Pickpockets don't actually have to pick your pockets anymore. That's the message you might see on TV or in ads warning that hackers can access your credit card data wirelessly, through something called radio frequency identification, or RFID. In the last few years, a whole RFID-blocking industry has sprung up, and it survives partly on confusion.
In videos like this YouTube demo, a man holds a black scanner the size of a large remote near a woman's back pocket and, voila, he's got her credit card number and expiration date. That's because her card has a tiny RFID sensor chip.
These chips are supposed to make life easier by emitting radio signals for fast identification. The technology helps keep track of livestock and inventory. It makes automatic payment on toll roads and faster scanning of passports possible, and, starting around 2004, brought us contactless payment with certain credit cards.
The problem, according to Walt Augustinowicz, is there's no "off" button on these cards. "Anyone with a reader can try and surreptitiously gather data from them," he says.
Augustinowicz is the godfather of RFID-blocking accessories. A decade ago, recognizing that people would want to block their credit cards from being "skimmed," he started a company called Identity Stronghold. On his website, you can find shielded badge protectors, leather purses, and every style wallet imaginable — from Western bi-folds to purple faux-crocodile mini clutches. The products cost is anywhere from $10.00 to $50.00.
"We actually have special shielding cloth now that's actually lined inside every wallet," Augustinowicz says.
The industry championed by Augustinowicz has blown up since. REI and other companies sell a range of RFID-blocking products and say the number of customers looking for travel bags and credit card sleeves has been growing. That's despite the fact that the percentage of credit cards with RFID chips in the U.S. is extremely small. If you see a symbol of radio waves on your credit card, it's likely RFID enabled. (RFID chips are different from EMV chips. EMV chips, which require contact, are in most credit cards.) There aren't exact numbers, but according to Phil Sealy, principal analyst at ABI Research, about 26 million were issued in 2016. That's out of a total of 550 million payment cards in the U.S.
In other countries, the percentage of contactless cards is much higher, according to Roger Grimes, a computer security expert. Still, he says you probably don't need to buy an RFID-blocking wallet.
"There's probably hundreds of millions of financial crimes being done every year and so far zero, real life RFID crime," he says.
Grimes says tracking RFID crime is just about impossible — it's hard to know how someone's information was stolen. But he says the reason it's unlikely to happen is simple: thieves don't want to waste their time.
"An RFID hacker has to make sure that there's a lot of people walking by with RFID-enabled credit cards, [and] there's good chance they'll be caught on closed circuit cameras nearby, versus, I can for a lot less risk, go online on the Internet and buy thousands" of credit cards, their information and security codes "for literally a couple of a bucks a piece," Grimes says.
Still, people are worried about electronic pickpocketing — worried enough to strap on RFID-blocking fanny packs, even skinny jeans. In 2014, the San Francisco-based clothing company Betabrand partnered with Norton Security to create the firstpair of denim with RFID protected pockets. Aaron Magness, Betabrand's vice president of marketing, says the pockets were lined with a nickel-and-copper fabric.
"They went up for crowdfunding and made it through crowdfunding, so there's enough people that wanted the pants and it actually turned out to be quite successful," Magness says. There was a downside. "If you have the 'dark' pocket, what ends up happening is your cell phone is constantly searching for signal and you're going to drain your batteries pretty quickly," he says. "So it may not be the best idea to have the fabric in the pocket."
Eva Velasquez, president of the Identity Theft Resource Center, says from a consumer perspective, deciding whether to invest in RFID-blocking technology is all about evaluating risk. In the next few years, there will undoubtedly be millions more of these cards on the market. But for now, Velazquez is most concerned about other ways thieves steal personal information.
"Things like telephone scams," she says. "Simply asking people for that information, pretending to be your bank or the IRS. There really are a plethora of ways."
So, Velazquez says, if you're in the market to buy a new wallet and decide to get one with RFID protection, it won't hurt. But she encourages people to pay attention to the basics, like good password management and checking your credit reports.
Finally, if you're worried about e-pickpocketing but don't want to spend much money, you can make your own blocking wallet or wrap your cards or passport in a thick piece of aluminum foil. According to Consumer Reports, that works as well as most RFID protectors on the market.
Lauren Silverman covers health, science and technology for member station KERA. You can follow her @silverwoman.
Copyright 2017 KERA
