In 2013, security expert Fran Brown revealed a device that can copy RFID (radio frequency identification) cards three-feet away. He wanted to demonstrate how vulnerable RFID data in credit cards, identification cards, security passes, car key fobs and everywhere else is.
Twelve years later, the threat of RFID hacking is still present. There have been incidents such as hotel key room hacking and unauthorized credit card transactions after transiting in certain airports that have given people enough reason to invest in products with RFID-blocking features. Examples of these are bags, vehicle key fobs, passport holders, and wallets. But are they really worth spending on?
Kap Maceda Aguila
Before we answer that, let’s go back to the basics: what is RFID and what does it do? According to the Department of Homeland Security of the United States, it is a technology that utilizes radio waves to identify objects or people through a device. It is capable of reading “information contained in a wireless device or ‘tag’ from a distance without making any physical contact or requiring a line of sight.” An antenna reads the data from the RFID-tagged items and transmits it to an RFID reader. Radio frequencies are used to store and collect data.
Credit cards, for example, have passive RFID tags. These do not require a power source and rely on the energy received from an RFID reader and its antenna for power. Active or battery-powered tags, on the other hand, can transmit data from farther distances. Examples of its use are in supply chain management, livestock tracking in farms, and collecting payment on highway tollways.
Experts have revealed a number of ways that RFID data can be stolen. One way is skimming, where criminals gain access to data via rogue scanners. You're scanning your credit or debit card the way you normally do when you pay for something, and without your knowledge, your card details are getting copied illegally.
Another technique is called spoofing. This method utilizes software installed in devices such as computers or smartphones to imitate the signal of RFID tags. It is then used to gain access to secure systems and locations that can enable anyone to track a person’s location without their knowledge and disrupt business operations by gaining access to inventory, for example.
So what do products with RFID-blocking features promise? NordVPN’s Petras Borisovas describes these items as capable of “making your RFID-enabled device resistant to unauthorized access.” An RFID blocking wallet, for example, “is made from materials that interfere with electromagnetic fields.” As a result, criminals cannot take advantage and scan your credit cards without permission.
While someone gaining access to credit cards, security passes, and other vulnerabilities sound like security nightmares, the internet is surprisingly divided on the gravity of RFID threats. Borisovas reveals in his article “What is RFID blocking, and do you need it?” that the case to support claims of unauthorized RFID data access is not very compelling. “Anxiety around identity theft is understandable. But adding further physical protection won’t do much for security — the real threats are online. In the majority of cases, the data is accessible only to the kind of verified scanners you’ll encounter at airports and other official checkpoints. Furthermore, most passports issued in the last decade already contain layers of RFID blocking material.” In reality, he opines that additional security measures are already in place, such as the one-time passwords required to complete credit card transactions. Thieves also need the Card Verification Value (CVV) to use it online.
However, there is still a strong case against RFID threats. Global security companies continue to annually include the threat in studies and product development considerations, too. NordVPN’s Dark Web Monitor is capable of alerting users when their account credentials are found on underground hacker hangouts so they can act on the threat before the criminals act. Norton is offering LifeLock Select Plus to offer customers a comprehensive security and powerful identity theft protection. Products include the Stolen Wallet Protection to help in the cancellation or replacement of lost or stolen cards and Stolen Funds Reimbursement that helps cover financial losses due to identity fraud. The findings and products of these organizations continue to encourage many to invest in RFID-blocking products to help shield their data from incoming RFID signals attempting to gain access
While experts are divided on whether getting additional layers of protection is worth your money or not, they are one in reminding of security actions you should keep prioritizing: using strong passwords, avoiding leaving credit or access cards lying around in the open, and actively monitoring bank accounts especially during travel. Additionally, set limits on daily transactions and keep your bank’s contact information handy even abroad. A new wallet can only go as far as shielding data that can be accessed through other means.