The Flipper Zero has acquired a strange public reputation. To enthusiasts, it is a pocket-sized electronics and cybersecurity laboratory. To some commentators, it is a universal “hacking device” capable of unlocking cars, cloning bank cards and interfering with critical infrastructure.

Neither description is entirely accurate.

For law enforcement, the Flipper Zero deserves attention because it packs several previously specialised capabilities into a cheap, portable and accessible device. It can interact with some access cards, radio remotes, infrared equipment, computers and embedded hardware. Those capabilities can support authorised security testing, training and investigation—but can also be misused for unauthorised access, disruption or credential collection.

The correct response is therefore not panic or prohibition. It is technical literacy.

What is a Flipper Zero?

The Flipper Zero is a handheld electronic multi-tool built around several separate interfaces:

• A sub-1 GHz radio transceiver
• A 13.56 MHz NFC reader and emulator
• A 125 kHz low-frequency RFID interface
• An infrared transmitter and receiver
• Bluetooth Low Energy
• USB connectivity
• iButton and 1-Wire support
• General-purpose input/output or GPIO, pins for connecting external hardware

Its official specifications list a CC1101 sub-1 GHz transceiver, NFC and RFID hardware, Bluetooth LE, USB 2.0 and a microSD card capable of storing user data, applications and captured signals. Its radio bands vary by region, with official firmware applying regional transmission restrictions.

That collection of interfaces is what makes the device interesting. None is particularly revolutionary on its own. Similar functions have long been available using specialist badge readers, programmable USB devices, universal remotes, development boards and radio equipment. The Flipper Zero combines simplified versions of them in one recognisable package.

It is better understood as a convenient collection of physical-security testing tools than as a universal hacking device.

Why should law enforcement understand it?

Police officers may encounter a Flipper Zero in several different contexts:

• As an innocent hobbyist or cybersecurity researcher’s device
• As equipment used during an authorised security assessment
• As an item found during a search connected to burglary, fraud or computer misuse
• As a device containing stored credentials, radio recordings or scripts
• As an instrument allegedly used to interfere with local electronic equipment
• As a suspicious-looking object reported by members of the public

Possession alone does not establish criminal intent. The same device can be used to audit a building’s access controls or to attempt entry without permission.

Context, configuration, stored data and associated conduct matter considerably more than the product name printed on the casing.

Legitimate law-enforcement uses

1. Testing police access-control systems

Many police buildings, evidence stores, vehicle compounds and partner facilities use electronic credentials. Some older systems still rely on low-frequency RFID cards that transmit an identifier without strong cryptographic authentication.

The Flipper Zero can read, save, emulate and, with compatible rewritable tags, write several forms of 125 kHz RFID credential. Its manufacturer explicitly notes that low-frequency RFID cards do not generally provide high levels of security.

Under controlled and properly authorised conditions, a Flipper can help a police security team answer questions such as:

• Can an issued badge be read without removing it from its holder?
• Does the system depend only on a clonable identification number?
• Are lost or cancelled credentials rejected immediately?
• Can an emulated credential pass through a reader?
• Do additional controls protect sensitive rooms?

This does not replace a professional access-control assessment. More capable tools may be needed to examine encrypted cards, reader communications, backend configuration and credential lifecycle management. Nevertheless, a Flipper can demonstrate weaknesses in legacy systems in a form that non-technical decision-makers can immediately understand.

2. Cybersecurity and physical-security training

The device is useful for training because it makes otherwise abstract threats visible.

An officer can see how an insecure radio remote may be recorded, how a weak RFID badge can be represented digitally or how a computer may trust a connected device claiming to be a keyboard. Such demonstrations can improve awareness among:

• Frontline officers
• Digital investigators
• Counterterrorism security advisers
• Crime-prevention teams
• Facilities managers
• Evidence-store personnel
• Corporate and critical-infrastructure liaison officers

The value lies less in teaching officers how to “hack” systems and more in showing how poor security assumptions can be exploited.

For example, the lesson from badge emulation is not that every access card can be cloned. It is that an organisation should not rely on an unencrypted identifier as its sole security control.

3. Reproducing reported electronic interference

A Flipper Zero can receive and transmit compatible signals used by certain gates, barriers, wireless switches, doorbells and other short-range devices. The manufacturer states that its built-in radio covers specific ranges between approximately 300 and 928 MHz, with separate supported bands rather than continuous broadband coverage. It can decode known protocols or save some signals in raw form.

In a controlled laboratory or authorised site inspection, investigators could use such capabilities to help determine whether:

• A reported gate-opening incident involved a replayable static remote
• An unauthorised transmission can trigger a wireless doorbell or alarm sensor
• A common consumer protocol actually caused an apparently sophisticated incident
• A suspect recording is compatible with the affected equipment

The Flipper should not be treated as a calibrated spectrum analyser, forensic RF recorder or general-purpose software-defined radio. It can nevertheless be useful for preliminary reproduction and demonstration.

4. Examining seized Flipper Zero devices

A seized Flipper may contain more evidential value than its physical appearance suggests.

The official qFlipper software can manage files on the device’s microSD card, back up and restore the device, view firmware information and upload or download stored files. Depending on how the device was used, stored material might include:

• NFC or RFID credential files
• Sub-GHz radio captures
• Infrared remote files
• BadUSB scripts
• Third-party applications
• Custom firmware
• Notes or filenames identifying locations and targets
• Files associated with external Wi-Fi or radio modules

The existence of a stored credential does not prove that it was obtained illegally or successfully used. Investigators should seek corroboration from access logs, CCTV, computers, phones, messages, purchase records and the affected system.

Digital evidence should be preserved through established forensic processes rather than casually explored on the device. NIST guidance emphasises structured forensic activity, appropriate handling of different data sources and consultation with legal and organisational authorities.

Turning on a seized device, selecting applications, or connecting it to ordinary police computers could alter data, trigger scripts, or create new metadata. Examination should therefore be conducted by competent personnel in accordance with the relevant digital-evidence procedures.

5. Investigating embedded and Internet of Things equipment

GPIO pins allow the Flipper Zero to communicate with compatible development boards and embedded electronics. In a laboratory, it may serve as a simple interface for hardware debugging or for communications over protocols such as UART, SPI or I²C.

This can support introductory examination of:

• Alarm components
• Access controllers
• IoT devices
• Electronic locks
• Recovered development boards
• Modified consumer electronics

However, the Flipper is not a replacement for a complete hardware-forensics bench. Serious embedded-device examination may require logic analysers, oscilloscopes, chip programmers, specialist probes and controlled extraction procedures.

How can it be misused?

1. Cloning weak access credentials

The most credible misuse involves older or poorly configured access systems.

Low-frequency RFID credentials may expose a simple identifier that can be read and emulated. Some NFC technologies also have known weaknesses, although NFC is not a single security standard: it includes everything from basic tags to encrypted smart cards with mutual authentication.

The Flipper Zero’s NFC module can read, store and emulate supported cards and interact with certain reader and card protocols. Its official documentation also describes functionality associated with analysing readers and recovering keys for some vulnerable MIFARE Classic deployments.

That does not mean it can clone every employee badge, police warrant card, bank card, passport or modern encrypted credential. The result depends on the card technology, cryptography, reader configuration and backend checks.

The law-enforcement concern should be weak access-control design, not the existence of one particular consumer tool.

2. Replaying static radio remotes

Some older gates, garage doors, barriers and wireless switches use fixed codes. A compatible transmission may be recorded and replayed later.

Systems using properly implemented rolling codes or bidirectional cryptographic authentication are substantially more resistant. A recording of one valid transmission should not simply remain valid forever.

Consequently, possession of a Flipper near a gate is not proof that the gate can be opened with it. Investigators need to identify the frequency, protocol, receiver and security mechanism that are actually involved.

3. BadUSB attacks

The Flipper can identify itself to a computer as a human-interface device, such as a keyboard. It can then execute a predefined sequence of keystrokes through USB or, after pairing, through Bluetooth.

Official documentation describes this BadUSB function as capable of performing actions available to someone with physical access, including changing settings, retrieving information or executing commands.

The most important limitation is access. The attacker generally needs:

• Physical access to an exposed USB port or
• The ability to persuade someone to connect the device or
• Bluetooth pairing and acceptance by the target

Endpoint controls, locked screens, device control policies, application restrictions, and staff awareness can substantially reduce the risk.

From an investigative perspective, stored scripts may help establish intent, but they should be analysed alongside evidence showing whether the device was connected to a target and what occurred afterwards.

4. Infrared disruption and nuisance activity

The infrared interface can learn and transmit commands used by televisions, projectors, audio systems and some climate-control equipment.

Misuse may include turning displays off, altering public information screens or interfering with equipment in waiting rooms, shops or hospitality premises. Such conduct can cause disruption, but it is usually equivalent to using a programmable universal remote.

The seriousness comes from the context. Turning off a television as a prank is different from deliberately interfering with a public display carrying safety information.

5. Bluetooth nuisance attacks

Modified firmware and third-party applications have been shown to broadcast large numbers of Bluetooth-related notifications or pairing prompts to nearby devices.

Such activity may distract users, interfere with normal device operation or disrupt some poorly designed peripherals. It should not be confused with silently taking complete control of every nearby phone.

Smartphones, laptops and inexpensive development boards can also produce the same general class of nuisance. Focusing exclusively on the Flipper risks overlooking more capable equipment.

6. Wi-Fi attacks using external hardware

A stock Flipper Zero does not contain a conventional Wi-Fi radio.

External modules, such as the official ESP32-S2-based Developer Board or third-party boards, provide Wi-Fi capability. The official board is designed for wireless debugging and firmware work and includes its own Wi-Fi-capable processor.

With modified software, an attached board may be used for Wi-Fi security testing or misuse. At that point, however, the operative radio and much of the functionality reside in the external board.

Investigators should document the complete configuration:

• The Flipper itself
• Attached GPIO modules
• External antennas
• Firmware versions
• Installed applications
• Computers and phones used to manage it
• Storage cards and associated files

Describing all such combinations simply as “a Flipper Zero attack” may conceal the equipment that provided the relevant capability.

Can it steal modern cars?

Claims about vehicle theft require particular caution.

The stock device can interact with some sub-GHz automotive signals and weaknesses may exist in older or poorly implemented remote systems. There have also been reports of privately distributed firmware that claims to exploit specific vehicle protocols.

However, the Flipper is not a universal keyless-entry relay, does not have every radio required for modern automotive attacks and cannot automatically defeat secure rolling-code or bidirectional authentication systems. Public claims that it can instantly unlock and start almost any modern vehicle are exaggerated.

Even reported techniques that unlock a door do not necessarily bypass the immobiliser or start the engine. Actual vehicle theft frequently involves other methods, including relay equipment, CAN-bus attacks, diagnostic tools, stolen keys, compromised accounts or exploitation of model-specific weaknesses. Recent reporting on alleged Flipper-enabled vehicle access has noted the lack of confirmed theft cases and the distinction between door access and engine theft.

Investigators should avoid attributing a theft to a Flipper solely because one was recovered. The technical mechanism should be established from vehicle logs, CCTV, recovered equipment and specialist examination.

What the Flipper Zero cannot do

A stock Flipper Zero is not:

• A broadband software-defined radio
• A native Wi-Fi hacking platform
• A mobile-phone interception system
• A universal bank-card cloner
• A device that defeats all encrypted access cards
• A universal car key
• A long-range radio jammer
• A substitute for a full digital-forensics workstation
• Proof, by itself, of criminal intent

Its sub-GHz component is a low-power CC1101 transceiver intended for particular short-range digital modulation schemes. Its official hardware operates only within defined sub-bands, with region-dependent transmission rules.

A laptop connected to a capable software-defined radio, specialised RFID equipment or purpose-built automotive theft tools may present a significantly broader technical capability while appearing less suspicious to an untrained observer.

Lawful authority is the dividing line.

The same action may be legitimate or criminal depending on authorisation.

Reading an organisation’s badge during an approved penetration test is different from copying an employee’s badge without permission. Testing a police gate in a controlled assessment is different from replaying its remote signal to gain entry to a restricted compound. Running a keyboard-injection demonstration on a laboratory computer is different from connecting the device to someone else’s workstation.

In the United Kingdom, unauthorised access to computer material, unauthorised acts intended to impair a computer and the supply or possession of articles connected with computer-misuse offences may fall within the scope of the Computer Misuse Act 1990, depending on the circumstances and intent. The Act focuses on authorisation and conduct rather than whether the equipment used looks specialised.

Security researchers and police personnel should therefore work under explicit, documented authority defining:

• The systems that may be tested
• The permitted techniques
• The testing period
• Data-handling requirements
• Safety restrictions
• Reporting and escalation procedures

How police should respond when one is found

A proportionate response begins with observation rather than assumption.

Officers should record the circumstances in which the device was found, including any connected modules, cables, antennas, cards or computers. The device’s display, physical state, and connections may be relevant, but indiscriminate button-pressing or experimentation can alter the evidence.

Questions for the investigation include:

• Where was it found?
• Was it powered on or connected to another device?
• What activity was occurring nearby?
• Are there reports of unauthorised entry or electronic interference?
• Is there evidence of consent or authorised security testing?
• What firmware and external modules are present?
• What files are stored on the device and microSD card?
• Do access-control, network or CCTV logs corroborate its use?
• Are relevant instructions, messages or target details present on associated phones or computers?

The Flipper should be treated as one possible component within a wider evidential picture.

Policy recommendations for law-enforcement organisations

Police services do not need to ban or fear the device. They need policies that recognise its actual capabilities.

Agencies should:

1. Include Flipper Zero awareness in cybercrime and digital-evidence training.
2. Audit legacy RFID, NFC and radio-based access systems.
3. Prohibit unapproved testing against operational police infrastructure.
4. Create procedures for handling seized multi-tool and development devices.
5. Document external modules and custom firmware rather than examining only the base unit.
6. Corroborate stored files with independent logs and physical evidence.
7. Avoid treating lawful possession as automatic evidence of criminality.
8. Use controlled demonstrations to explain physical-access and IoT risks to staff.
9. Direct technical examination to trained digital forensics or cybercrime personnel.
10. Focus remediation on vulnerable systems rather than on a single branded tool.

Conclusion

The Flipper Zero is neither harmless in every situation nor the cyber superweapon portrayed in sensational social media videos.

For law enforcement, it has three principal meanings.

First, it is a useful educational and authorised testing device that can expose weaknesses in access-control systems, consumer radio equipment and endpoint security.

Second, it can be misused against vulnerable systems, particularly where organisations rely on static radio codes, insecure RFID credentials, exposed USB ports or poorly protected electronic equipment.

Third, a seized Flipper may itself contain digital evidence—but its evidential value depends on proper preservation, expert examination and corroboration.

The central risk is not that the Flipper Zero created entirely new forms of crime. It is that it made several longstanding security weaknesses cheaper, more portable and easier to demonstrate.

A technically informed police response should therefore avoid both complacency and alarmism. Understand the interfaces, establish the suspect’s authority and intent, properly preserve the evidence, and investigate the system that was allegedly affected.

The vulnerable system—not the dolphin-shaped gadget—is usually the most important part of the story