On: We can't check the app permissions on Google Play ...

[david_allison]

Do you have a source on that [credit cards]?

From a casual further inspection, there are videos on YouTube which demonstrate this: https://www.youtube.com/watch?v=K_6oMZb8UOI

[Gigachad → david_allison]

Someone else can probably give the technical details but from my understanding, all but the most primitive NFC cards use a challenge/response system rather than just an ID. So there is no way to actually clone the secret stored internally as this is never transmitted.

I'm willing to bet that video is just plain fake. Especially given it only has 2k views.

[david_allison → Gigachad]

I'd put stock in the video, it's using https://github.com/devnied/EMV-NFC-Paycard-Enrollment which seems reasonably popular.