Why You Don’t Need an RFID Wallet to Protect Your Credit Cards

We’ve all heard stories about people who wake up to find their bank accounts empty. In an instant, their life savings have been wiped out. The culprit? An electronic pickpocket.

Armed only with a card reader, the electronic pickpocket targets unsuspecting shoppers, scanning contactless credit cards through slim leather wallets to steal hard-earned cash. It’s a powerful image.

The only problem is that it doesn’t take modern card protection technology into account. Because it’s convenient to use a new contactless card, many people assume that it’s also insecure. Luckily, that’s just not the case.

Modern credit cards use Chip with PIN (EMV) and RFID, which stands for radio frequency identification (RFID) and sometimes NFC (Near Field Communication). As Infosecurity Magazine reports, EMV RFID and NFC cards are more secure than traditional credit cards with magnetic stripes (Magstripes).

This means that while RFID blocking "protection" will make your wallet bulkier and in some cases produce a crinkle sound, it won’t enhance card security.

In this article, we’ll look at what really matters for credit card protection.

Chip with PIN (EMV) and RFID/NFC: The Gold Standard in Credit Card Protection and Convenience

Have you ever tried to tap your card and pay for a purchase, only to realize that you’re holding the card upside down or too far away?

If you have, you know just how close you need to be to a contactless payment terminal to use a RFID card. It's incredibly difficult to trigger a payment just by holding a card reader up to a leather wallet. That’s because RFID credit cards only work when there’s nothing standing between the card and the card reader and you have to get real close. As a result, even a minimalist EDC wallet will protect your credit cards from electronic pickpockets.

In the past decade Chip and PIN known as EMV credit cards have replaced the outdated magnetic strip cards. You probably noticed years ago when your new credit card showed up with a chip in it. As of October, 2015 all merchants in the US were required to accept EMV cards. EMV is an acronym for Europay, Mastercard and Visa, and it uses a chip and pin to complete transactions. Moreover, every EMV credit card transaction is encrypted and uses a one-time code called the control number. This makes it worthless for criminals to try and steal your data. 

In fact, research shows EMV cards with RFID are extremely safe. As the former executive director of the Identity Theft Resource Center, John Haley, explains:

“There are only three pieces of information that are captured by the RFID terminal: card number, expiration date, and a control number that is generated per transaction by the chip based on the information that the RFID terminals sends to the card. It’s a unique number and it changes every time. If you were to capture the control number and try to use that information two minutes from now, it wouldn’t be viable.”

To see if your EMV credit or debit card uses RFID, look for a wave-like symbol that’s reminiscent of the Wi-Fi symbol. That symbol is a sure sign that your card uses RFID technology and every transaction is secure.

Some EMV cards still have magstripes that can be compromised in skimming (we go over this below). But this has nothing to do with RFID or NFC and a RFID blocking wallet won't be blocking anything.

Some RFID blocking wallet sellers will tell you they also block NFC and you must have this. This is also not true. NFC is just two way communication where as RFID is one way. NFC is often used on smart phone wallets when you add your card to it. Some EMV credit and debit cards have NFC and they're still very secure because all EMV cards use encryption and one time codes. There are no longer any credit or debit cards that use RFID or NFC without EMV. 

RFID in Passports and other Cards

To take advantage of RFID, many countries are rolling the technology out to passports with chips. This means that frequent travelers don’t need to worry about security when using a leather passport wallet for their RFID passport — just as with credit cards, their personal information is encrypted. The RFID chip can only be read within 6 inches, only when the passport cover is open, and you need to be able to decrypt it to read it. Passport cards have less data on them to not be a security risk. 

The same isn’t true for all RFID enabled cards. In credit and debit cards it’s the Chip with PIN encryption and one time code that makes it secure. The same isn’t true for all hotel and employer RFID cards. Every hotel and employer has different security standards. You can also set the distance required to read a RFID card. With credit and debit cards it's very close. Some hotels and employers don't require that and will allow a greater distance. When someone says RFID cards aren't secure, remind them that they’re not all created the same.

Why People Fear RFID / NFC

If RFID and NFC is so safe, why are so many people talking about RFID blocking wallets and NFC blocking wallets? It’s simple: fear makes for good marketing. If you can get people to fear something they don’t understand, it’s easier to convince them to buy your product.

A quick search for a wallet with RFID blocking is all it takes to see dozens of companies warning against the supposed dangers of this robust technology. They never tell you about Chip & PIN (EMV) cards that use encryption and one time unique codes for every transaction. Consumer education about RFID security is against their interests.

However, personal finance and information security experts agree that buying a wallet for credit card protection is unnecessary. Instead of focusing on electronic pickpocketing, people should be looking out for genuine security threats.

In the words of Roger A. Grimes, a data-driven defense evangelist at Cyber Security company KnowBe4, “In nearly two and half decades, I've never found a single real-world crime that would have been prevented by an RFID blocker.” Instead, most RFID-related theft occurs when people have their cards physically taken from them by a criminal.

The Real Culprit: Credit Card Skimming

Though many people worry about how to protect the credit cards in their wallet from RFID scanners, few realize that credit card skimming is a far greater threat. Credit card skimming occurs when a thief inserts or attaches a physical device to a card reader. The device, called a “skimmer,” reads information from the card when it is inserted or swiped. Thieves then use this information to make online purchases or copy it to a dummy credit card. As a result, credit card skimmers steal $1 billion annually. This has nothing to do with RFID. Some even confuse skimmers with scanning.

Here’s an informative video of a convenience store that shows you exactly how card skimmers are installed and used.

How to Protect the Credit Cards in Your Wallet

In addition to sticking with Chip with PIN (EMV) RFID credit and debit cards, you can protect yourself against credit card skimmers by carefully inspecting card readers before use. If a card reader seems to have been compromised, that’s a clear red flag. Tug on it and see if it jiggles. And be especially careful at ATM’s and the pump—gas stations are often targeted by skimmers.

Personal finance experts also recommend setting up text alerts to keep track of your credit card payments. Especially large payments. Reviewing monthly statements to catch suspicious transactions can also be a good idea.

Choosing a Wallet Without Fear

Since RFID blocking wallets don’t meaningfully enhance card security, you shouldn’t feel the need to spend extra on them. Instead, you can choose the wallet that you like.

Final Thoughts

Your cards and passport data is encrypted and this means that while RFID/NFC blocking "protection" will make your wallet bulkier and in some cases produce a crinkle sound, it won't enhance card security.