Do You Really Need RFID Blocking? An Honest Answer From a Wallet Maker

Short answer: Most people don't strictly need RFID blocking for their credit and debit cards. Contactless payment cards only talk to a reader a few centimeters away, and they create a one-time code for each transaction, so stolen data is hard to reuse. Real-world skimming of payment cards is uncommon. RFID blocking is a reasonable extra layer if you carry certain ID or access cards, travel through crowded places often, or simply want peace of mind. It shouldn't be the main reason you buy a wallet.

We sell RFID-blocking wallets, so we know this answer is not the most convenient one for us. We think you should hear it anyway.

What is RFID skimming?

RFID skimming is when someone uses a hidden reader to wirelessly read a contactless card without the owner noticing. Contactless credit and debit cards use 13.56 MHz radio (the ISO/IEC 14443 standard, the same family as NFC). A reader's field powers the card's chip, and the chip answers.

The idea is easy to picture: someone brushes past you on a train with a reader in a bag. Whether that's a practical way to steal money is a different question.

How close does someone need to be to read my card?

Very close. According to the US National Institute of Standards and Technology (NIST SP 800-98), ISO/IEC 14443 cards typically operate at 7–15 cm (about 3–6 inches). Security researchers have shown rogue scanning at around 25 cm with custom equipment. Listening in on a real transaction between a card and a legitimate terminal has been shown at longer distances with fixed antennas.

So an attacker using normal equipment would need to be within a few inches of your card. Doing better than that takes specialized gear.

Why is RFID skimming of credit cards considered low risk?

Modern contactless payment cards don't send a reusable secret. Each transaction includes dynamic data that is unique to that tap, so captured data can't simply be replayed for another purchase. That point comes from the Secure Technology Alliance's contactless payments security Q&A. Card issuers also check each transaction's cryptogram before approving it.

In practice, that means:

  • A skimmed tap doesn't give a thief a working clone of your chip card.
  • Your PIN is not sent over the air when you pay contactlessly. You type it on the terminal when one is required.
  • Card issuers' fraud monitoring still applies to contactless transactions.

This doesn't mean contactless cards can't be attacked. Researchers have demonstrated relay attacks, where one device near your card and another near a real terminal pass the conversation between them in real time (Kfir and Wool, "Picking Virtual Pockets," 2005). These attacks need two coordinated devices and a live transaction. They are far more effort than "wave a scanner past a pocket."

When does RFID blocking actually matter?

RFID blocking is most useful in a few specific situations:

Situation Does blocking help? Why
Everyday credit and debit cards A little Low real-world risk; per-transaction codes limit what a skimmer gets
Crowded transit and travel hubs Some peace of mind Close physical proximity is what any skimming attempt needs
Tapping a whole wallet at a transit gate Yes, practically Shielding the cards you're not using helps the reader see only the card you pull out
Building access badges and some ID cards Depends on the card's frequency Some badges use other frequencies (such as 125 kHz) and simpler security. Card Blocr is tested at 13.56 MHz, so we don't claim protection at other frequencies
US passport book Usually not needed The passport is not a wallet card; it has its own protections
US passport card Use the sleeve it comes with The US State Department issues each passport card with a protective RFID-blocking sleeve

Does an RFID-blocking wallet actually work?

Yes, for cards fully inside a conductive enclosure like an aluminum card chamber. Metal around the card blocks the reader's field, so the card can't power up and answer. Card Blocr wallets use an aluminum card chamber. Card Blocr's RFID blocking is factory-tested at 13.56 MHz, the frequency used by credit and debit cards. Test documentation from our factory is available on request.

Two honest caveats:

  • Only the chamber blocks. The aluminum chamber is the shield. Don't assume cards in an outer leather or PU pocket are protected.
  • Popped-up cards are exposed. Secrid, which makes a similar aluminum card case, notes that when cards are slid partway out, they can still communicate over a short distance. That is true of any pop-up wallet.

Will RFID blocking stop my phone or tracker from working?

No. RFID blocking only affects cards stored in the shielded chamber. Your phone and the Bluetooth tracker in a wallet work normally. That's why the Card Blocr Wallet with Built-In Find My Tracker combines an RFID-blocking card area with a 2.2 mm tracker that works in Apple Find My.

Does RFID blocking stop me from paying with a tap?

Yes, while the card is inside the chamber. You'll need to pop the card out (or take it out) to tap. Most people barely notice, since a pop-up mechanism puts the card in your hand in one motion. If you mostly pay with your phone or watch, the question doesn't come up.

So should I buy an RFID-blocking wallet?

Buy the wallet you'd want anyway for its size, capacity, card access and price. If it also blocks RFID, treat that as a free bonus. Most aluminum pop-up wallets, ours included, block RFID by design, so you rarely pay extra for it.

If you've decided a pop-up wallet suits you, these are good places to start:

Comparing brands? See Best Pop-Up Wallets Under $40.

What are the best ways to protect my cards?

The measures that do the most are simple:

  • Turn on transaction alerts in your banking app.
  • Use your phone or watch wallet where you can. It uses device-specific tokens rather than your card number.
  • Check statements regularly, and report lost cards right away.
  • Be cautious with phishing emails and texts asking for card details.
  • Keep your US passport card in the sleeve it came with.

Sources

Back to blog