NFC Wristbands at Events: How Festival Bands Handle Payments and Access

The band a festival straps to your wrist is a tiny 13.56 MHz NFC chip, and it's usually doing three jobs at once: opening the gate, paying for your drink, and proving who you are. Tap it on a reader and the whole thing settles in a couple of seconds. The interesting question — the one this article answers — is what's actually on that chip, and how much of it your own phone can read.

Quick answer: one band, three jobs

An event wristband is a passive NFC tag running at 13.56 MHz under ISO 14443-A, the same high-frequency standard as the stickers and cards you already tap. The chip sits in fabric, silicone, or a paper band, carries no battery, and wakes up on the reader's field once it's within about four centimetres.

Across concerts, conferences, and festivals it handles three jobs: access control at the gate or a VIP zone, cashless tap-to-pay at the bars and food stalls, and identification that links the band to your registration. Inside is either an open NTAG running NDEF or a secured MIFARE chip — and which one you're wearing decides what the band can do and what you can read.

How payments and access actually work

Cashless runs on a closed loop

Festival cashless is a closed-loop system: the money only works inside the event. You top up a balance online before the gates open or at a kiosk on-site, then tap to pay. That balance lives in one of two places — encrypted in a secure file on the chip itself, so the reader can settle the sale even with no signal, or on the operator's server keyed to the chip's UID. Either way, authorization usually takes two to four seconds, and whatever you don't spend is normally refundable after the event.

Access control mostly works offline

Entry is simpler. Each reader holds the list of valid bands and checks the chip's UID locally, so the gate keeps moving even when a muddy field has knocked out cell coverage. The same trick gates VIP areas, backstage, and camping zones — your band is encoded for the areas you paid for, and the reader just says yes or no.

Which chip is on your wrist

Two chip families cover almost every band.

For identification and networking bands — the kind that share a vCard or a profile URL when someone taps them — an NTAG215 is the usual pick. Its 504 bytes hold a contact card or a link with room to spare, and because NTAG is open NDEF, any phone can read it.

For cashless and secure ticketing, organizers reach for MIFARE DESFire EV2 or EV3. DESFire keeps value in encrypted, file-based applications protected by AES with mutual authentication — exactly what you want guarding a purse. You'll also still see MIFARE Classic on cheap access-only bands. It's inexpensive, but its Crypto-1 cipher has been broken since 2008, so it has no business holding money.

What you can read with NFCore

You can inspect your own band, within the limits the chip sets.

If it's an open NTAG, NFCore reads the NDEF payload — the vCard or URL — plus the chip's UID, on both iOS and Android. If it's a MIFARE Classic access band, an iPhone shows you only the UID; Core NFC doesn't dump Classic sectors the way Android can, one of the platform gaps worth knowing. And if it's a DESFire cashless band, every phone reads the UID and chip type, but the encrypted payment application stays locked — reading the balance needs the operator's keys, which no consumer app, NFCore included, has.

That's the honest boundary, and it's the same one that keeps your money safe. Read your own band to see what it is; you won't be pulling the purse off anyone's wrist. In NFCore, open Read Tag to identify the chip and UID, or the memory dump view to see the raw NDEF on an open band. It's on the App Store and Google Play, stores nothing in the cloud, and needs no account.

FAQ

Can someone steal money by scanning my festival band? Not from a DESFire cashless band — the balance is encrypted, and the reader needs the operator's keys. A casual tap from a stranger's phone gets the UID, nothing spendable.

Will my leftover balance be refunded? Usually, yes. Closed-loop systems almost always offer a post-event refund of unspent funds; check the event's cashless terms for the window and any fee.

Can I read my own wristband with my phone? You can read the UID and chip type on any band, and the full NDEF on an open NTAG band. You can't read an encrypted DESFire purse without the operator's keys.

Do NFC wristbands work without internet? Yes. Access checks and on-chip cashless both settle offline at the reader, which is exactly why festivals lean on them.