NICEVILLE, Fla. — In this week’s edition of It’s Geek To Me, Jeff Werner explains how contactless credit cards work, whether thieves can steal information by scanning wallets, and if RFID-blocking cards are worth buying.
Niceville.com Community Partner
QUESTION:
Spouse Peripheral from Bluewater Bay, Florida, asks:
I have seen a few ads lately about protection from wireless scanners and hackers who just walk by you on the street and steal your information from your wallet. No touching or pickpocketing, just a scan. The protection that is sold is the size of a credit card that slips into your wallet. You just put it into your wallet and forget about it.
Recently, an ad came my way from a company called Wallet Defender. There are several kinds out there. Depending on which package you purchase, they are about $9, $10 to $15 each. Do you think these are worth it?
ANSWER:
Jeff Werner responds:
I have to be careful about how I answer this one, because this is such a broad topic, and there are arguments to be made on both sides of the issue. What “I think” isn’t really worth very much in this situation. What’s more important is an explanation of what you are dealing with, and why it probably isn’t actually a problem.
Let’s start by pulling back the curtain on how your cards actually talk to the world and what the real risks are with the technology in use.
Modern credit cards are equipped for tap-to-pay credit terminals, where you no longer need to insert your card, or otherwise swipe the magnetic stripe. This marvel of the modern age is thanks to a technology called RFID, which stands for Radio Frequency Identification. More specifically, they use a subset of RFID called NFC, or Near Field Communication.
If you’re unfamiliar with these technologies, it might surprise you to learn that there is actually a tiny digital radio transmitter built right in to your card. When you place your card against a checkout terminal, the terminal emits a tiny radio signal. The card has a small internal antenna that catches that signal, powers up the tiny embedded computer chip, and transmits back just enough data to authorize the transaction.
Niceville.com Community Partner
The ads you are seeing are designed to trigger a very specific emotional response: fear. They paint a picture of a crowded subway car or a busy sidewalk where a high-tech thief walks past you with a hidden antenna, silently vacuuming up credit card numbers, expiration dates, and secret codes right through your jeans.
It sounds like something straight out of a spy movie, and because it feels technically plausible, they try and convince you that spending ten or fifteen dollars on a “Wallet Defender” seems like a cheap insurance policy.
Here is the catch that the ad companies won’t tell you: that interaction is designed to work at extremely close range. We are talking less than two inches. For a hacker to walk past you on the street and read your card, they would practically have to bump their scanning device directly against your back pocket.
Even if they managed to get a high-powered, non-standard antenna and hide it inside a backpack to extend that range to a foot or two, the data they would capture is mostly useless to them.
Years ago, the very first generation of contactless cards would broadcast your actual name and card number in plain text. If someone scanned you back then, they might have been able to use that information to buy things online. But the banking industry caught on quickly.
Niceville.com Community Partner
Today, every time your tap card talks to a scanner, it uses advanced encryption to generate a one-time-use digital token or security code. That code is only valid for that exact microsecond and that single transaction. If a thief intercepts that transmission on the street, they cannot reuse it to make a purchase later. It expires instantly.
Furthermore, your name and the three-digit CVV code on the back of your card are never transmitted wirelessly at all. Without those, standard online fraud is nearly impossible.
This is why legitimate law enforcement agencies, cybersecurity experts, and your friendly neighborhood technology Geek report that “digital pickpocketing” on the street is virtually non-existent. It is an incredibly inefficient way to steal money.
Why would a criminal risk walking around in public hoping to get close enough to a pocket to grab a single encrypted token when they can sit comfortably at home and buy millions of verified and leaked credit card numbers on the dark web from a database hack?
Niceville.com Community Partner
So, what are these companies actually selling you for $15? The products like Wallet Defender generally fall into two categories. Some are passive cards made of a thin layer of metal, like aluminum or carbon fiber, which simply block radio waves. Others are active cards that contain a tiny circuit designed to detect an incoming scanner signal and respond by broadcasting static to “jam” the incoming signal.
Do they work? Well, from a pure physics standpoint, the answer is yes, because they do block or disrupt the radio signals. If you put one in your wallet, a scanner will not be able to read the cards directly next to it.
But neither is it particularly likely that the cards can be read without one either. You are likely paying a premium for a solution to a problem you don’t actually have.
The real threats to your wallet these days remain the old-fashioned ones: data breaches at companies where you shop, phishing emails that trick you into typing your password into a fake website, and physical skimmers attached to the front of outdoor gas station pumps or ATM slots.
Niceville.com Community Partner
Keeping an eye on your monthly bank statements and setting up instant text alerts for any transaction made on your account will do infinitely more to protect your finances than any piece of plastic you can slip into your pocket. Save your fifteen dollars and skip the digital superstition!
To view additional content, comment on articles, or submit a question, visit my website at ItsGeekToMe.co.
Jeff Werner, a software engineer based in Niceville, Florida, has been writing his popular “It’s Geek to Me” tech column since 2007. He shares his expertise to help readers solve everyday tech challenges.
