Devices, systems, and methods are disclosed which relate to an NFC-enabled security token that is removably coupled to a mobile device. The security token may be provisioned with the information by the mobile device, then decoupled from the mobile device and used to authenticate the user or perform a transaction at a POS terminal equipped with an NFC reader. The security token includes logic for user-controlled restrictions on allowable purchases, such as payment limits, timeouts, vendor identifiers, allowed purchases, and location-based restrictions. The security token is further equipped with “self-destruct” security features, such as deactivating itself or erasing any sensitive information upon being unable to contact the mobile device for a specified duration, or being subject to an unauthorized or restricted transaction, until such time as it is re-coupled to the mobile device.