Travel Explainer

The Skimming Scam

RFID-blocking wallets can work. But do you really need one?

radio wave repelling wallet.
Are thieves really trying to steal your information via the RFID chips in your passport and credit cards?

Photo illustration by Juliana Jiménez. Photo by Ryan McVay/Thinkstock.

Wallet choices used to be simple. You could get a bifold, a trifold, or a clutch. More pockets, fewer pockets; leather or synthetic. Flip through Sky Mall on your next flight, though, and you’ll find a new and potentially confusing option: RFID blocking. RFID-blocking wallets and sleeves, like this one from Swiss Alpine and this one from Buxton, claim to do something more than just keep your cards and money organized. They claim to keep your personal information safe from high-tech thieves. Do they really work, and are they necessary?

They might do their job, at least to some extent, under certain theoretical circumstances. But that doesn’t mean you need one.

RFID-blocking wallets are designed to help insulate you from a very particular brand of electronic pickpocketing, called RFID skimming. The concern is that some credit cards, passports, and driver’s licenses now come with embedded radio frequency identification chips. When activated by an RFID reader, these chips transmit certain types of information wirelessly, so that you can verify your identity or even make a purchase without swiping your card. The downside: Anyone with an RFID reader can activate those chips and pick up whatever information they’re designed to transmit. And, if they’re sneaky about it, they can do it without your knowledge.

Hackers have made headlines over the years by demonstrating how a handheld RFID reader can “skim” sensitive information from people’s cards at a distance of several feet. They can get your name and country of origin from your passport. More alarmingly, in some demonstrations, RFID skimmers have collected whole credit card numbers from the pockets of passersby. RFID-blocking wallets are designed to impede your cards’ RFID signals, making them harder to read remotely. Tests by Consumer Reports, MakeUseOf, and others have found that some RFID-blocking wallets work better than others. If you’re going for maximum efficacy, however, few work as well as simply wrapping your cards in aluminum foil. 

What’s less clear is whether RFID skimming is a threat worth worrying about in the first place. For all the hype about the theoretical danger, there have been few if any reports of actual crimes involving RFID skimming. The technique appears to be far more popular among security researchers than it is among thieves, and for good reason: There are much easier and more effective ways to steal people’s money and data.

While early versions of RFID payment systems may have transmitted sensitive data like the card number unencrypted, major credit card companies insist that’s no longer the case. Their RFID chips now send a one-time code for each transaction, so at best, a determined thief might be able to make a single purchase by recording and replicating the signal he picks up from a given card. Even if that were to happen, the cardholder would not be liable for the fraudulent purchase under most credit card companies’ policies. From the thief’s perspective, it’s a lot of work for relatively little gain.

By contrast, skimmers installed on ATM or point-of-sale machines allow thieves to pick up much more usable information from a far greater number of cards. Unlike RFID skimming, ATM skimming is a real and widespread problem both in the United States and elsewhere. But no wallet will protect you from that.

In any case, RFID-based contactless payment systems have recently fallen out of favor among U.S. credit card companies. They’re focusing instead on implementing a European-style chip-and-PIN system known as EMV, which uses different technology and is less vulnerable to remote skimming. (EMV cards may come with their own security risks, but again, an RFID-blocking wallet won’t help you with those.)

As for the other RFID chips you might carry, the most anyone is likely to glean from your passport or driver’s license is basic information like your name and country of origin. If you’re bent on traveling incognito—perhaps you’re a spy, or an international person of mystery—an RFID-blocking wallet or sleeve might be a prudent precaution. Otherwise, odds are you’ll be just fine without one.

The Explainer thanks Julie Fergerson, chair of the Identity Theft Resource Center, and Brian Krebs, independent investigator and author of the blog Krebs on Security.

Take the grand tour of the rest of our Travel Explainers here.