Financial institutions should be on alert for a scam that combines social engineering, previously undocumented malware and mobile phones’ near-field communication (NFC) capabilities to compromise payment cards, researchers said Friday.