Testing an old idea: NFC-based transient accounts: accounts that log off as soon as the app goes to the background, deleting all traces of the account from the phone.
It looks like this in debugging...
Wouldn't it be better to have the NFC tag sign the event, keeping the key material even out of memory?