than the third.

UHF RFID + QR in retail

UHF handles inventory at the pallet, carton and rail level. QR on the swing ticket handles the shopper, who cannot read UHF with a phone. The two systems address different audiences on the same garment and rarely interact.

BLE + NFC in access and industrial systems

NFC provides the fallback that works when the battery is dead, the phone is off, or the app is not installed. BLE provides the convenience path — hands-free unlock, remote provisioning, over-the-air credential updates. Many modern smart locks ship exactly this combination for precisely this reason: BLE for the good day, NFC for the bad one.

NFC + BLE in devices

An increasingly common pattern in consumer hardware: tap the phone to the device, the NFC tag hands over the BLE pairing parameters, and the connection completes without menus or PIN codes. NFC solves the discovery and intent problem; BLE handles the data. This is “NFC handover”, it is standardised, and it is the single most user-friendly pairing experience available.

Part Nine: Total Cost of Ownership Over Three Years

Unit price is the wrong number. Here is a more honest comparison for a hypothetical deployment of 1,000 objects that must remain functional for three years.

Cost line	NFC	QR	UHF RFID	BLE
Hardware, 1,000 units	£250	£0 (in print cost)	£120	£4,000
Encoding / production setup	£150	£0	£200	£2,500 (firmware)
Reader infrastructure	£0	£0	£6,000	£0
Hosting / platform, 3 years	£300	£300	£3,000	£1,800
Battery replacement, 3 years	£0	£0	£0	£1,200 + labour
Replacement for failures	~2%	~5% (wear/damage)	~3%	~8%
Approximate 3-year total	~£700	~£300	~£9,300	~£9,500

These figures are illustrative rather than quotable, and they will move by a factor of two in either direction depending on specification and supplier. The structural point holds regardless: QR is cheapest, NFC is close behind and buys a materially better interaction, and RFID and BLE are order-of-magnitude commitments that must be justified by capabilities the cheaper options simply cannot deliver.

The other structural point is durability. A printed QR code degrades with the surface it is printed on. An NFC tag laminated inside PVC or metal has no consumable component and typically outlives the object’s usefulness. A BLE beacon has a defined, finite life measured in battery cycles. Over a three-year horizon, “no maintenance” is worth more than most spreadsheets capture.

Part Ten: A Practical Threat Model

Security discussions in this category tend to collapse into vague reassurance. Here is a concrete attacker-oriented view.

Attack 1: Overlay or substitution

Applies to: QR (trivial), NFC (moderate), UHF (moderate)

The attacker replaces the legitimate pointer with their own. For QR this requires a sticker. For NFC it requires physically swapping or re-encoding the tag, which needs access to the object and, if the tag was write-locked at manufacture, is impossible without replacing the object outright.

Mitigation: Write-lock NFC tags at production. For high-value placements, use tamper-evident materials. For QR, inspect placements physically and use short branded domains so a wrong destination is more visible in the phone’s preview.

Attack 2: Cloning

Applies to: basic NFC (trivial), LF RFID (trivial), MIFARE Classic (trivial), UHF (varies)

The attacker reads the tag and writes identical content to a blank. For a tag containing only a URL, this is a ten-second operation with a £15 phone app and a £0.30 blank.

Mitigation: Cryptographic tags. NTAG 424 DNA’s SUN mechanism produces a different, server-verifiable code on every read, so a clone that copies the current URL fails on the second use. DESFire EV3 requires possession of AES keys that never leave the chip.

Attack 3: Eavesdropping and relay

Applies to: all radio technologies, in theory

NFC’s near-field operation makes passive eavesdropping hard but not impossible — laboratory work has demonstrated it at up to a metre with directional equipment. BLE is trivially sniffable in the clear if pairing is insecure. UHF is readable at range by design.

Relay attacks, where two attackers bridge the gap between a credential and a reader, are a genuine concern in contactless access control and payments, and are mitigated by timing constraints and distance-bounding rather than by encryption.

Mitigation: Encrypt the link. Do not transmit anything secret in the clear on any of these technologies. Assume the identifier is public and put the security on the server.

Attack 4: Tracking

Applies to: UHF (severe), BLE (moderate), NFC (minimal)

A UHF tag broadcasts a static identifier to any reader within metres. BLE mitigates this with resolvable private addresses that rotate, but many cheap devices do not implement it. NFC’s range makes covert tracking essentially impractical.

Mitigation: Kill or shield UHF tags after retail sale. Enforce address randomisation in BLE. This is one of NFC’s genuine, under-appreciated privacy advantages.

Attack 5: Malicious payload

Applies to: NFC and QR equally

Both can point to a phishing page or a malicious download. Neither technology is at fault; the URL is the payload and the browser is the defence.

Mitigation: Phone-level destination previews, which both iOS and Android now show before opening. This is exactly why NDEF URI records and QR codes should use recognisable domains — an unfamiliar shortener in the preview is the only warning most users will get.

Part Eleven: Where Each Technology Is Heading

NFC is expanding beyond the tap. The NFC Forum’s multi-purpose roadmap targets longer usable range through improved antenna design and higher power transfer for wireless charging of small devices at up to a watt. On the security side, SUN-capable chips are moving from premium to mainstream pricing, which will make cryptographically authenticated physical objects the default rather than a luxury. Regulatory pressure in the EU around digital product passports is also pushing item-level tagging into categories that never previously carried a chip.

QR is not going anywhere, and the pandemic permanently normalised scanning behaviour that had stalled for a decade. The interesting development is GS1 Digital Link, which is progressively replacing the traditional barcode on retail packaging with a QR code that encodes both the product identifier and a web destination in one symbol. That transition is scheduled to reach global scale by 2027 and will put a scannable web link on essentially every consumer product.

RFID continues to consolidate in retail and logistics, with adoption driven by mandates from large retailers rather than organic demand. The unit economics keep improving and the interesting frontier is battery-free sensing — tags that report temperature, moisture or strain using only harvested energy.

BLE is being reshaped by Bluetooth Channel Sounding, introduced in Bluetooth 6.0, which brings centimetre-class distance measurement and meaningful anti-relay protection to a technology that previously estimated distance from signal strength alone. That upgrade materially strengthens the case for BLE in access control and asset location.

The net effect across all four is convergence rather than displacement. Objects will increasingly carry more than one identifier, and the interesting design question moves from “which technology?” to “which technology leads the interaction?”

Frequently Asked Questions

Is NFC just a type of RFID?

Technically yes — NFC operates at 13.56 MHz, which is the HF RFID band, and NFC card readers can communicate with certain HF RFID tags. In practice the terms are used to mean different things: NFC implies phone-readable, short-range, standardised NDEF data exchange, while “RFID” colloquially means the UHF systems used in logistics that no phone can read. If a supplier uses the terms interchangeably, ask which frequency band they are selling.

Which is more secure, NFC or QR?

NFC, and the gap is wide when cryptographic chips are used. A QR code has no mechanism to prove it is authentic; anyone can print one and stick it over another. A basic NFC tag is only modestly better, but an NTAG 424 DNA or DESFire tag produces cryptographic proof that cannot be forged by copying. Physical proximity adds a further constraint that QR does not have.

Do NFC cards work with every phone?

Every iPhone from the XS onward reads NFC card tags in the background with no app. iPhone 7, 8 and X can read them but need an app or Control Centre shortcut. Almost all Android phones released since 2014 support NFC, though a small number of entry-level models omit the hardware. Coverage across the phones people actually carry in 2026 is very high, but a QR fallback still catches the remainder.

Can NFC tags be reprogrammed?

Yes, unless they have been permanently locked. Most tags ship rewritable and can be re-encoded with any NFC writing app. Well-made commercial products lock the tag at production so the destination cannot be tampered with, and change the content on the server instead — which is the correct architecture, because it means updating information never requires touching the physical object.

Why do some NFC taps fail?

Almost always one of four reasons: the phone’s NFC antenna is not aligned with the tag’s (antenna position varies by handset — top rear on iPhone, centre rear on most Android), a metal case or surface is detuning the field, the tag is not NDEF-formatted, or the phone’s screen is off or locked. Moving the phone slowly across the object rather than holding it in one spot resolves the majority of failures.

Does NFC drain phone battery?

Negligibly. The NFC controller in a modern phone is a low-power polling circuit; leaving it enabled costs a fraction of a percent of daily battery. The energy for the tag comes from the phone’s field during the tap itself, which lasts well under a second.

Can I use one card for both NFC and QR?

Yes, and you should. The two mechanisms can resolve to the same URL, so there is one destination to maintain and one set of analytics. Lead with the tap and treat the printed code as the safety net.

What happens to an NFC card if the company behind it disappears?

This is the right question to ask and rarely asked. Because the tag stores a URL rather than the data, the card is only as durable as the service resolving that URL. Ask whether the destination can be re-encoded, whether the profile data can be exported, and whether the tag is locked to a single vendor’s domain. A card that lets you own or export your data is worth more than one that does not.

Is UHF RFID readable by a smartphone?

No. Phones have 13.56 MHz NFC hardware only. Reading UHF requires a dedicated reader or a phone sled accessory, typically costing several hundred pounds. This is the single most common and most expensive misunderstanding in the category.

How long do these technologies last physically?

NFC and RFID tags have no consumable components and typically survive as long as the object holding them, with failure coming from antenna bond fatigue after repeated flexing rather than chip degradation. A printed QR code lasts as long as the print survives abrasion, UV and moisture. BLE beacons are limited by battery, generally one to three years.

Conclusion: Match the Technology to the Moment

The right way to choose is not to rank these four but to describe the moment of interaction precisely, then let the description select the technology.

If the moment is one person deliberately engaging with one object at arm’s length, NFC is the answer, because it turns the interaction into a single gesture and demands nothing from the other person’s device.

If the moment is many people looking at one surface from varying distances, QR is the answer, because it costs nothing, scales with print size and reaches every camera.

If the moment is a machine counting many objects with no human present, UHF RFID is the answer, and the tags are the cheapest part of a project whose real cost is infrastructure.

If the moment is continuous two-way conversation with a device that already has power, BLE is the answer, and the battery and app dependency are the price of that capability.

Most real deployments contain more than one moment, which is why the strongest designs layer technologies rather than choosing between them — NFC leading with QR beneath it, or BLE for convenience with NFC as the fallback that works when everything else has failed.

The failure mode to avoid is choosing on unit price or on novelty. A QR code that nobody scans is not cheap; it is a wasted print run. A beacon network that reaches two per cent of an audience is not smart; it is expensive infrastructure serving almost nobody. And a cryptographic NFC chip on a promotional item with a six-week life is money spent on a threat that does not exist.

Describe the moment honestly, count the actions you are asking a human to take, be truthful about the three-year cost including maintenance, and the choice usually makes itself. For anyone weighing these options specifically for professional identity and in-person networking, the deciding factors are friction and update-ability — which is the reasoning behind how Evrycard approaches contactless networking, and the same reasoning applies whatever hardware you end up buying.