Testing RFID blocking cards: Do they work? Do you need one?

[RV_]

Since we all use CCs and Debit cards today I was wondering about an RFID blocking sleeve or wallet. It is something I put off looking into but an article today was clear about it.

These blockers just need to sit in my wallet, two for mine because I have a trifold.

One of my favorite Tech writers also gave a link and I found a better one at about half the price for four.

Excerpt:

The blocking card looks like any other credit or debit card, and doesn't need any charging or anything. All you need to do is pop it into your wallet or purse, and it's supposed to block RFID reading.

The Vulkit RFID blocking card looks like any other credit, debit, or ID card.

But does it work?

First I fired up the Flipper Zero, and tested an unprotected debit card. It read the data (see the picture below).

Note that while the Flipper Zero can read NFC cards, it cannot decode the card's encrypted security code, also known as CSC, CVV, CVC, CAV, and a bunch of other three-letter abbreviations.  

The Flipper Zero can read the unencrypted data on a debit card.

 

OK, now let's add the blocking card to the equation.

The Vulkit RFID blocking card does indeed block the RFID signal.

Yup, it blocked the reader. The Flipper couldn't read anything from it.  

What if the blocking card is behind the target card -- meaning it isn't a physical barrier between the credit card and the reader?

The Vulkit RFID blocking card works even if it is behind the target card.

 

Yup, it even blocked that. 

So, does Vulkit's blocking card work? 

Yes. It's very effective.

Do you need one?

It depends. 

The Vulkit RFID blocking card certainly adds a layer of security between you and someone wanting to access your data. For example, I've seen hotel safes that can be locked and unlocked using credit or debit cards, and a Flipper Zero could be used to clone the card and unlock the safe.

So, while I think the chance of someone reading your card and using it for bad things is small, these cards cost about $4 each, which means they're cheap and easy-to-use insurance against such attacks."

Source article with more:

https://www.zdnet.com/article/testing-rfid-blocking-cards-do-they-work-do-you-need-one/?ftag=TREc64629f&utm_email=3b2e0f94e4947c973f63c5cf2d34603c24fe97fe01cb10979119da7270e034b9&utm_campaign_id=6230454&utm_email_id=1c87d9544038b267c265fc969622f5dc577be1ebaa6f147fb2d4ae7fd2e8a88d&utm_newsletter_id=92316&medium=email&source=iterable

 

His link is sold out so I ordered four from this vendor - https://www.amazon.com/dp/B07T8PYBKM/ref=sspa_dk_detail_0?pd_rd_i=B07T8PYBKM&pd_rd_w=C2X32&content-id=amzn1.sym.88097cb9-5064-44ef-891b-abfacbc1c44b&pf_rd_p=88097cb9-5064-44ef-891b-abfacbc1c44b&pf_rd_r=588NTJZ5XVZSJNR7DYGS&pd_rd_wg=dLtaJ&pd_rd_r=c211090f-a76d-4926-a7cd-e4e86dc13db3&s=generic&sp_csd=d2lkZ2V0TmFtZT1zcF9kZXRhaWw&spLa=ZW5jcnlwdGVkUXVhbGlmaWVyPUExTEtBSDhONkJTN1ZOJmVuY3J5cHRlZElkPUEwOTExMDQzMjdVODhBRjNYQVY2SSZlbmNyeXB0ZWRBZElkPUEwODQzNjEwM0ZSM0ZON0tUNDRSTyZ3aWRnZXROYW1lPXNwX2RldGFpbCZhY3Rpb249Y2xpY2tSZWRpcmVjdCZkb05vdExvZ0NsaWNrPXRydWU&th=1

The almost 5000 reviews show it works and has been tested by folks who bought them.

 

 

[Kirk W]

Not everyone agrees with that opinion. Here are a couple of other opinions.

What is RFID Blocking (and Why You Don’t Really Need It)   Last updated Feb. 6, 2023 

According to USA Today, your RFID-enabled credit card is constantly emitting its information, and as soon as your card is close enough to a reader, the reader records the info. This is what makes the transaction occur in a matter of seconds. So, technically, all a thief needs is a scanner that can read the radio signals emitted by the RFID chip in your card. If they have one of these scanners, theoretically they would be able to steal credit card data if they’re within close proximity, and you wouldn’t even know it.

But they’ve got to be close — usually within four to six inches of the card — unless they have a really strong antenna. At that close of a distance, you’d probably notice, but it does depend on where you are. If you’re walking through Target, someone coming within six inches of you would be incredibly noticeable, but that proximity might not be as suspicious if you’re crammed in a crowded train. In that scenario, someone just brushing against you might be enough for a criminal to potentially get your information.

While this might have you on guard the next time you leave your house, looking at anyone standing next to you in line or in a crowded place as a potential thief, American Express notes that signals coming from the RFID chip only emit the credit card number and expiration date; not the CVV code or cardholder’s name. While this can be enough for a thief to successfully duplicate your card for in-store purchases, online purchases typically require you to enter the CVV code and expiration date, which isn’t transmitted through the RFID.

Furthermore, many RFID-enabled credit cards send out a unique serial code, which, according to both Visa and Mastercard, changes every time you use it, so if someone does get your information and is able to duplicate it, they’ll likely only be able to use your information once — if at all.

But we can probably all agree it only takes one occurrence for credit card fraud to be damaging. And if these criminals are stealing the information from multiple people, imagine what they can walk away with.

RFID Blocking – What Is It & Do You Need to Worry?   Last updated: Jan 27, 2023 

While it’s always a good idea to safeguard your wallet, the danger of contactless credit card thefts is overblown. Here’s why:

Criminals with a reader need to be very close to scan your card.

The theft is a time consuming hit-or-miss for criminals. Their victim might not even own a contactless card.

The RFID chip only transmits the card number. Additional information needed for online transactions, such as the expiration date or security code, can’t be scanned.

RFID cards now use encrypted one-time codes for each purchase.

All this means it’s not really worth it for scammers to skim RFID cards. Still, you should keep a close eye on your online finances and RFID scams are the least of your worries.

[docj]

Here's another article explaining why concerns about long-range information theft from RFID cards is unfounded:  https://www.thalesgroup.com/en/markets/digital-identity-and-security/banking-payment/cards/contactless/how-it-works

[RV_]

Well hi guys. Thanks for reiterating what was in the article excerpt above. It said:

 

"The Vulkit RFID blocking card certainly adds a layer of security between you and someone wanting to access your data. For example, I've seen hotel safes that can be locked and unlocked using credit or debit cards, and a Flipper Zero could be used to clone the card and unlock the safe.

So, while I think the chance of someone reading your card and using it for bad things is small, these cards cost about $4 each, which means they're cheap and easy-to-use insurance against such attacks."

 

Like I always say, take what you can use and leave the rest.

Here's one that does about a foot and does not use a Flipper, start a 2:19 into the 3:29 video:

I also saw the divided opinions, this one can do two feet or so as configured.

The small likelihood of an attack happening is a given from the original post. I want to play with my key cards and see where and if/how they block for the price of two Starbucks coffees.

Here is the Amazon page for this reader used in the video:https://www.amazon.com/gp/product/B00UX03TLO/ref=ppx_yo_dt_b_asin_title_o02_s00?ie=UTF8&psc=1

Edited February 21, 2023 by RV_

[Ray,IN]

re: the security chip. If you shop at Lowes read the receipt closely and don't throw it in the  trash. Last week I bought an appliance at Lowes's. The receipt had my CC number on it, and the long number of the security chip!

When I first read of preventing CC data from being scanned while in my pocket,  I lined my wallet (trifold) with aluminum foil where folding money is supposed to be placed. It blocks signals just as well as those aluminum wallets advertised on TV.

Derek, that Amazon card reader says it cannot support encrypted HID data. Is that what the small PC board does?

[Kirk W]

14 hours ago, Ray,IN said:

If you shop at Lowes read the receipt closely and don't throw it in the  trash.

I am looking at a receipt from Lowe's that I got about a week ago and I don't see the credit card number. What I did locate is **** **** **** 1234 (not actual). I found the same thing on a receipt from Hobby Lobby and from Walmart. I also checked one from Albertson's and one from Murphy Oil that I used my phone & Apple pay and each of those do have a number on them but it isn't the same number and it isn't the credit card number. Am I looking in the wrong place and just missing it? 

[Ray,IN]

Kirk I  just re-read my Lowes receipt, I was wrong, good catch. MY CC # appears as you say, it does have the entire RFID chip number in plain print though. The RFID chip is supposedly the latest in CC security, yet Lowes printed the number.

[Kirk W]

25 minutes ago, Ray,IN said:

yet Lowes printed the number.

That doesn't matter at all as the number is unique to that transaction and the credit card will reject a second attempt to use it. 

[RV_]

Ray Kirk beat me to it. I got the cards yesterday and will post on FB and if you want I will message you the posts.

[Ray,IN]

So that was a one-time number; thanks Kirk and Derek. That information is relieving to me. Kind of like the DoD number on retired military cards is not real, it merely give the DoD a way to link to my real ID while hiding my true number.

Edited February 24, 2023 by Ray,IN

[RV_]

However don't feel too safe. All they need is your name, birthday, and the last four of your SS, and they can access a lot and work out the rest. So guard that too. We shred all old receipts.

[Ray,IN]

Yes Derek, now some places (government) require my SSN last 6 instead of 4 digits. Call me paranoid, but crooks are everywhere these days. We've worn out 3 shredders in the past 20 years. Now DW has some of those ink black-out rollers for everyday stuff.

[TXiceman]

After seeing some reports on recent car thefts on cars with the RFID key fobs, I got my wife and I the RFID shields for the key fobs.  They are not convenient to use, but they do shield the key fob.

The crooks are getting smarter as the technology gets smarter.  You have to stay a step ahead of them.

The new truck has a catalytic converter as well, so the crooks have something else to steal.  But after picking it up, next stop was to get a Cat-Shield installed.  Also keep my credit cards in an RFID shield and shred anything with out name of address on it.

 

Ken

[RV_]

Ken,

I hear ya! I'd seen those in my research but I did not order a fob for mine but keep a key card in my wallet and my phone is my Fob. Don't want my phone in a Faraday cage! Tech is  moving faster and about to get crazy with AI developments. Now all we need to do is jail the malware developers and users. Bet big DATA and AI can find them soon.