The original title of this post was going to be: “Electronic Pickpocketing: Why RFID Protection is Essential While Traveling.” As I dug deeper into the research, I realized that title didn’t make any sense and that I had been fooled by some really effective marketing. I would have been perpetuating the myth, rather than giving you the facts.
I intend to give you all of the relevant information and resources available about EMV chips and RFID protection. By the end of this post, you’ll understand why the people who are scamming people like you and I aren’t who you think.
Before we get to that, let’s look at what exactly all of this technology is in our credit cards, ATM cards, passports, and drivers licenses.
RFID is the acronym for Radio Frequency Identification. It’s a catchall term that covers the spectrum of all technologies that use radio waves to identify people or objects. I’m sure we could get very scientific with how this stuff works, but it comes down to a pretty simple idea.
Each RFID chip has a unique identifier and when it is scanned by an RFID reader it collects the chip’s information. You have to be within a certain distance for it all to work properly. The technology was first patented in 1983 by a man named Charles Walton.
So this technology has been around for awhile, but where are we using it? It’s actually used all over the place and sometimes you don’t even know it.
Some livestock and pets are implanted with RFID chips so that they can be scanned and identified. Toll roads like California’s FasTrak® allow for cars to automatically be scanned and have their accounts charged rather than stopping and paying with cash. RFID is also used to track shipments in the shipping industry.
And yes, it’s also used in passports, credit cards, debit cards, and some drivers licenses.
So now you’re probably wondering why in the world major companies and governments would put your most sensitive information on a card that can easily be scanned by a machine.
Well, there are some major benefits to this technology. This is why the RFID industry is going to be over $27 billion by 2024.
If you hate waiting in lines, you’ll appreciate that RFID technology will speed up border crossings while maintaining security. The technology allows customs officials to increase the speed in which they check passports while automatically checking the information against terrorist watch lists.
As for credit cards and debit cards, your transaction is more protected against thief’s who can copy the magnetic strip on your credit card. After your credit card’s magnetic strip is stolen the thief can make copies and distribute them on the black market. The new technology will prevent you from having to swipe your credit card.
The EMV chips are becoming popular in the US as the major card companies transition to this technology.
EMV chips have been around for awhile in Europe, but it’s taken some time for them to finally arrive in the US. EMV stands for Europay, MasterCard, and Visa, which shows that the major credit card companies all worked together to push this more secure technology.
Over $16 billion in credit card fraud was reported in 2014 and affected over 12.7 million people. It’s no wonder that these companies want to create more secure cards. This is why you’ve probably received an updated credit card with EMV technology in the past year.
Although these new cards still come with a magnetic strip, the credit card companies are shifting liability away from themselves to encourage retailers to stop using them. Retailers must update their credit card processing systems to the new EMV-enabled systems before October 1st, 2015.
If a retailer does not update their systems and it results in fraudulent activity on the card, the credit card companies will charge the retailers to cover the fraudulent expense. Ouch! This is why you’ll see most retailers updating to the new EMV system if they haven’t done so already.
The deadline is also likely the reason that fraudsters were hustling to steal as much credit card info as possible before the free-for-all party comes to a halt.
When you’re traveling around, you’ll notice that there are two main types of these EMV cards: Chip & Pin and Chip & Signature.
Chip and Pin EMV Cards
If you’re from the US, you probably associate PIN’s with a debit card or ATM card. This isn’t likely to change soon for you, but you should be aware that some places, require a PIN with your credit card. As you can imagine, this makes it a bit difficult to finish your transaction when your credit card doesn’t have a PIN.
These aren’t very common at retail locations, but they are common at unattended kiosks. If you encounter a Chip and Pin type system somewhere, it’s likely to be associated with transportation. Places like gas stations, train stations, and toll booths in Europe and other locations require a PIN.
Chip and Signature EMV Cards
Chip and Signature cards are exactly what they sound like. You insert your card into the reader, and then sign your signature to complete the transaction. This type of EMV card transaction will continue to be common in retail stores, convenience stores, etc.
The credit card companies are implementing this new technology for security reasons, but you’ve probably heard about electronic pickpocketing. Let’s look at what the scammers are trying to do now that we have radio frequencies on our most important documents and cards.
Skimming and Eavesdropping Scams
Now that our information is one scan away, there are a couple of scams that are going around that we should be aware of. The two that many news stations have reported on are credit card skimming and eavesdropping.
Credit card skimming involves someone getting close enough to you with a credit card reader and scanning your credit card. They could potentially do this without you being aware of it going on. You’re simply walking by, someone walks behind you with a scanner, and that information is automatically sent to their computer.
Eavesdropping is a little bit different than skimming, but it’s goal is the same. Eavesdropping occurs when there is communication between the reader and the chip. The information is intercepted while this is happening and transferred to a computer.
Why would credit card companies and the US government make our information so vulnerable? Well, it’s not as vulnerable as some companies claim.
If you do a little research into these news stories, you’ll begin to notice a trend. The people that the reporters are talking to own or work for a company that sells sleeves, wallets, and pouches that block RFID signals. The expert on this news story is Walt Augustinowicz, the owner of Identity Stronghold.
The more scared you are of having your identity stolen, the more likely you’ll be to pick up one of those RFID blocking wallets or sleeves. But are they even necessary?
Randy Vanderhoof, the executive director of the Smart Card Alliance, says “We’ve got six years of history, a hundred million users of these cards, and we haven’t seen any documented cases of this kind of fraudulent transaction. The reason we think that’s the case is that it’s very difficult to monetize this as a criminal.”
Most criminals that are looking to steal credit card information want to do so in a way that makes them the most money. This is why experts expect a shift in fraud to go to e-commerce, where the card doesn’t have to be present.
So should we be worried about these scams or is it just a bunch of hype to get us to buy the RFID protection wallets?
Protection Against the Scams
Let’s look at each official document or card and see exactly what the companies and government are doing to protect us.
The Passport Card is an official US document that you can use instead of a passport for certain entries into the US. It cannot be used for any international travel by air.
As you may have guessed, RFID technology is included in the card to help speed up the process through US customs and try to keep everyone safe. The card is always issued with a protective RFID sleeve, which keeps it from being read when it’s not in use.
And even if you don’t use the sleeve and someone scans the card, all they will get is a number, which will only mean something if the thief also has access to the government database.
U.S. Electronic Passport
The US Government has been issuing electronic passports since August 2007. They have an RFID chip in them that stores the information displayed on the photo page of your passport as well as some other data to prevent fraud.
The purpose of these passports is to speed up the customs process and enhance security by automatically scanning the data against databases as well as saving a digital image of the person.
To prevent anyone from accessing your information, there are safety measures put in place on the card itself. First, someone can’t scan the information unless the passport is open. It has a protective metallic barrier that prevents someone from skimming it while it’s closed. In addition, the chip denies access to any device that tries to access the info without authorization.
Enhanced Driver’s License
Similarly to the Passport Card, the Enhanced Driver’s License also includes an RFID chip. It uses the same technique to deter would-be thefts, by not including any personally identifiable information on the card.
There is a number included in the chip that only is relevant when you have access to the secure databases that look the information up.
Credit Cards and Debit Cards
The cards generate single-transaction codes that only would allow a criminal to make one purchase on your card before they have to scan a new one. Instead of making copies of your magnetic strip on credit cards and selling them on the black market, it’s now limited to one transaction. This is a smart move from the credit card companies since they now limit their risk.
As far as eavesdropping goes, the EMV terminal and the EMV credit card work together to make sure the data is secure. If a scammer were to access the data it would be a bunch of random numbers that would be nearly impossible to decipher.
Do You Need an RFID Blocking Wallet?
This brings us back to the start of the article. I was under the impression that I needed an RFID wallet to keep my passport and credit cards safe. I’m not a security expert, but after all of this research I’m convinced it’s blown way out of proportion.
These RFID protection companies are attempting to scare us into purchasing something that we don’t really need. According to the US Government, your passport is safe from skimming because of the protective metallic barrier.
If you have a Passport Card, place it in the RFID protective sleeve that comes with it just in case. If you have an Enhanced Driver’s License, and someone scans the card, the government says it will only be random numbers that only mean something if the thief has access to the government’s database.
Lastly, if you have a credit card or debit card and a thief does decide to try and skim it, they will only be able to use it on one transaction. If that happens, your credit card company is more than likely liable for the fraudulent transaction and will reimburse you the money.
If a thief is going to get close enough to you to scan your card, they’re probably better off pickpocketing you so that they can use the card more than once. Personally, I’m going to focus more on keeping my cards safe from pickpockets than I am going to be worried about RFID skimmers.
If you’re really overprotective or your name is James Bond, then you can consider getting an RFID sleeve. Other than that, I wouldn’t put it too high on your list of priorities when you’re traveling.