RFID Safety – How To Stop Thieves From Hacking Your Cards

graphic © off-grid.info – images – shutterstock.com (under license)

RFID credit / debit cards are now ubiquitous in many parts of the world and provide a convenient way for people to make payment by simply holding the card up to a reader, which is able to scan the information on the card in order to make the payment.

However these cards are far from secure: Electronic scanners that can read the card’s information are inexpensive (less than $100) to purchase and it has been demonstrated that thieves do not even need to take your wallet out of your pocket. A simple tap, brush, or even just pass in close proximity is all it takes for a thief to scan the card’s RFID chip and take money out of your pocket- digitally. Scammers are able to collect all the information they need to make a usable clone card – including the long number and expiry date.

Security professionals have demonstrated that it is “way too easy” to do this! Someone could steal your card info just by bumping into you! This form of “electronic pickpocketing” is just one of many possible types of credit card scams.

Over a billion cards have been issued with unencrypted RFID chips. If your card says “blink”, “paypass” or “pay wave”, or has the “waves” symbol – it contains the RFID technology.

The problem goes deeper: Passports too contain RFID chips and could be susceptible to hacking. RFID is also used extensively by secure access systems to unlock doors to buildings, hotel rooms and in the corporate environment.

Credit card companies confidently state that their cards have sophisticated anti-fraud technologies – however an estimated $16 BILLION dollars are lost annually to card fraud!

You do NOT want to become a victim of this kind of crime. In addition to draining your bank or credit card account, thieves might gain unauthorized access to your home or hotel room, plant other spying devices (bugs, keystroke loggers etc), create other forms of fake ID in your name, take control of your online accounts, ruin your credit and so on.

These sleeves contain a metallic layer that blocks the card from being read while still in your pocket or wallet!

The sleeves actually work. One eye-opening review we found came from a security conference – where a security engineer put a prepaid credit card to the test – inviting other RFID scanning specialists at the conference to see if they could break into his cards.

“I hung out for the 90 minutes and went back to the hotel. The $50.00 prepaid card and the chip and tap enabled debit card were breached, money had been removed and account information taken.”

When the researcher tested the Alpine Rivers RFID blocking sleeves he found that they were entirely effective in preventing successful attacks on his cards.

Make sure that the sleeves you purchase are FIPS 201 Approved: As part of efforts to prevent the passive “skimming” of RFID-enabled cards or passports, the U.S. General Services Administration (GSA) issued a set of test procedures for evaluating RFID sleeves. For shielding products to be in compliance with FIPS-201 guidelines, they must meet or exceed this published standard.

The United States government now requires that when new ID cards are issued, they must be delivered with an approved shielding sleeve or holder.

The effectiveness of the shielding depends on the frequency being used and the thickness of the protective layer. Low-frequency LowFID tags, such as those used in implantable devices for humans and pets, are relatively resistant to shielding though thick metal foil will prevent most reads. High frequency HighFID tags (13.56 MHz—smart cards and access badges) are more easily shielded and are difficult to read when within a few centimetres of a metal surface. (Source: https://en.wikipedia.org/wiki/Radio-frequency_identification)

Here’s a link to where you can purchase FIPS 201 Approved RFID blocking sleeves for your cards and passports on Amazon.

From the description: Protects credit cards, debit & ATM cards, passports, driver’s licenses & other RFID-enabled contactless Smart Cards. Lined with an electromagnetically opaque shield to block signals from high-tech pickpockets & unauthorized electronic scanning devices.

Card Safety Step #2: Shield your pin

You should cover your pin with your hand not only to prevent anyone who might be watching, but also to prevent any video camera from filming what you are doing. Someone innocently “texting” standing near you could in fact be filming and then later, at their leisure, retrieve your pin. Skimmers have also been known to plant hidden cameras above ATM machines so that the pin can be captured along with the card info when the card is swiped.

Card Safety Step #3: Look for anything weird about the ATM machine you are using

Thieves may plant devices on ATM machines that sit directly above the “real” ATM, enabling them to steal your card data. It’s advisable also for this reason only to use ATM machines inside actual banks, where they are much less likely to have been tampered with.

Card Safety Step #4: Avoid or limit debit card use online

Check also that when you are using a credit card online, that they site is secure (https)

Card Safety Step #5: Check your statements regularly

This might be the only way that you will know that you have been burned! The majority of people do not check their statements. Alert bank or credit card company immediately following any unknown transactions.

Card Safety Step #6: Keep your card on lock

Don’t leave cards where someone else can get their hands on them. Report lost or stolen cards asap.

Card Safety Step #7: Enable 2 Factor Authentication

Just don’t make the mistake of changing phone numbers without turning this off first, otherwise you will find yourself locked out of your accounts and it is a REAL hassle to get back in.

Card Safety Step #8: Don’t do transactions or log into accounts on computers that others have access to

For example – cyber cafe computers. It is very common for these to have malware installed such as keystroke loggers

Card Safety Step #9: Change pins and passwords regularly

Banks suggest changing card pins every 3 months. Memorize your PIN … and don’t leave it written down.

Card Safety Step #10: Don’t Use Free Public Wifi Unencrypted

for transactions. Someone within 500 feet could steal your data. Use a VPN (virtual private network) to encrypt your transaction.

Card Safety Step #11: Use Strong and Long Passwords

Also use a different password for every account (because once one is broken they will try the same password on everything, because of the sheer number of people who use the same password for everything! Also consider the use of a password manager.