Dissecting a Credit Card Under a 200°C Heat Gun
In July 2023, engineer Matteo P. frequently encountered payment friction while traveling across Europe: every time he navigated a rushed subway turnstile or checked out at a coffee shop, he had to pull out his smartphone, unlock the screen, and launch a payment card. The multi-step mobile payment workflow felt sluggish in fast-moving queues, while holding a rectangular hard plastic bank card carried a high risk of loss. To escape this clunky interaction, he grabbed a heat gun set to 200°C and directly baked his contactless credit card.
Under the high heat, the plastic card body quickly softened and melted away, cleanly revealing the tiny chip and embedded antenna inside. Measuring only a few square millimeters, this microchip houses the public-key cryptography and authentication architecture built by the banking industry over decades. The hard plastic shell of a credit card is merely a physical housing convenient for human hands; the actual payment verification takes place entirely within the cryptographic unit inside the chip. As long as the chip remains undamaged physically, its payment functionality is completely preserved.
Figure: The modified F-91W on the wrist. Source: Hackernoon
Matteo P. chose the classic Casio F-91W digital watch, first introduced in 1989, as his carrier. Retailing for around $10, this iconic digital timepiece boasts a 7-year battery life and is arguably the most familiar wearable device among global hackers. Transplanting a bank card chip into such an affordable watch dramatically shortens the payment interaction into a seamless wrist flick taking milliseconds, without sacrificing wearing comfort.
A Passive Radio Dialogue at 13.56 MHz
At the physical layer, contactless payment is essentially a radio frequency energy and data exchange occurring at 13.56 MHz. The IC chip inside a bank card has no battery of its own; it operates as a standard passive RFID/NFC device. When the card approaches a POS terminal, the electromagnetic field emitted by the card reader induces a micro-current in the card’s antenna, instantly powering up the chip to complete the cryptographic handshake.
This passive power mechanism means the chip transplant requires no hookup to the watch’s power circuitry. Tucked inside the F-91W casing, the chip draws zero energy from the watch’s original CR2016 coin cell battery. The passive induction architecture completely decouples the payment module from the watch’s power system, allowing payment functionality to operate independently even if the watch battery dies.
Figure: F-91W disassembly. Source: Hackernoon
The size and design of the antenna determine whether this RF dialogue succeeds. Theoretically, an ideal full-wavelength antenna at 13.56 MHz spans 22 meters. In the constrained medium of a credit card, engineers rely on fractional-wavelength loop coils. Once the original card melted under the heat gun, the resulting deformation shifted the resonance point, requiring antenna parameters to be recalibrated inside the watch’s tight enclosure.
Fishing Reels and Precision Tuning with a $50 Vector Network Analyzer
To reconstruct the antenna inside the tiny watch case, Matteo P. hand-wound enameled copper wire with a diameter of just 0.10 mm. Constrained by limited workshop tools, he repurposed a fishing reel to control the winding tension and turn count, attempting to match the target inductance by adjusting the coil loops. Hand-wound antennas require iterative assembly and testing, as minor changes in physical turn spacing induce frequency drift.
Measuring antenna resonance depends on specialized RF instrumentation. The modding process relied on a NanoVNA—a handheld vector network analyzer costing roughly $50—paired with Proxmark3, an open-source RFID research platform, to monitor the coil’s impedance and resonance peaks at 13.56 MHz in real time. The high-precision network analyzer converted invisible high-frequency electromagnetic field variations into intuitive curves, ensuring the coil induces maximum voltage when near a POS terminal probe.
Figure: Finished watch on wrist and contactless payment test. Source: Hackernoon
During debugging, a capacitor scavenged from an RFID-RC522 reader module served as a temporary antenna probe to capture weak signals around the coil. The metal backplate and internal circuit board of the watch introduced severe electromagnetic shielding and parasitic capacitance effects, forcing the antenna to maintain precise physical isolation from metal watch components. Through turn-by-turn tuning via NanoVNA, the enameled wire coil locked into the optimal resonance point within the watch case gap.
Stripping the Plastic Movement: Giving a Classic Digital Watch a Second Heart
The internal physical space of the Casio F-91W is extremely tight, with the factory movement occupying almost the entire resin case. To fit both the custom antenna and the transplanted chip, Matteo P. trimmed away the watch’s internal plastic support structure. This physical mod required modifying the internal frame while keeping the LCD screen and button contact springs stably positioned.
The missing internal framework was replaced by custom 3D-printed front and rear inserts. The newly designed inserts re-allocated internal compartments, providing isolation channels for the chip and enameled coil to prevent button presses from squeezing the antenna. The LCD screen window was sealed and fixed with UV resin glue, preserving dust resistance and original visual aesthetics.
Figure: Receipt from the first contactless payment transaction. Source: Hackernoon
The modified watch retained the signature green backlight and timekeeping functions of the F-91W. When the watch approached a POS terminal for the first time, a crisp beep sounded, and a transaction receipt printed smoothly. This physical migration proved that the packaging form factor of a credit card chip can be arbitrarily reconfigured without altering a single line of code in the underlying financial payment infrastructure.
The Battle for the Final Centimeter of Payment Terminals
Traditional banks and smart hardware vendors have long sought to control the physical form factor of payment terminals: banks rely on rigid plastic cards, while smartwatch makers push complex operating systems and secure element chips. Matteo P.’s mod disrupted this form-factor monopoly. Bypassing illegal paths like cloning or tampering with card data, he physically relocated his own legitimate chip from a plastic card onto his wrist.
In our view, this engineering experiment demonstrates how a hacker using a heat gun, enameled wire, and a $50 RF analyzer can bridge the interaction gaps left by the financial hardware supply chain. The cryptographic algorithms and private keys inside the chip form the real barrier of payment security; whether the outer shell is a plastic card or a digital watch has no bearing on authentication reliability.
As more open-source hardware enthusiasts share F-91W NFC modification designs on GitHub and community forums, new possibilities emerge for the evolution of wearable payment devices. Future personal payment tools won’t require bloated operating systems or frequent charging schedules—minimal physical transplantation can grant contactless payment capabilities to everyday objects. In this tug-of-war between convenience and security, the openness of the hardware layer ultimately defines the user experience.
Reference Links:
- Hackernoon: How I Hacked and Turned My Casio F-91W into a Contactless Payment Device
- Lobsters Community Discussion (lobste.rs/s/bhzp2z)
