release version 1.0.12

.idea/deploymentTargetSelector.xml

@@ -4,10 +4,10 @@
     <selectionStates>
       <SelectionState runConfigName="app">
         <option name="selectionMode" value="DROPDOWN" />
-        <DropdownSelection timestamp="2026-05-22T00:11:32.873305232Z">
+        <DropdownSelection timestamp="2026-05-28T18:41:19.777722821Z">
           <Target type="DEFAULT_BOOT">
             <handle>
-              <DeviceId pluginId="PhysicalDevice" identifier="serial=683a9830" />
+              <DeviceId pluginId="PhysicalDevice" identifier="serial=4254e2f" />
             </handle>
           </Target>
         </DropdownSelection>

README.md

@@ -14,8 +14,9 @@ A native Android client for Maldivian banking services. It is a pure client: req
 - Existing accounts with MIB, BML, or Fahipay
 - Your TOTP seed (base32 secret from your authenticator app setup) for each bank
 
-## Download
-[Download latest APK](https://git.shihaam.dev/shihaam/ISODroid/releases/latest)
+## Download APK
+[Gitea Releases](https://git.shihaam.dev/shihaam/thijooree/releases)
+[Telegram Channel](https://t.me/s/thijooreeapks)
 
 ## Privacy
 

app/build.gradle.kts

@@ -11,8 +11,8 @@ android {
         applicationId = "sh.sar.basedbank"
         minSdk = 26
         targetSdk = 36
-        versionCode = 9
-        versionName = "1.0.10"
+        versionCode = 11
+        versionName = "1.0.12"
 
         testInstrumentationRunner = "androidx.test.runner.AndroidJUnitRunner"
     }
@@ -91,6 +91,9 @@ dependencies {
     // Biometric authentication
     implementation("androidx.biometric:biometric:1.1.0")
 
+    // Encrypted SharedPreferences (HCE token store)
+    implementation("androidx.security:security-crypto:1.1.0-alpha06")
+
     testImplementation(libs.junit)
     androidTestImplementation(libs.androidx.junit)
     androidTestImplementation(libs.androidx.espresso.core)

app/src/debug/res/xml/shortcuts.xml

@@ -0,0 +1,43 @@
+<?xml version="1.0" encoding="utf-8"?>
+<shortcuts xmlns:android="http://schemas.android.com/apk/res/android">
+
+    <shortcut
+        android:shortcutId="transfer"
+        android:enabled="true"
+        android:icon="@drawable/ic_shortcut_transfer"
+        android:shortcutShortLabel="@string/transfer"
+        android:shortcutLongLabel="@string/transfer">
+        <intent
+            android:action="sh.sar.basedbank.OPEN_TRANSFER"
+            android:targetPackage="sh.sar.basedbank.debug"
+            android:targetClass="sh.sar.basedbank.MainActivity" />
+        <categories android:name="android.shortcut.conversation" />
+    </shortcut>
+
+    <shortcut
+        android:shortcutId="scan_qr"
+        android:enabled="true"
+        android:icon="@drawable/ic_shortcut_scan_qr"
+        android:shortcutShortLabel="@string/transfer_scan_qr"
+        android:shortcutLongLabel="@string/transfer_scan_qr">
+        <intent
+            android:action="sh.sar.basedbank.OPEN_SCAN_QR"
+            android:targetPackage="sh.sar.basedbank.debug"
+            android:targetClass="sh.sar.basedbank.MainActivity" />
+        <categories android:name="android.shortcut.conversation" />
+    </shortcut>
+
+    <shortcut
+        android:shortcutId="tap_to_pay"
+        android:enabled="true"
+        android:icon="@drawable/ic_shortcut_pay_card"
+        android:shortcutShortLabel="@string/card_pay_nfc"
+        android:shortcutLongLabel="@string/card_pay_nfc">
+        <intent
+            android:action="sh.sar.basedbank.TAP_TO_PAY"
+            android:targetPackage="sh.sar.basedbank.debug"
+            android:targetClass="sh.sar.basedbank.MainActivity" />
+        <categories android:name="android.shortcut.conversation" />
+    </shortcut>
+
+</shortcuts>

app/src/main/AndroidManifest.xml

@@ -7,6 +7,9 @@
     <uses-permission android:name="android.permission.CAMERA" />
     <uses-permission android:name="android.permission.USE_BIOMETRIC" />
     <uses-permission android:name="android.permission.ACCESS_NETWORK_STATE" />
+    <uses-permission android:name="android.permission.NFC" />
+
+    <uses-feature android:name="android.hardware.nfc.hce" android:required="false" />
 
     <application
         android:name=".BasedBankApp"
@@ -59,6 +62,25 @@
             android:exported="false"
             android:screenOrientation="portrait" />
 
+        <activity
+            android:name=".nfc.BmlTapToPayActivity"
+            android:exported="false"
+            android:launchMode="singleTop"
+            android:theme="@style/Theme.BasedBank" />
+
+        <service
+            android:name=".nfc.BmlHostCardEmulatorService"
+            android:exported="true"
+            android:permission="android.permission.BIND_NFC_SERVICE">
+            <intent-filter>
+                <action android:name="android.nfc.cardemulation.action.HOST_APDU_SERVICE" />
+                <category android:name="android.intent.category.DEFAULT" />
+            </intent-filter>
+            <meta-data
+                android:name="android.nfc.cardemulation.host_apdu_service"
+                android:resource="@xml/bml_aid_list" />
+        </service>
+
         <provider
             android:name="androidx.core.content.FileProvider"
             android:authorities="${applicationId}.fileprovider"

app/src/main/java/sh/sar/basedbank/LockActivity.kt

@@ -278,9 +278,11 @@ class LockActivity : AppCompatActivity() {
             }
             val navDest = intent.getIntExtra("nav_destination", -1)
             val autoScan = intent.getBooleanExtra("auto_scan", false)
+            val autoTapMode = intent.getBooleanExtra("auto_tap_mode", false)
             startActivity(Intent(this, HomeActivity::class.java).apply {
                 if (navDest != -1) putExtra("nav_destination", navDest)
                 if (autoScan) putExtra("auto_scan", true)
+                if (autoTapMode) putExtra("auto_tap_mode", true)
             })
             finish()
         }

app/src/main/java/sh/sar/basedbank/MainActivity.kt

@@ -25,9 +25,11 @@ class MainActivity : AppCompatActivity() {
             "sh.sar.basedbank.OPEN_TRANSFER"      -> R.id.nav_transfer
             "sh.sar.basedbank.OPEN_SCAN_QR"       -> R.id.nav_transfer
             "sh.sar.basedbank.OPEN_PAY_WITH_CARD" -> R.id.nav_pay_with_card
+            "sh.sar.basedbank.TAP_TO_PAY"         -> R.id.nav_pay_with_card
             else -> -1
         }
         val autoScan = intent?.action == "sh.sar.basedbank.OPEN_SCAN_QR"
+        val autoTapMode = intent?.action == "sh.sar.basedbank.TAP_TO_PAY"
 
         val target = when {
             !onboardingDone -> OnboardingActivity::class.java
@@ -43,6 +45,7 @@ class MainActivity : AppCompatActivity() {
         startActivity(Intent(this, target).apply {
             if (navDestination != -1) putExtra("nav_destination", navDestination)
             if (autoScan) putExtra("auto_scan", true)
+            if (autoTapMode) putExtra("auto_tap_mode", true)
         })
         finish()
     }

app/src/main/java/sh/sar/basedbank/api/bml/BmlModels.kt

@@ -82,6 +82,15 @@ data class BmlQrPayResult(
     val errorMessage: String = ""
 )
 
+data class BmlWalletToken(
+    val token: String,
+    val expiry: String,
+    val appCode: String,      // AID hex, e.g. "A0000000031010"
+    val serviceCode: String,
+    val data: String,
+    val validUntil: String    // "YYYY-MM-DD HH:mm:ss.SSS"
+)
+
 data class BmlForeignLimit(
     val type: String,
     val used: Double,

app/src/main/java/sh/sar/basedbank/api/bml/BmlTapToPayClient.kt

@@ -0,0 +1,79 @@
+package sh.sar.basedbank.api.bml
+
+import okhttp3.MediaType.Companion.toMediaType
+import okhttp3.RequestBody.Companion.toRequestBody
+import org.json.JSONArray
+import org.json.JSONObject
+
+class BmlTapToPayClient {
+
+    private val client = newBmlApiClient()
+
+    /**
+     * Fetches up to [quantity] single-use payment tokens for [cardId].
+     * [otp] is a TOTP code generated from the stored BML OTP seed.
+     *
+     * Flow:
+     *   1. POST → code 99 (OTP required) or 0 (direct, unlikely)
+     *   2. POST with channel=token → code 22 (OTP generated on BML side, but we use TOTP)
+     *   3. POST with otp=TOTP → code 0, payload = token list
+     */
+    fun fetchTokens(
+        session: BmlSession,
+        cardId: String,
+        otp: String,
+        quantity: Int = 3
+    ): List<BmlWalletToken> {
+        val url = "$BML_BASE_URL/api/mobile/walletpayments/gettoken"
+
+        // Step 1: initiate
+        val base = JSONObject().apply {
+            put("type", "track2")
+            put("cardid", cardId)
+            put("quantity", quantity)
+        }
+        val step1 = post(session, url, base)
+        if (step1.optInt("code") == 0) return parseTokens(step1.optJSONArray("payload"))
+        if (step1.optInt("code") != 99) throw Exception(step1.optString("message", "Token request failed"))
+
+        // Step 2: request OTP channel (triggers BML to validate we can use TOTP)
+        val body2 = JSONObject(base.toString()).apply { put("channel", "token") }
+        val step2 = post(session, url, body2)
+        if (step2.optInt("code") != 22) throw Exception(step2.optString("message", "OTP channel request failed"))
+
+        // Step 3: submit TOTP
+        val body3 = JSONObject(body2.toString()).apply { put("otp", otp) }
+        val step3 = post(session, url, body3)
+        if (step3.optInt("code") != 0) throw Exception(step3.optString("message", "Token fetch failed"))
+
+        return parseTokens(step3.optJSONArray("payload"))
+    }
+
+    private fun post(session: BmlSession, url: String, body: JSONObject): JSONObject {
+        val req = okhttp3.Request.Builder()
+            .url(url)
+            .post(body.toString().toRequestBody("application/json".toMediaType()))
+            .header("Authorization", "Bearer ${session.accessToken}")
+            .header("User-Agent", BML_USER_AGENT)
+            .header("x-app-version", BML_APP_VERSION)
+            .build()
+        return client.newCall(req).execute().use { resp ->
+            JSONObject(resp.body?.string() ?: throw Exception("Empty response"))
+        }
+    }
+
+    private fun parseTokens(arr: JSONArray?): List<BmlWalletToken> {
+        arr ?: return emptyList()
+        return (0 until arr.length()).map { i ->
+            val o = arr.getJSONObject(i)
+            BmlWalletToken(
+                token       = o.getString("token"),
+                expiry      = o.getString("expiry"),
+                appCode     = o.getString("app_code"),
+                serviceCode = o.getString("service_code"),
+                data        = o.optString("data", ""),
+                validUntil  = o.optString("valid_until", "")
+            )
+        }
+    }
+}

app/src/main/java/sh/sar/basedbank/nfc/BmlHostCardEmulatorService.kt

@@ -0,0 +1,185 @@
+package sh.sar.basedbank.nfc
+
+import android.content.Intent
+import android.nfc.cardemulation.HostApduService
+import android.os.Bundle
+import android.util.Log
+import sh.sar.basedbank.api.bml.BmlWalletToken
+
+/**
+ * HCE service that emulates a BML contactless payment card.
+ *
+ * Implements the minimal EMV mag-stripe contactless flow:
+ *   SELECT PPSE → SELECT AID → GET PROCESSING OPTIONS → READ RECORD
+ *
+ * Each BmlWalletToken is single-use and is set via [setToken] before tapping.
+ * After READ RECORD is sent the [onTransactionComplete] callback fires.
+ */
+class BmlHostCardEmulatorService : HostApduService() {
+
+    private var gpoSent = false
+
+    override fun processCommandApdu(commandApdu: ByteArray?, extras: Bundle?): ByteArray {
+        if (commandApdu == null) return SW_UNKNOWN_ERROR
+        val apdu = Apdu(commandApdu)
+        if (apdu.isError) return apdu.errorResponse()
+
+        return when (apdu.ins) {
+            INS_SELECT -> handleSelect(apdu)
+            INS_GPO    -> handleGpo()
+            INS_READ   -> handleReadRecord()
+            else       -> SW_UNKNOWN_ERROR
+        }
+    }
+
+    override fun onDeactivated(reason: Int) {
+        if (!gpoSent) onTransactionComplete?.invoke(false)
+        gpoSent = false
+    }
+
+    // ── APDU handlers ──────────────────────────────────────────────────────────
+
+    private fun handleSelect(apdu: Apdu): ByteArray {
+        val data = apdu.data ?: return SW_UNKNOWN_ERROR
+
+        if (data.contentEquals(PPSE_BYTES)) {
+            val token = activeToken ?: run { launchPromptActivity(); return SW_UNKNOWN_ERROR }
+            return hexToBytes(buildSelectPpseResponse(token.appCode, applicationLabel(token.appCode), "01"))
+        }
+
+        val token = activeToken ?: return SW_UNKNOWN_ERROR
+        return if (data.contentEquals(hexToBytes(token.appCode))) {
+            hexToBytes(buildSelectAidResponse(token.appCode, applicationLabel(token.appCode)))
+        } else {
+            SW_UNKNOWN_ERROR
+        }
+    }
+
+    private fun launchPromptActivity() {
+        val intent = Intent("sh.sar.basedbank.TAP_TO_PAY").apply {
+            setPackage(applicationContext.packageName)
+            flags = Intent.FLAG_ACTIVITY_NEW_TASK
+        }
+        startActivity(intent)
+    }
+
+    private fun handleGpo(): ByteArray {
+        gpoSent = true
+        // AIP=0080 (mag-stripe mode), AFL=08010100 (SFI=1, record 1-1, offline 0)
+        val miscData = "008008010100"
+        val body = tlv("80", miscData)
+        return hexToBytes(body + SW_OK_HEX)
+    }
+
+    private fun handleReadRecord(): ByteArray {
+        val token = activeToken ?: return SW_UNKNOWN_ERROR
+        val track2 = buildTrack2(token)
+        val body = tlv("70", tlv("57", track2))
+        val response = hexToBytes(body + SW_OK_HEX)
+        onTransactionComplete?.invoke(true)
+        return response
+    }
+
+    // ── TLV / APDU response builders ───────────────────────────────────────────
+
+    private fun buildSelectPpseResponse(aid: String, label: String, priority: String): String {
+        val priorityTlv  = tlv("87", priority)                  // tag 87
+        val aidTlv       = tlv("4F", aid)                       // tag 4F  (ADF Name)
+        val appEntry     = tlv("61", aidTlv + priorityTlv)       // tag 61
+        val ppseTlv      = tlv("84", PPSE_HEX)                  // tag 84  (DF Name)
+        val inner        = tlv("BF0C", appEntry)                 // tag BF0C
+        val propTemplate = tlv("A5", inner)                      // tag A5
+        val fci          = tlv("6F", ppseTlv + propTemplate)     // tag 6F
+        return fci + SW_OK_HEX
+    }
+
+    private fun buildSelectAidResponse(aid: String, label: String): String {
+        val aidTlv      = tlv("84", aid)                                        // tag 84
+        val labelTlv    = tlv("50", asciiToHex(label))                          // tag 50
+        val pdolTlv     = tlv("9F38", "9F6602")                                 // PDOL: TTQ 2 bytes
+        val propTemplate = tlv("A5", labelTlv + pdolTlv)                         // tag A5
+        val fci         = tlv("6F", aidTlv + propTemplate)                      // tag 6F
+        return fci + SW_OK_HEX
+    }
+
+    private fun buildTrack2(token: BmlWalletToken): String {
+        var t2 = "${token.token}D${token.expiry}${token.serviceCode}${token.data}"
+        if (t2.length % 2 != 0) t2 += "F"
+        return t2
+    }
+
+    // ── Helpers ─────────────────────────────────────────────────────────────────
+
+    /** Build BER-TLV: tag (hex string, 1 or 2 bytes) + DER length + data (hex string). */
+    private fun tlv(tagHex: String, dataHex: String): String {
+        val lenBytes = dataHex.length / 2
+        val lenHex = when {
+            lenBytes <= 0x7F -> lenBytes.toHexByte()
+            lenBytes <= 0xFF -> "81" + lenBytes.toHexByte()
+            else             -> "82" + (lenBytes shr 8).toHexByte() + (lenBytes and 0xFF).toHexByte()
+        }
+        return tagHex + lenHex + dataHex
+    }
+
+    private fun Int.toHexByte(): String = toString(16).padStart(2, '0').uppercase()
+
+    private fun asciiToHex(s: String): String =
+        s.toByteArray(Charsets.US_ASCII).joinToString("") { "%02X".format(it) }
+
+    private fun hexToBytes(hex: String): ByteArray {
+        val s = hex.uppercase()
+        return ByteArray(s.length / 2) { i ->
+            s.substring(i * 2, i * 2 + 2).toInt(16).toByte()
+        }
+    }
+
+    // ── APDU parser ─────────────────────────────────────────────────────────────
+
+    private inner class Apdu(raw: ByteArray) {
+        val isError: Boolean
+        val ins: Int
+        val data: ByteArray?
+
+        init {
+            if (raw.size < 4) {
+                isError = true; ins = -1; data = null
+            } else {
+                isError = false
+                ins = raw[1].toInt() and 0xFF
+                val lc = if (raw.size > 4) raw[4].toInt() and 0xFF else 0
+                data = if (lc > 0 && raw.size >= 5 + lc) raw.copyOfRange(5, 5 + lc) else null
+            }
+        }
+
+        fun errorResponse() = SW_UNKNOWN_ERROR
+    }
+
+    companion object {
+        private const val TAG = "BmlHCE"
+
+        private const val INS_SELECT = 0xA4
+        private const val INS_GPO    = 0xA8
+        private const val INS_READ   = 0xB2
+
+        private val PPSE_HEX   = "325041592E5359532E4444463031"   // "2PAY.SYS.DDF01"
+        private val PPSE_BYTES = byteArrayOf(
+            0x32,0x50,0x41,0x59,0x2E,0x53,0x59,0x53,0x2E,0x44,0x44,0x46,0x30,0x31
+        )
+
+        private const val SW_OK_HEX      = "9000"
+        private val SW_UNKNOWN_ERROR     = byteArrayOf(0x6F.toByte(), 0x00.toByte())
+
+        @Volatile var activeToken: BmlWalletToken? = null
+        @Volatile var onTransactionComplete: ((success: Boolean) -> Unit)? = null
+
+        fun setToken(token: BmlWalletToken) { activeToken = token }
+        fun clearToken() { activeToken = null }
+
+        fun applicationLabel(aidHex: String): String = when {
+            aidHex.startsWith("A0000000031010", ignoreCase = true) -> "VISA"
+            aidHex.startsWith("A0000000041010", ignoreCase = true) -> "MASTERCARD"
+            aidHex.startsWith("A000000025",     ignoreCase = true) -> "AMEX"
+            else -> "BML"
+        }
+    }
+}

app/src/main/java/sh/sar/basedbank/nfc/BmlTapToPayActivity.kt

@@ -0,0 +1,20 @@
+package sh.sar.basedbank.nfc
+
+import android.content.Intent
+import android.os.Bundle
+import androidx.appcompat.app.AppCompatActivity
+import sh.sar.basedbank.MainActivity
+
+/**
+ * Fallback entry point — redirects to MainActivity which routes to the in-app tap-to-pay screen.
+ */
+class BmlTapToPayActivity : AppCompatActivity() {
+    override fun onCreate(savedInstanceState: Bundle?) {
+        super.onCreate(savedInstanceState)
+        startActivity(Intent(this, MainActivity::class.java).apply {
+            action = "sh.sar.basedbank.TAP_TO_PAY"
+            flags = Intent.FLAG_ACTIVITY_NEW_TASK or Intent.FLAG_ACTIVITY_CLEAR_TASK
+        })
+        finish()
+    }
+}

app/src/main/java/sh/sar/basedbank/ui/home/DashboardFragment.kt

@@ -25,6 +25,7 @@ import sh.sar.basedbank.api.models.BankAccount
 import sh.sar.basedbank.api.mib.MibCard
 import sh.sar.basedbank.api.mib.MibFinanceDeal
 import sh.sar.basedbank.util.bmlapi.BmlCardParser
+import sh.sar.basedbank.util.PaymvQrParser
 import sh.sar.basedbank.util.CredentialStore
 import kotlin.math.abs
 import sh.sar.basedbank.databinding.FragmentDashboardBinding
@@ -41,10 +42,10 @@ class DashboardFragment : Fragment() {
     private val qrLauncher = registerForActivityResult(ActivityResultContracts.StartActivityForResult()) { result ->
         if (result.resultCode != Activity.RESULT_OK) return@registerForActivityResult
         val raw = result.data?.getStringExtra(QrScannerActivity.EXTRA_QR_CONTENT) ?: return@registerForActivityResult
-        if (raw.startsWith("https://ebanking.bankofmaldives.com.mv/qrpay/") ||
-            raw.startsWith("https://pay.bml.com.mv/app/")) {
+        val bmlUrl = PaymvQrParser.extractBmlGatewayUrl(raw)
+        if (raw.startsWith("https://ebanking.bankofmaldives.com.mv/qrpay/") || bmlUrl != null) {
             (requireActivity() as HomeActivity).navigateTo(
-                R.id.nav_transfer, TransferFragment.newInstanceFromBmlQr(raw, pendingQrAccountNumber)
+                R.id.nav_transfer, TransferFragment.newInstanceFromBmlQr(bmlUrl ?: raw, pendingQrAccountNumber)
             )
         } else {
             Toast.makeText(requireContext(), R.string.transfer_qr_invalid, Toast.LENGTH_SHORT).show()
@@ -97,12 +98,16 @@ class DashboardFragment : Fragment() {
         LinearSnapHelper().attachToRecyclerView(binding.rvCards)
 
         val updateCardList = {
-            val mibItems = (viewModel.mibCards.value ?: emptyList()).map { CardItem.Mib(it) }
+            val credStore = CredentialStore(requireContext())
+            val hidden = credStore.getHiddenDashboardCardNumbers()
+            val mibItems = (viewModel.mibCards.value ?: emptyList())
+                .filter { !hidden.contains(it.maskedCardNumber) }
+                .map { CardItem.Mib(it) }
             val bmlItems = (viewModel.accounts.value ?: emptyList())
-                .filter { (it.profileType == "BML_PREPAID" || it.profileType == "BML_CREDIT" || it.profileType == "BML_DEBIT") && it.statusDesc.equals("Active", ignoreCase = true) }
+                .filter { (it.profileType == "BML_PREPAID" || it.profileType == "BML_CREDIT" || it.profileType == "BML_DEBIT") && it.statusDesc.equals("Active", ignoreCase = true) && !hidden.contains(it.accountNumber) }
                 .map { CardItem.Bml(it) }
             val all = mibItems + bmlItems
-            val defaultNum = CredentialStore(requireContext()).getDefaultCardAccountNumber()
+            val defaultNum = credStore.getDefaultCardAccountNumber()
             val ordered = if (defaultNum != null) {
                 val def = all.filterIsInstance<CardItem.Bml>().firstOrNull { it.account.accountNumber == defaultNum }
                 if (def != null) listOf(def) + all.filter { it !== def } else all
@@ -385,8 +390,15 @@ class DashboardFragment : Fragment() {
                 val nfcSupported = nfcAdapter != null
                 btnPayNfc.isEnabled = nfcSupported
                 btnPayNfc.setOnClickListener {
-                    val msg = if (isMib) R.string.mib_qr_nfc_not_supported else R.string.work_in_progress
-                    Toast.makeText(requireContext(), msg, Toast.LENGTH_SHORT).show()
+                    if (isMib) {
+                        Toast.makeText(requireContext(), R.string.mib_qr_nfc_not_supported, Toast.LENGTH_SHORT).show()
+                    } else {
+                        val accountNumber = (item as CardItem.Bml).account.accountNumber
+                        (requireActivity() as HomeActivity).navigateTo(
+                            R.id.nav_pay_with_card,
+                            CardsFragment.newInstanceWithAutoTapMode(accountNumber)
+                        )
+                    }
                 }
             }
         }

app/src/main/java/sh/sar/basedbank/ui/home/HomeActivity.kt

@@ -237,10 +237,13 @@ class HomeActivity : AppCompatActivity() {
         if (savedInstanceState == null) {
             val navDest = intent.getIntExtra("nav_destination", -1)
             val autoScan = intent.getBooleanExtra("auto_scan", false)
+            val autoTapMode = intent.getBooleanExtra("auto_tap_mode", false)
             if (navDest != -1) {
-                val fragment = if (autoScan && navDest == R.id.nav_transfer)
-                    TransferFragment.newInstanceWithAutoScan()
-                else null
+                val fragment = when {
+                    autoScan && navDest == R.id.nav_transfer -> TransferFragment.newInstanceWithAutoScan()
+                    autoTapMode && navDest == R.id.nav_pay_with_card -> CardsFragment.newInstanceWithAutoTapMode()
+                    else -> null
+                }
                 navigateTo(navDest, fragment)
             } else {
                 show(DashboardFragment())

app/src/main/java/sh/sar/basedbank/ui/home/PayMvQrFragment.kt

@@ -61,9 +61,9 @@ class PayMvQrFragment : Fragment() {
         val raw = result.data?.getStringExtra(QrScannerActivity.EXTRA_QR_CONTENT) ?: return@registerForActivityResult
 
         // BML card/gateway QR — hand off to dedicated payment screen
-        if (raw.startsWith("https://ebanking.bankofmaldives.com.mv/qrpay/") ||
-            raw.startsWith("https://pay.bml.com.mv/app/")) {
-            (requireActivity() as HomeActivity).navigateTo(R.id.nav_transfer, TransferFragment.newInstanceFromBmlQr(raw))
+        val bmlUrl = PaymvQrParser.extractBmlGatewayUrl(raw)
+        if (raw.startsWith("https://ebanking.bankofmaldives.com.mv/qrpay/") || bmlUrl != null) {
+            (requireActivity() as HomeActivity).navigateTo(R.id.nav_transfer, TransferFragment.newInstanceFromBmlQr(bmlUrl ?: raw))
             return@registerForActivityResult
         }
 

app/src/main/java/sh/sar/basedbank/ui/home/PayWithCardFragment.kt

@@ -24,13 +24,31 @@ import androidx.fragment.app.activityViewModels
 import androidx.recyclerview.widget.LinearLayoutManager
 import androidx.recyclerview.widget.PagerSnapHelper
 import androidx.recyclerview.widget.RecyclerView
+import android.animation.ValueAnimator
+import android.graphics.Canvas
+import android.graphics.Paint
+import android.graphics.RectF
+import android.view.Gravity
+import androidx.biometric.BiometricManager
+import androidx.biometric.BiometricPrompt
+import androidx.core.content.ContextCompat
+import androidx.lifecycle.lifecycleScope
+import com.google.android.material.button.MaterialButton
 import com.google.android.material.color.MaterialColors
+import kotlinx.coroutines.Dispatchers
+import kotlinx.coroutines.launch
+import kotlinx.coroutines.withContext
+import sh.sar.basedbank.BasedBankApp
 import sh.sar.basedbank.R
+import sh.sar.basedbank.api.bml.BmlTapToPayClient
+import sh.sar.basedbank.nfc.BmlHostCardEmulatorService
 import sh.sar.basedbank.api.mib.MibCard
 import sh.sar.basedbank.databinding.FragmentCardsBinding
 import sh.sar.basedbank.util.CardsCache
 import sh.sar.basedbank.util.CredentialStore
+import sh.sar.basedbank.util.Totp
 import sh.sar.basedbank.util.bmlapi.BmlCardParser
+import sh.sar.basedbank.util.PaymvQrParser
 import kotlin.math.abs
 
 class CardsFragment : Fragment() {
@@ -44,6 +62,9 @@ class CardsFragment : Fragment() {
     private var cardWidth: Int = 0
     private var pendingQrAccountNumber: String? = null
     private var isManageMode: Boolean = false
+    private var isTapMode: Boolean = false
+    private var tapAnimView: NfcTapAnimationView? = null
+    private var autoTapModeTriggered = false
 
     // Carousel snapshot captured on enter, used to reverse the exit animation
     private var carouselCardLayoutTop = 0f      // card layout top relative to contentLayout
@@ -60,10 +81,10 @@ class CardsFragment : Fragment() {
     private val qrLauncher = registerForActivityResult(ActivityResultContracts.StartActivityForResult()) { result ->
         if (result.resultCode != Activity.RESULT_OK) return@registerForActivityResult
         val raw = result.data?.getStringExtra(QrScannerActivity.EXTRA_QR_CONTENT) ?: return@registerForActivityResult
-        if (raw.startsWith("https://ebanking.bankofmaldives.com.mv/qrpay/") ||
-            raw.startsWith("https://pay.bml.com.mv/app/")) {
+        val bmlUrl = PaymvQrParser.extractBmlGatewayUrl(raw)
+        if (raw.startsWith("https://ebanking.bankofmaldives.com.mv/qrpay/") || bmlUrl != null) {
             (requireActivity() as HomeActivity).navigateTo(
-                R.id.nav_transfer, TransferFragment.newInstanceFromBmlQr(raw, pendingQrAccountNumber)
+                R.id.nav_transfer, TransferFragment.newInstanceFromBmlQr(bmlUrl ?: raw, pendingQrAccountNumber)
             )
         } else {
             Toast.makeText(requireContext(), R.string.transfer_qr_invalid, Toast.LENGTH_SHORT).show()
@@ -135,7 +156,7 @@ ViewCompat.setOnApplyWindowInsetsListener(binding.contentLayout) { v, insets ->
 
         // Swipe-down on the manage card to dismiss manage mode
         binding.manageCardView.root.setOnTouchListener { _, event ->
-            if (!isManageMode) return@setOnTouchListener false
+            if (!isManageMode && !isTapMode) return@setOnTouchListener false
             val mgr = binding.manageCardView.root
             when (event.action) {
                 android.view.MotionEvent.ACTION_DOWN -> {
@@ -162,7 +183,7 @@ ViewCompat.setOnApplyWindowInsetsListener(binding.contentLayout) { v, insets ->
                         val dy = (event.rawY - swipeDragStartRawY).coerceAtLeast(0f)
                         swipeIsDragging = false
                         if (dy > 130f) {
-                            setManageMode(false)
+                            if (isTapMode) setTapMode(false) else setManageMode(false)
                         } else {
                             // Snap back
                             mgr.animate().translationY(0f).scaleX(1f).scaleY(1f)
@@ -191,8 +212,17 @@ ViewCompat.setOnApplyWindowInsetsListener(binding.contentLayout) { v, insets ->
         binding.btnTapToPay.isEnabled = nfcAvailable
         binding.btnTapToPay.setOnClickListener {
             val item = cards.getOrNull(currentCardPosition) ?: return@setOnClickListener
-            val msg = if (item is CardItem.Mib) R.string.mib_qr_nfc_not_supported else R.string.work_in_progress
-            Toast.makeText(requireContext(), msg, Toast.LENGTH_SHORT).show()
+            if (item is CardItem.Mib) {
+                Toast.makeText(requireContext(), R.string.mib_qr_nfc_not_supported, Toast.LENGTH_SHORT).show()
+                return@setOnClickListener
+            }
+            val bmlItem = item as CardItem.Bml
+            val prefs = requireContext().getSharedPreferences("prefs", Context.MODE_PRIVATE)
+            if (prefs.getBoolean("biometrics_transfer_confirm", false)) {
+                showBiometricPromptForTap(bmlItem)
+            } else {
+                setTapMode(true, bmlItem)
+            }
         }
 
         val wip = View.OnClickListener {
@@ -253,6 +283,7 @@ ViewCompat.setOnApplyWindowInsetsListener(binding.contentLayout) { v, insets ->
         binding.llPayButtons.visibility = View.GONE
         binding.llManageButtons.visibility = View.VISIBLE
         binding.llDefaultCardRow.visibility = View.VISIBLE
+        binding.llHideDashboardRow.visibility = View.VISIBLE
         binding.manageCardView.root.visibility = View.VISIBLE
 
         // Set switch state (clear listener first to avoid triggering on programmatic set)
@@ -273,6 +304,17 @@ ViewCompat.setOnApplyWindowInsetsListener(binding.contentLayout) { v, insets ->
             }
         }
 
+        val accountNumber = (item as? CardItem.Bml)?.account?.accountNumber
+            ?: (item as? CardItem.Mib)?.card?.maskedCardNumber
+        binding.switchHideFromDashboard.setOnCheckedChangeListener(null)
+        binding.switchHideFromDashboard.isChecked = accountNumber != null &&
+            store.getHiddenDashboardCardNumbers().contains(accountNumber)
+        binding.switchHideFromDashboard.setOnCheckedChangeListener { _, isChecked ->
+            if (accountNumber != null) {
+                store.setCardHiddenFromDashboard(accountNumber, isChecked)
+            }
+        }
+
         // After layout pass, compute offsets, save carousel snapshot, and animate
         binding.contentLayout.doOnNextLayout {
             val mgr = binding.manageCardView.root
@@ -364,7 +406,9 @@ ViewCompat.setOnApplyWindowInsetsListener(binding.contentLayout) { v, insets ->
                 binding.llPayButtons.visibility = View.VISIBLE
                 binding.llManageButtons.visibility = View.GONE
                 binding.llDefaultCardRow.visibility = View.GONE
+                binding.llHideDashboardRow.visibility = View.GONE
                 binding.switchDefaultCard.setOnCheckedChangeListener(null)
+                binding.switchHideFromDashboard.setOnCheckedChangeListener(null)
                 buildDots(cards.size, currentCardPosition)
             }
             .start()
@@ -377,6 +421,234 @@ ViewCompat.setOnApplyWindowInsetsListener(binding.contentLayout) { v, insets ->
             .start()
     }
 
+    // ── Tap-to-pay mode ────────────────────────────────────────────────────────
+
+    private fun setTapMode(enabled: Boolean, item: CardItem.Bml? = null) {
+        isTapMode = enabled
+        requireActivity().title = getString(if (enabled) R.string.card_pay_nfc else R.string.nav_pay_with_card)
+        if (enabled) enterTapMode(item!!) else exitTapMode()
+    }
+
+    private fun showBiometricPromptForTap(item: CardItem.Bml) {
+        val bmgr = BiometricManager.from(requireContext())
+        if (bmgr.canAuthenticate(BiometricManager.Authenticators.BIOMETRIC_STRONG) != BiometricManager.BIOMETRIC_SUCCESS) {
+            setTapMode(true, item)
+            return
+        }
+        val prompt = BiometricPrompt(this, ContextCompat.getMainExecutor(requireContext()),
+            object : BiometricPrompt.AuthenticationCallback() {
+                override fun onAuthenticationSucceeded(result: BiometricPrompt.AuthenticationResult) {
+                    setTapMode(true, item)
+                }
+                override fun onAuthenticationError(errorCode: Int, errString: CharSequence) { }
+            })
+        prompt.authenticate(
+            BiometricPrompt.PromptInfo.Builder()
+                .setTitle(getString(R.string.card_pay_nfc))
+                .setSubtitle(item.account.accountBriefName)
+                .setNegativeButtonText(getString(R.string.cancel))
+                .build()
+        )
+    }
+
+    private fun enterTapMode(item: CardItem.Bml) {
+        // Bind card data to the shared manage card view
+        val cv = binding.manageCardView
+        cv.tvCardOwner.text = item.account.accountBriefName
+        cv.tvCardNumber.text = formatMasked(item.account.accountNumber)
+        loadCardImage(cv.ivCardImage, BmlCardParser.cardImageAsset(item.account))
+        val isActive = item.account.statusDesc.equals("Active", ignoreCase = true)
+        bindCardStatus(cv.tvCardStatus, item.account.statusDesc.takeUnless { isActive })
+        cv.root.alpha = if (isActive) 1f else 0.45f
+
+        // Snapshot carousel card position before layout changes (for animation)
+        val contentLoc = IntArray(2).also { binding.contentLayout.getLocationOnScreen(it) }
+        val lm = binding.rvCards.layoutManager as? LinearLayoutManager
+        val srcView = lm?.findViewByPosition(currentCardPosition)
+        val srcLoc = IntArray(2).also {
+            srcView?.getLocationOnScreen(it) ?: run { it[0] = contentLoc[0]; it[1] = contentLoc[1] }
+        }
+        val srcScreenTop = (srcLoc[1] - contentLoc[1]).toFloat()
+        val srcCenterX = (srcLoc[0] - contentLoc[0]).toFloat() + cardWidth / 2f
+        val textLoc = IntArray(2).also { binding.tvSelectedCardType.getLocationOnScreen(it) }
+        val textSrcScreenTop = (textLoc[1] - contentLoc[1]).toFloat()
+
+        carouselCardLayoutTop = srcScreenTop
+        carouselCardCenterX = srcCenterX
+        carouselTextLayoutTop = textSrcScreenTop
+
+        // Apply layout changes
+        binding.btnManageCard.visibility = View.GONE
+        binding.topSpacer.visibility = View.GONE
+        binding.rvCards.visibility = View.GONE
+        binding.pageIndicator.visibility = View.GONE
+        binding.divider.visibility = View.GONE
+        binding.llPayButtons.visibility = View.GONE
+        binding.llManageButtons.visibility = View.GONE
+        binding.llDefaultCardRow.visibility = View.GONE
+        binding.manageCardView.root.visibility = View.VISIBLE
+        binding.flTapMode.visibility = View.VISIBLE
+
+        // Build tap mode content: animation view + cancel button
+        binding.flTapMode.removeAllViews()
+        val animView = NfcTapAnimationView(requireContext())
+        tapAnimView = animView
+
+        val dp = resources.displayMetrics.density
+        val cancelBtn = MaterialButton(requireContext(), null,
+            com.google.android.material.R.attr.materialButtonOutlinedStyle
+        ).apply { setText(R.string.cancel); setOnClickListener { setTapMode(false) } }
+
+        val cancelWrapper = LinearLayout(requireContext()).apply {
+            orientation = LinearLayout.VERTICAL
+            gravity = Gravity.CENTER_HORIZONTAL
+            setPadding(0, 0, 0, (24 * dp).toInt())
+            addView(cancelBtn)
+        }
+        val container = LinearLayout(requireContext()).apply {
+            orientation = LinearLayout.VERTICAL
+            layoutParams = ViewGroup.LayoutParams(ViewGroup.LayoutParams.MATCH_PARENT, ViewGroup.LayoutParams.MATCH_PARENT)
+            addView(View(requireContext()).apply {  // spacer pushes content below card
+                layoutParams = LinearLayout.LayoutParams(LinearLayout.LayoutParams.MATCH_PARENT, 0, 1f)
+            })
+            addView(animView.apply {
+                layoutParams = LinearLayout.LayoutParams(LinearLayout.LayoutParams.MATCH_PARENT, 0, 3f)
+            })
+            addView(cancelWrapper.apply {
+                layoutParams = LinearLayout.LayoutParams(LinearLayout.LayoutParams.MATCH_PARENT, LinearLayout.LayoutParams.WRAP_CONTENT)
+            })
+        }
+        binding.flTapMode.addView(container)
+
+        // Animate card up from carousel position (same as manage mode)
+        binding.contentLayout.doOnNextLayout {
+            val mgr = binding.manageCardView.root
+            val dstLoc = IntArray(2).also { mgr.getLocationOnScreen(it) }
+            val dstTop = (dstLoc[1] - contentLoc[1]).toFloat()
+            val dstCenterX = (dstLoc[0] - contentLoc[0]).toFloat() + mgr.width / 2f
+
+            mgr.pivotX = mgr.width / 2f
+            mgr.pivotY = 0f
+            mgr.scaleX = if (mgr.width > 0) cardWidth.toFloat() / mgr.width.toFloat() else 1f
+            mgr.scaleY = mgr.scaleX
+            mgr.translationX = srcCenterX - dstCenterX
+            mgr.translationY = srcScreenTop - dstTop
+
+            mgr.animate()
+                .scaleX(1f).scaleY(1f)
+                .translationX(0f).translationY(0f)
+                .setDuration(380).setInterpolator(DecelerateInterpolator()).start()
+
+            val textDstLoc = IntArray(2).also { binding.tvSelectedCardType.getLocationOnScreen(it) }
+            binding.tvSelectedCardType.translationY = textSrcScreenTop - (textDstLoc[1] - contentLoc[1]).toFloat()
+            binding.tvSelectedCardType.animate()
+                .translationY(0f)
+                .setDuration(380).setInterpolator(DecelerateInterpolator()).start()
+        }
+
+        fetchAndArmToken(item)
+    }
+
+    private fun exitTapMode() {
+        tapAnimView?.stopAnimation()
+        tapAnimView = null
+        BmlHostCardEmulatorService.clearToken()
+        BmlHostCardEmulatorService.onTransactionComplete = null
+
+        binding.manageCardView.root.animate().cancel()
+        binding.tvSelectedCardType.animate().cancel()
+
+        val mgr = binding.manageCardView.root
+        val contentLoc = IntArray(2).also { binding.contentLayout.getLocationOnScreen(it) }
+        val mgrLoc = IntArray(2).also { mgr.getLocationOnScreen(it) }
+        val mgrLayoutTop = (mgrLoc[1] - contentLoc[1]).toFloat() - mgr.translationY
+        val mgrLayoutCenterX = (mgrLoc[0] - contentLoc[0]).toFloat() - mgr.translationX + mgr.width / 2f
+
+        val textLoc = IntArray(2).also { binding.tvSelectedCardType.getLocationOnScreen(it) }
+        val textLayoutTop = (textLoc[1] - contentLoc[1]).toFloat() - binding.tvSelectedCardType.translationY
+
+        mgr.pivotX = mgr.width / 2f
+        mgr.pivotY = 0f
+
+        mgr.animate()
+            .scaleX(if (mgr.width > 0) cardWidth.toFloat() / mgr.width.toFloat() else 1f)
+            .scaleY(if (mgr.width > 0) cardWidth.toFloat() / mgr.width.toFloat() else 1f)
+            .translationX(carouselCardCenterX - mgrLayoutCenterX)
+            .translationY(carouselCardLayoutTop - mgrLayoutTop)
+            .setDuration(320)
+            .setInterpolator(AccelerateInterpolator())
+            .withEndAction {
+                mgr.scaleX = 1f; mgr.scaleY = 1f
+                mgr.translationX = 0f; mgr.translationY = 0f
+                mgr.visibility = View.GONE
+                binding.tvSelectedCardType.translationY = 0f
+                binding.flTapMode.visibility = View.GONE
+                binding.flTapMode.removeAllViews()
+                binding.btnManageCard.visibility = View.VISIBLE
+                binding.topSpacer.visibility = View.VISIBLE
+                binding.rvCards.visibility = View.VISIBLE
+                binding.divider.visibility = View.VISIBLE
+                binding.llPayButtons.visibility = View.VISIBLE
+                buildDots(cards.size, currentCardPosition)
+            }
+            .start()
+
+        binding.tvSelectedCardType.animate()
+            .translationY(carouselTextLayoutTop - textLayoutTop)
+            .setDuration(320)
+            .setInterpolator(AccelerateInterpolator())
+            .withEndAction { binding.tvSelectedCardType.translationY = 0f }
+            .start()
+    }
+
+    private fun fetchAndArmToken(item: CardItem.Bml) {
+        val app = requireActivity().application as BasedBankApp
+
+        viewLifecycleOwner.lifecycleScope.launch {
+            val loginId = item.account.loginTag.removePrefix("bml_")
+            val session = app.bmlSessionFor(item.account)
+            val otpSeed = CredentialStore(requireContext()).loadBmlCredentials(loginId)?.otpSeed
+
+            if (session == null || otpSeed == null) {
+                if (isTapMode) {
+                    Toast.makeText(requireContext(),
+                        if (session == null) getString(R.string.transfer_session_unavailable)
+                        else "OTP unavailable",
+                        Toast.LENGTH_SHORT).show()
+                    setTapMode(false)
+                }
+                return@launch
+            }
+
+            val otp = Totp.generate(otpSeed)
+            val result = withContext(Dispatchers.IO) {
+                runCatching { BmlTapToPayClient().fetchTokens(session, item.account.internalId, otp) }
+            }
+            val token = result.getOrNull()?.firstOrNull()
+
+            if (!isTapMode) return@launch  // user cancelled while we were fetching
+
+            if (token == null) {
+                if (isTapMode) {
+                    Toast.makeText(requireContext(),
+                        result.exceptionOrNull()?.message ?: "Failed to get payment token",
+                        Toast.LENGTH_SHORT).show()
+                    setTapMode(false)
+                }
+                return@launch
+            }
+
+            BmlHostCardEmulatorService.setToken(token)
+            BmlHostCardEmulatorService.onTransactionComplete = { success ->
+                view?.post {
+                    if (!isTapMode) return@post
+                    setTapMode(false)
+                    if (success) Toast.makeText(requireContext(), "Payment complete", Toast.LENGTH_SHORT).show()
+                }
+            }
+        }
+    }
+
     private fun rebuildCards() {
         // Remember which card is currently selected by identity so we can restore position after reorder
         val currentCard = cards.getOrNull(currentCardPosition)
@@ -411,6 +683,30 @@ ViewCompat.setOnApplyWindowInsetsListener(binding.contentLayout) { v, insets ->
             buildDots(cards.size, currentCardPosition)
             updateCardInfo(currentCardPosition)
         }
+
+        // Auto-enter tap mode when launched from shortcut, NFC prompt, or dashboard
+        if (!autoTapModeTriggered && arguments?.getBoolean(ARG_AUTO_TAP_MODE) == true) {
+            val targetAccount = arguments?.getString(ARG_AUTO_TAP_ACCOUNT)
+            val targetCard = if (targetAccount != null)
+                cards.filterIsInstance<CardItem.Bml>().firstOrNull { it.account.accountNumber == targetAccount }
+            else
+                cards.filterIsInstance<CardItem.Bml>().firstOrNull()
+            if (targetCard != null) {
+                autoTapModeTriggered = true
+                // Scroll to the target card first
+                val pos = cards.indexOf(targetCard)
+                if (pos >= 0) {
+                    currentCardPosition = pos
+                    binding.rvCards.scrollToPosition(pos)
+                }
+                val prefs = requireContext().getSharedPreferences("prefs", Context.MODE_PRIVATE)
+                if (prefs.getBoolean("biometrics_transfer_confirm", false)) {
+                    showBiometricPromptForTap(targetCard)
+                } else {
+                    setTapMode(true, targetCard)
+                }
+            }
+        }
     }
 
     private fun applyCardScales() {
@@ -432,7 +728,7 @@ ViewCompat.setOnApplyWindowInsetsListener(binding.contentLayout) { v, insets ->
     }
 
     private fun buildDots(count: Int, selected: Int) {
-        if (isManageMode) return
+        if (isManageMode || isTapMode) return
         binding.pageIndicator.removeAllViews()
         if (count <= 1) {
             binding.pageIndicator.visibility = View.GONE
@@ -468,6 +764,10 @@ ViewCompat.setOnApplyWindowInsetsListener(binding.contentLayout) { v, insets ->
     }
 
     fun onBackPressed(): Boolean {
+        if (isTapMode) {
+            setTapMode(false)
+            return true
+        }
         if (isManageMode) {
             setManageMode(false)
             return true
@@ -475,12 +775,24 @@ ViewCompat.setOnApplyWindowInsetsListener(binding.contentLayout) { v, insets ->
         return false
     }
 
+    override fun onPause() {
+        super.onPause()
+        if (isTapMode) {
+            BmlHostCardEmulatorService.clearToken()
+            BmlHostCardEmulatorService.onTransactionComplete = null
+        }
+    }
+
     override fun onResume() {
         super.onResume()
         requireActivity().title = getString(R.string.nav_pay_with_card)
     }
 
     override fun onDestroyView() {
+        tapAnimView?.stopAnimation()
+        tapAnimView = null
+        BmlHostCardEmulatorService.clearToken()
+        BmlHostCardEmulatorService.onTransactionComplete = null
         super.onDestroyView()
         _binding = null
     }
@@ -542,7 +854,114 @@ ViewCompat.setOnApplyWindowInsetsListener(binding.contentLayout) { v, insets ->
         }
     }
 
+    // ── NFC animation view ─────────────────────────────────────────────────────
+
+    private inner class NfcTapAnimationView(context: Context) : View(context) {
+
+        private val paint = Paint(Paint.ANTI_ALIAS_FLAG)
+        private val animator = ValueAnimator.ofFloat(0f, 1f).apply {
+            duration = 1600
+            repeatCount = ValueAnimator.INFINITE
+            repeatMode = ValueAnimator.RESTART
+            addUpdateListener { invalidate() }
+            start()
+        }
+
+        fun stopAnimation() = animator.cancel()
+
+        override fun onDraw(canvas: Canvas) {
+            val w = width.toFloat(); val h = height.toFloat()
+            if (w <= 0f || h <= 0f) return
+
+            val dp = resources.displayMetrics.density
+            val progress = animator.animatedFraction
+            val cx = w / 2f; val cy = h / 2f - 20 * dp
+
+            val colorOnSurface = MaterialColors.getColor(this,
+                com.google.android.material.R.attr.colorOnSurface, android.graphics.Color.BLACK)
+            val colorPrimary = MaterialColors.getColor(this,
+                com.google.android.material.R.attr.colorPrimary, android.graphics.Color.BLUE)
+            val colorSurfaceVariant = MaterialColors.getColor(this,
+                com.google.android.material.R.attr.colorSurfaceVariant, android.graphics.Color.LTGRAY)
+
+            // Phone (left of center)
+            val phoneW = 36 * dp; val phoneH = 62 * dp
+            val phoneX = cx - 72 * dp - phoneW; val phoneY = cy - phoneH / 2f
+
+            // POS terminal (right of center)
+            val posW = 30 * dp; val posH = 50 * dp
+            val posX = cx + 72 * dp; val posY = cy - posH / 2f
+
+            // Phone body
+            paint.style = Paint.Style.FILL; paint.color = colorSurfaceVariant
+            canvas.drawRoundRect(phoneX, phoneY, phoneX + phoneW, phoneY + phoneH, 6 * dp, 6 * dp, paint)
+            paint.style = Paint.Style.STROKE; paint.strokeWidth = 2 * dp; paint.color = colorOnSurface
+            canvas.drawRoundRect(phoneX, phoneY, phoneX + phoneW, phoneY + phoneH, 6 * dp, 6 * dp, paint)
+
+            // Phone screen
+            paint.style = Paint.Style.FILL; paint.color = colorPrimary; paint.alpha = 70
+            canvas.drawRoundRect(phoneX + 3 * dp, phoneY + 8 * dp,
+                phoneX + phoneW - 3 * dp, phoneY + phoneH - 12 * dp, 3 * dp, 3 * dp, paint)
+            paint.alpha = 255
+
+            // Static NFC arcs on the right side of phone
+            paint.style = Paint.Style.STROKE; paint.strokeWidth = 2 * dp; paint.color = colorPrimary
+            val arcOriginX = phoneX + phoneW
+            for (i in 1..3) {
+                val r = i * 10 * dp
+                paint.alpha = 220 - i * 50
+                canvas.drawArc(RectF(arcOriginX - r, cy - r, arcOriginX + r, cy + r),
+                    -70f, 140f, false, paint)
+            }
+            paint.alpha = 255
+
+            // POS terminal body
+            paint.style = Paint.Style.FILL; paint.color = colorSurfaceVariant
+            canvas.drawRoundRect(posX, posY, posX + posW, posY + posH, 5 * dp, 5 * dp, paint)
+            paint.style = Paint.Style.STROKE; paint.strokeWidth = 2 * dp; paint.color = colorOnSurface
+            canvas.drawRoundRect(posX, posY, posX + posW, posY + posH, 5 * dp, 5 * dp, paint)
+
+            // POS screen
+            paint.style = Paint.Style.FILL; paint.color = colorPrimary; paint.alpha = 70
+            canvas.drawRoundRect(posX + 3 * dp, posY + 4 * dp,
+                posX + posW - 3 * dp, posY + posH * 0.45f, 3 * dp, 3 * dp, paint)
+            paint.alpha = 255
+
+            // POS card slot
+            paint.style = Paint.Style.STROKE; paint.strokeWidth = 1.5f * dp; paint.color = colorOnSurface
+            canvas.drawLine(posX + 4 * dp, posY + posH * 0.72f, posX + posW - 4 * dp, posY + posH * 0.72f, paint)
+
+            // Animated NFC rings travelling from phone toward POS
+            val gapStart = arcOriginX + 28 * dp
+            val gapEnd = posX - 4 * dp
+            val midX = (gapStart + gapEnd) / 2f
+            paint.style = Paint.Style.STROKE; paint.strokeWidth = 2.5f * dp
+            for (i in 0..2) {
+                val p = ((progress + i / 3f) % 1f)
+                val r = p * (gapEnd - gapStart) / 2f + 6 * dp
+                paint.color = colorPrimary; paint.alpha = ((1f - p) * 200).toInt().coerceIn(0, 255)
+                canvas.drawArc(RectF(midX - r, cy - r, midX + r, cy + r), -80f, 160f, false, paint)
+            }
+            paint.alpha = 255
+
+            // Label
+            paint.style = Paint.Style.FILL; paint.color = colorOnSurface; paint.alpha = 160
+            paint.textSize = 14 * dp; paint.textAlign = Paint.Align.CENTER
+            canvas.drawText(context.getString(R.string.card_pay_nfc), cx, cy + 60 * dp, paint)
+            paint.alpha = 255; paint.textAlign = Paint.Align.LEFT
+        }
+    }
+
     companion object {
+        private const val ARG_AUTO_TAP_MODE = "auto_tap_mode"
+        private const val ARG_AUTO_TAP_ACCOUNT = "auto_tap_account"
+        fun newInstanceWithAutoTapMode(accountNumber: String? = null) = CardsFragment().apply {
+            arguments = Bundle().apply {
+                putBoolean(ARG_AUTO_TAP_MODE, true)
+                if (accountNumber != null) putString(ARG_AUTO_TAP_ACCOUNT, accountNumber)
+            }
+        }
+
         fun cardImageAsset(card: MibCard): String? = when (card.cardType) {
             "51" -> "cards/mib/faisa_card.png"
             "53" -> "cards/mib/visa_black_platinum.png"

app/src/main/java/sh/sar/basedbank/ui/home/TransferFragment.kt

@@ -125,12 +125,12 @@ class TransferFragment : Fragment() {
         val raw = result.data?.getStringExtra(QrScannerActivity.EXTRA_QR_CONTENT) ?: return@registerForActivityResult
 
         // BML card/gateway QR — hand off to dedicated payment screen
-        if (raw.startsWith("https://ebanking.bankofmaldives.com.mv/qrpay/") ||
-            raw.startsWith("https://pay.bml.com.mv/app/")) {
+        val bmlUrl = PaymvQrParser.extractBmlGatewayUrl(raw)
+        if (raw.startsWith("https://ebanking.bankofmaldives.com.mv/qrpay/") || bmlUrl != null) {
             val fromCard = selectedAccount?.takeIf {
                 it.profileType == "BML_PREPAID" || it.profileType == "BML_CREDIT" || it.profileType == "BML_DEBIT"
             }
-            (requireActivity() as HomeActivity).navigateTo(R.id.nav_transfer, TransferFragment.newInstanceFromBmlQr(raw, fromCard?.accountNumber))
+            (requireActivity() as HomeActivity).navigateTo(R.id.nav_transfer, TransferFragment.newInstanceFromBmlQr(bmlUrl ?: raw, fromCard?.accountNumber))
             return@registerForActivityResult
         }
 

app/src/main/java/sh/sar/basedbank/util/CredentialStore.kt

@@ -627,6 +627,17 @@ class CredentialStore(context: Context) {
         editor.apply()
     }
 
+    // ── Dashboard card visibility ─────────────────────────────────────────────
+
+    fun getHiddenDashboardCardNumbers(): Set<String> =
+        prefs.getStringSet("hidden_dashboard_cards", emptySet()) ?: emptySet()
+
+    fun setCardHiddenFromDashboard(accountNumber: String, hidden: Boolean) {
+        val current = getHiddenDashboardCardNumbers().toMutableSet()
+        if (hidden) current.add(accountNumber) else current.remove(accountNumber)
+        prefs.edit().putStringSet("hidden_dashboard_cards", current).apply()
+    }
+
     // ── MIB profile visibility (per loginId) ─────────────────────────────────
 
     /** Returns the set of MIB profile IDs the user has chosen to hide (for a given loginId). */

app/src/main/java/sh/sar/basedbank/util/PaymvQrParser.kt

@@ -9,6 +9,24 @@ data class PaymvQrData(
 
 object PaymvQrParser {
 
+    /**
+     * Returns the BML gateway URL if [raw] is or contains one, otherwise null.
+     * Handles both plain URL QRs and combined EMV QRs (e.g. Fahipay+BML card QR).
+     * For combined EMV QRs the URL is parsed from TLV (root tag 35 → sub-tag 20 → sub-sub-tag 01)
+     * rather than via regex, to avoid greedily consuming subsequent EMV tag bytes.
+     */
+    fun extractBmlGatewayUrl(raw: String): String? {
+        if (raw.startsWith("https://pay.bml.com.mv/app/")) return raw
+        return try {
+            val root = parseTlv(raw)
+            val bmlMerchantInfo = root["35"]?.let { parseTlv(it) } ?: return null
+            val inner = bmlMerchantInfo["20"]?.let { parseTlv(it) } ?: return null
+            inner["01"]?.takeIf { it.startsWith("https://pay.bml.com.mv/app/") }
+        } catch (_: Exception) {
+            null
+        }
+    }
+
     fun parse(raw: String): PaymvQrData? {
         return try {
             val root = parseTlv(raw)

app/src/main/res/drawable/ic_nfc.xml

@@ -2,9 +2,41 @@
 <vector xmlns:android="http://schemas.android.com/apk/res/android"
     android:width="24dp"
     android:height="24dp"
-    android:viewportWidth="24"
-    android:viewportHeight="24">
+    android:viewportWidth="48"
+    android:viewportHeight="48">
+
+    <!-- Phone outline -->
     <path
-        android:fillColor="?attr/colorOnSurface"
-        android:pathData="M20,2L4,2C2.9,2 2,2.9 2,4l0,16c0,1.1 0.9,2 2,2l16,0c1.1,0 2,-0.9 2,-2L22,4C22,2.9 21.1,2 20,2zM13,18l-2,0 0,-1c-2.76,0 -5,-2.24 -5,-5s2.24,-5 5,-5 5,2.24 5,5l-2,0c0,-1.65 -1.35,-3 -3,-3s-3,1.35 -3,3 1.35,3 3,3l0,-2 2,3zM19,12l-2,0c0,-2.76 -2.24,-5 -5,-5l0,-2C15.87,5 19,8.13 19,12z"/>
+        android:fillColor="#00000000"
+        android:strokeColor="?attr/colorOnSurface"
+        android:strokeWidth="2"
+        android:strokeLineCap="round"
+        android:strokeLineJoin="round"
+        android:pathData="M6.08,8.6 L20.45,8.6 A1.58,1.58,0,0,1,22.03,10.18 L22.03,37.81 A1.58,1.58,0,0,1,20.45,39.39 L6.08,39.39 A1.58,1.58,0,0,1,4.5,37.81 L4.5,10.18 A1.58,1.58,0,0,1,6.08,8.6 Z"/>
+
+    <!-- Top notch line -->
+    <path
+        android:fillColor="#00000000"
+        android:strokeColor="?attr/colorOnSurface"
+        android:strokeWidth="2"
+        android:strokeLineCap="round"
+        android:pathData="M4.5,12.55 L22.03,12.55"/>
+
+    <!-- Bottom notch line -->
+    <path
+        android:fillColor="#00000000"
+        android:strokeColor="?attr/colorOnSurface"
+        android:strokeWidth="2"
+        android:strokeLineCap="round"
+        android:pathData="M4.5,35.45 L22.03,35.45"/>
+
+    <!-- NFC waves (outer, mid, inner) -->
+    <path
+        android:fillColor="#00000000"
+        android:strokeColor="?attr/colorOnSurface"
+        android:strokeWidth="2"
+        android:strokeLineCap="round"
+        android:strokeLineJoin="round"
+        android:pathData="M36.07,9.29 a18.28,18.28,0,0,1,0,29.42 m-4,-24.16 a11.84,11.84,0,0,1,5,9.45 11.84,11.84,0,0,1,-5,9.45 m-3.68,-14 a5.67,5.67,0,0,1,0,9.1"/>
+
 </vector>

app/src/main/res/drawable/ic_shortcut_pay_card_fg.xml

@@ -4,13 +4,47 @@
     android:height="108dp"
     android:viewportWidth="108"
     android:viewportHeight="108">
+
     <group
         android:translateX="30"
         android:translateY="30"
-        android:scaleX="2"
-        android:scaleY="2">
+        android:scaleX="1.0"
+        android:scaleY="1.0">
+
+        <!-- Phone outline -->
         <path
-            android:fillColor="#FFFFFF"
-            android:pathData="M20,4H4C2.89,4 2.01,4.89 2.01,6L2,18c0,1.11 0.89,2 2,2h16c1.11,0 2,-0.89 2,-2V6C22,4.89 21.11,4 20,4zM20,18H4v-6h16V18zM20,8H4V6h16V8z" />
+            android:fillColor="#00000000"
+            android:strokeColor="#FFFFFF"
+            android:strokeWidth="2.5"
+            android:strokeLineCap="round"
+            android:strokeLineJoin="round"
+            android:pathData="M6.08,8.6 L20.45,8.6 A1.58,1.58,0,0,1,22.03,10.18 L22.03,37.81 A1.58,1.58,0,0,1,20.45,39.39 L6.08,39.39 A1.58,1.58,0,0,1,4.5,37.81 L4.5,10.18 A1.58,1.58,0,0,1,6.08,8.6 Z"/>
+
+        <!-- Top notch line -->
+        <path
+            android:fillColor="#00000000"
+            android:strokeColor="#FFFFFF"
+            android:strokeWidth="2.5"
+            android:strokeLineCap="round"
+            android:pathData="M4.5,12.55 L22.03,12.55"/>
+
+        <!-- Bottom notch line -->
+        <path
+            android:fillColor="#00000000"
+            android:strokeColor="#FFFFFF"
+            android:strokeWidth="2.5"
+            android:strokeLineCap="round"
+            android:pathData="M4.5,35.45 L22.03,35.45"/>
+
+        <!-- NFC waves -->
+        <path
+            android:fillColor="#00000000"
+            android:strokeColor="#FFFFFF"
+            android:strokeWidth="2.5"
+            android:strokeLineCap="round"
+            android:strokeLineJoin="round"
+            android:pathData="M36.07,9.29 a18.28,18.28,0,0,1,0,29.42 m-4,-24.16 a11.84,11.84,0,0,1,5,9.45 11.84,11.84,0,0,1,-5,9.45 m-3.68,-14 a5.67,5.67,0,0,1,0,9.1"/>
+
     </group>
+
 </vector>

app/src/main/res/layout/fragment_cards.xml

@@ -93,6 +93,7 @@
 
             <!-- Divider -->
             <View
+                android:id="@+id/divider"
                 android:layout_width="match_parent"
                 android:layout_height="1dp"
                 android:layout_marginHorizontal="24dp"
@@ -173,6 +174,32 @@
 
             </LinearLayout>
 
+            <!-- Hide from dashboard toggle (manage mode only) -->
+            <LinearLayout
+                android:id="@+id/llHideDashboardRow"
+                android:layout_width="match_parent"
+                android:layout_height="wrap_content"
+                android:orientation="horizontal"
+                android:gravity="center_vertical"
+                android:paddingHorizontal="20dp"
+                android:paddingTop="4dp"
+                android:paddingBottom="4dp"
+                android:visibility="gone">
+
+                <TextView
+                    android:layout_width="0dp"
+                    android:layout_height="wrap_content"
+                    android:layout_weight="1"
+                    android:text="@string/card_hide_from_dashboard"
+                    android:textAppearance="?attr/textAppearanceBodyMedium" />
+
+                <com.google.android.material.materialswitch.MaterialSwitch
+                    android:id="@+id/switchHideFromDashboard"
+                    android:layout_width="wrap_content"
+                    android:layout_height="wrap_content" />
+
+            </LinearLayout>
+
             <!-- Card management actions (manage mode only) -->
             <LinearLayout
                 android:id="@+id/llManageButtons"
@@ -242,6 +269,13 @@
 
         </LinearLayout>
 
+        <!-- Tap-to-pay overlay: shown in tap mode, sits above contentLayout -->
+        <FrameLayout
+            android:id="@+id/flTapMode"
+            android:layout_width="match_parent"
+            android:layout_height="match_parent"
+            android:visibility="gone" />
+
         <!-- Loading state -->
         <LinearLayout
             android:id="@+id/loadingView"

app/src/main/res/values/strings.xml

@@ -238,7 +238,7 @@
     <string name="transfer_lookup_account">Look up account</string>
     <string name="transfer_clear_recipient">Clear recipient</string>
     <string name="transfer_pick_contact">Pick contact</string>
-    <string name="transfer_scan_qr">Scan QR</string>
+    <string name="transfer_scan_qr">Scan to Pay</string>
     <string name="qr_pick_image">Pick image</string>
     <string name="transfer_qr_invalid">Invalid or unsupported QR code</string>
     <string name="qr_camera_permission_title">Camera permission required</string>
@@ -332,6 +332,7 @@
     <string name="mib_qr_nfc_not_supported">Skill issue on MIB side, Not supported</string>
     <string name="card_manage">Manage Card</string>
     <string name="card_set_as_default">Set as Default Card</string>
+    <string name="card_hide_from_dashboard">Hide from Dashboard</string>
     <string name="card_action_change_pin">Change PIN</string>
     <string name="card_action_freeze">Freeze</string>
     <string name="card_action_block">Block</string>

app/src/main/res/xml/bml_aid_list.xml

@@ -0,0 +1,24 @@
+<?xml version="1.0" encoding="utf-8"?>
+<host-apdu-service xmlns:android="http://schemas.android.com/apk/res/android"
+    android:description="@string/app_name"
+    android:requireDeviceUnlock="false">
+
+    <aid-group
+        android:description="@string/app_name"
+        android:category="payment">
+
+        <!-- PPSE: 2PAY.SYS.DDF01 -->
+        <aid-filter android:name="325041592E5359532E4444463031" />
+
+        <!-- Visa -->
+        <aid-filter android:name="A0000000031010" />
+
+        <!-- Mastercard -->
+        <aid-filter android:name="A0000000041010" />
+
+        <!-- Amex -->
+        <aid-filter android:name="A000000025" />
+
+    </aid-group>
+
+</host-apdu-service>

app/src/main/res/xml/shortcuts.xml

@@ -28,13 +28,13 @@
     </shortcut>
 
     <shortcut
-        android:shortcutId="pay_with_card"
+        android:shortcutId="tap_to_pay"
         android:enabled="true"
         android:icon="@drawable/ic_shortcut_pay_card"
-        android:shortcutShortLabel="@string/nav_pay_with_card"
-        android:shortcutLongLabel="@string/nav_pay_with_card">
+        android:shortcutShortLabel="@string/card_pay_nfc"
+        android:shortcutLongLabel="@string/card_pay_nfc">
         <intent
-            android:action="sh.sar.basedbank.OPEN_PAY_WITH_CARD"
+            android:action="sh.sar.basedbank.TAP_TO_PAY"
             android:targetPackage="sh.sar.basedbank"
             android:targetClass="sh.sar.basedbank.MainActivity" />
         <categories android:name="android.shortcut.conversation" />