Host-based card emulation (HCE) is an Android feature that lets an app behave like a contactless payment card over NFC. Instead of relying on a physical secure element in the phone, the app can process NFC card commands in software and present card-like responses to a reader such as a point-of-sale terminal.
HCE matters because it enables legitimate mobile wallets, but it also expands the attack surface. If a malicious app or compromised device can control the emulation path, attackers may try to impersonate a card, abuse stored payment credentials, or support card-present fraud at checkout. Defenders reduce risk by keeping NFC and app permissions tight, using platform security controls, preferring secure hardware-backed payment flows where available, and monitoring for unusual contactless transactions or device compromise.