I’ve been researching the issue of RFID skimming. However, I can’t find conclusive sources on the true risk of this issue. Is it possible to read RFID chips on credit cards? If so, what type of information can hackers obtain? And do they need a credit card terminal to process this information? I’ve looked at Web sites from companies selling products for protecting against skimming, but their information is biased because they’re trying to sell a product.
—Jordan, United States
To my knowledge, there has never been a case of credit card information being skimmed. Those who raise concerns about the security issues surrounding RFID rarely differentiate what is possible and what is likely. It is possible to read the data from a credit card using an RFID reader based on the same open standard as the transponder in the credit card. Some credit card companies only store a serial number on the transponder and link it to a credit card in a secure back-end system. Others store the same information on the tag that is on the card—namely, the credit card number, the holder’s name and the expiration date.
I believe the threat is very small today, because there is little to be gained by doing this. If you are a criminal armed with an interrogator and you continually brush against people to read their credit card data, you could be caught in the act. Hacking databases online or paying someone for a password, on the other hand, is less risky, because it is easier to hide direct involvement. What’s more, the financial benefit of skimming is miniscule compared to that of hacking a database.
Capturing data from an RFID credit card would allow someone to, say, make a purchase online. But when you reported the fraudulent transaction, you would not be liable for the expenditure, and if the person used their own shipping address, they could be easily found. Additionally, when an item is purchased online, retailers choose different levels of security. In some cases, if the card number doesn’t match the billing address on file, the transaction will not go through. Since the billing address is never stored on the RFID transponder, the criminal would not have this information. Credit card companies also use software systems to detect potentially fraudulent transactions, and will suspend your account if they detect unusual purchasing patterns.
The likelihood that criminals will build or purchase RFID readers and go around skimming data from cards seems very unlikely—at least today—because the payoff is so small. A criminal might spend an entire day to acquire 200 to 300 card numbers—but if a criminal gang were to pay someone working in the IT department at a large online retailer that stores card numbers, or a bank or other financial institution, for a password, it could obtain millions of card numbers. It could then manufacture bogus cards and sell them, or sell the numbers to others who would use them for criminal purposes.
Over time, as these cards proliferate, I would expect we will see some skimming cases, and credit card companies will respond with greater security measures. I hope that answers your question.
Yours,
Mark Roberti, Editor, RFID Journal
FAQs
Because RFID credit cards work via radio frequencies, some thieves have begun targeting these credit cards by using RFID readers. These readers could potentially pick up your card information without your knowledge by getting close enough to your card to pick up on the radio frequency.
Can RFID credit cards be hacked? ›
Yes, debit cards with RFID chips are also susceptible to unauthorized scanning. To prevent huge financial losses, you should regularly monitor your transactions and flag unauthorized payments as soon as possible.
How far can RFID be read on a credit card? ›
High-frequency tags, which are often used in smart cards, have a read range of three feet or less.
Do RFID scanners work on chip cards? ›
Yes, the RFID tags that are in some credit cards put out radio signals, but those tags must be within close range of a reader to be read.
Can RFID readers read credit cards? ›
Although banks claim that RFID chips on cards are encrypted to protect information, it's been proven that scanners—either homemade or easily bought—can swipe the cardholder's name and number. (A cell-phone-sized RFID reader powered at 30 dBm (decibels per milliwatt) can pick up card information from 10 feet away.
How common is RFID credit card theft? ›
RFID credit cards are considered to be as safe as EMV chip cards, and data theft concerning RFID cards is uncommon. This is because of how these cards transmit information and what information is shared.
Can a credit card chip be read remotely? ›
Yes, chip credit cards can be read remotely, but only if they have contactless capabilities. A chip-only credit card has to be dipped into a card reader in order to complete the transaction. That's because the chip does not transmit any signal that can be picked up from a distance by a card reader or a fraudster.
Do credit cards with chips need RFID protection? ›
They also need to be much closer to scanners to be read. So, skimming theft risk is much lower again. RFID sleeves and wallets still block any signals from these cards. So, in the unlikely event someone gets so close they can read your card, you'll still have protection.
Can your phone read RFID card? ›
Smartphones that are NFC enabled can read RFID devices in the 13.56 MHz band. NFC is essentially 13.56 MHz RFID using predefined data structure & formats. RFID devices operating in the same frequency but not using NFC protocol can't typically be read by NFC phones except for a serial number.
Do credit card sleeves really work? ›
RFID blocking cards do work. They create a protective shield around your cards that prevents unauthorized scanners from recording and stealing information stored within the chips.
RFID Tag Finder will help you locate those hard to find RFID tagged assets, complete with visual and audio indicators.
How far away can you read an RFID chip? ›
Far-range UHF RFID tags can read at ranges as far as 12 meters with a passive RFID tag, whereas active tags can achieve ranges of 100 meters or more. The operating frequency of UHF RFID tags ranges from 300 MHz to 3 GHz, and UHF tags are the most vulnerable to interference.
What states banned RFID chip? ›
Currently 13 U.S. states have passed statutes banning mandatory human microchips: Arkansas, California, Missouri, Montana, Nevada, New Hampshire, North Dakota, Oklahoma, Utah, Wisconsin, Indiana, Alabama, and most recently Mississippi.
Can RFID readers be hacked? ›
By closely monitoring the power consumption levels of RFID tags, hackers can fool your systems. With some ingenuity and a cell phone bad actors can perform an RFID hack that will steal sensitive information or breach secured areas.
How do I protect my credit card from being scanned? ›
Cut two pieces of paper or cardboard into the size of a credit card, wrap each piece with aluminum foil, and carry them in your wallet around your credit cards. The aluminum will disrupt most electronic signals. You can also wrap each credit card in aluminum foil and place the wrapped cards in your wallet.
What can block RFID readers? ›
Any material that can interfere with electromagnetic fields is able to block RFID. The most common materials used in the manufacture of RFID blocking wallets and bags are carbon fiber, aluminum, and leather. In a pinch, you can just wrap your credit card in tinfoil to protect against skimming attacks.
Are RFID credit cards secure? ›
The passive RFID tag in your friend's credit card is an HF tag based on the ISO 14443 air-interface protocol, which limits the read range to a few inches, for security reasons. RFID credit cards are actually much safer than conventional magstripe cards.
Is RFID easily hackable? ›
Wireless devices that use RFID access control are convenient, but they are by nature less secure than wired connections, which are far more difficult for hackers to gain access to and infiltrate.
How do I protect my credit card from RFID theft? ›
Any material that can interfere with electromagnetic fields is able to block RFID. The most common materials used in the manufacture of RFID blocking wallets and bags are carbon fiber, aluminum, and leather. In a pinch, you can just wrap your credit card in tinfoil to protect against skimming attacks.
How did someone use my credit card without having it? ›
Card-not-present fraud can occur when a criminal obtains a cardholder's name, billing address, account number, three-digit CVV security code, or card expiration date. These details can be stolen electronically without obtaining the physical card.
