Can NFC cards get viruses or malware?
No. NFC chips store data (a URL or text) but don't run code. A chip cannot be infected with a virus. The only malware risk is if the URL stored on the chip points to a malicious website — which your browser's security features are designed to detect and warn about.
Why chips can't get viruses
Viruses and malware are software that executes on a processor. NFC chips have no processor — they're simple memory chips with a radio interface. They store bytes of data and transmit them when powered by a reader. There's nothing to 'infect.' The chip can hold malicious data (a URL pointing to a bad site), but that data doesn't execute on the chip itself.
The actual risk: malicious URLs
If someone encodes a phishing URL onto an NFC tag, tapping it opens that URL in your browser. Your browser's phishing/malware detection (Google Safe Browsing on Android/Chrome, similar on iOS) may warn you. Standard internet hygiene applies: check the URL before providing any information, and be skeptical of NFC tags in unusual public locations.
Can tapping an NFC card install an app on my phone?
No. Opening a URL in a browser doesn't install anything. An app installation requires you to explicitly download an installer file and authorize the installation.
Can I 'infect' my NFC card from a virus on my phone?
No. Phone software doesn't have access to write NFC chip data without explicit NFC write commands from an app. Your phone OS doesn't spontaneously write to NFC tags.
Should I worry about NFC security if I'm in a security-sensitive role?
Apply standard caution: don't tap NFC tags from unknown sources, especially in public spaces. For business cards exchanged personally, the risk is the same as clicking a link someone hands you.