4 RFID Security Myths You Need To Stop Believing

Radio Frequency Identification (RFID) technology was first patented in the 1980s and has made things possible that would have seemed like science-fiction back then. It permeates many aspects of our lives, enabling contactless card payments, helping businesses track their inventory, and allowing lost pets to be identified. However, despite being widely-used for several decades, there are still many pervasive myths and misunderstandings around RFID's security.

Unless you know how it works, RFID may as well be magic. There are two main types of RFID tag. The first has its own power source, allowing it to broadcast data over extremely long distances, which is called "active" RFID. The second, "passive" RFID, gets its power from an RFID reader. When you tap to pay, for example, the terminal creates a tiny electromagnetic current, allowing your card details to be read.

Some of the security concerns surrounding RFID may have originated as a result of assuming all devices can be read from long distances. With that in mind, let's put the most-common misconceptions to rest.

People have been worried about RFID theft (stealing information stored on a passport, credit card, or other RFID-enabled device) for as long as this technology has been in use. While this type of theft is possible, there are several functional limitations that make it difficult, time-consuming, and not particularly cost-effective for criminals.

Credit and debit cards use passive RFID and inductive coupling, meaning they're only capable of short-range communication. This is typically a few inches, with specialized equipment extending the range up to nearly 18 inches. In other words, a criminal has to get close to you, identify where the card is kept, and hope it supports NFC. Even then, skimming success rates are reduced by RFID-blocking wallets, thick clothing, or carrying metallic items like keys in the same pocket.

This isn't to say skimming doesn't happen, because it does. However, any reports of credit cards being cloned from several feet away are fictitious. It's just much more efficient to attach a card skimmer to an ATM machine than to target people individually. The problem is actually so widespread that retailers like Costco reduce the chance of card-skimming by employing human fuel attendants.

The idea of encasing something in metal to block unwanted signals isn't new: In 1836, a scientist named Michael Faraday invented the Faraday cage, a metal mesh designed for this exact purpose. With aluminum foil being cheap, pliable, and readily-available, it's a natural choice for anyone hoping to recreate this experiment on a smaller scale. That said, while aluminum can block some RFID signals, it's not a reliable solution. Further, lining your bag with foil could land you in hot water with loss-prevention employees, since shoplifters often use the same tactic in the hopes of beating electronic security tagging systems.

So why exactly can't aluminum foil be trusted? To block both high-frequency and ultra high frequency RFID signals reliably, you'd have to ensure total coverage, ideally with several layers of foil. Any small gap or tear would render the whole activity pointless, which is an issue given tinfoil isn't meant to be repeatedly wrapped and unwrapped. A longer-term solution would be to pick up a wallet that blocks RFID signals: these are more durable, require less work, and as an added bonus, you can take them anywhere (even the airport) without raising any eyebrows.

Most modern RFID devices are actually quite resistant to interference. For instance, when you tap your card to pay for something, the data sent from your card to the payment terminal is encrypted, rendering it unreadable to anyone monitoring radio traffic. An attacker could theoretically see your card details if they could crack the encryption, but they'd better clear their schedule since it'd take millions of years to brute force a single 128-bit AES key.

With this in mind, it's actually easier to compromise the RFID implementation instead of the device. Rather than trying to decrypt a signal, an attacker could use a device like a Flipper Zero to replicate the encrypted signal entirely. These devices aren't cheap, require a fair bit of technical know-how, and wouldn't work for payments since the signal is different every time but it's entirely possible to create your own key fob for accessing a building. That's why when RFID is used in sensitive applications, there should always be a secondary identity-verification method. Instead of relying exclusively on a key fob, you could employ facial recognition checks, a PIN code, or have someone at the front desk manually verify access eligibility.

When RFID was first gaining traction, just like with 5G, there were conspiracy theories about how governments would use it to track their citizens. Decades later, RFID technology is primarily used to monitor shipments and stock, not people. There are exceptions, of course: Some hospitals use RFID-enabled wristbands to track the movements of patients, and your passport's embedded chip does keep a record of your travel history.

There are perfectly innocent reasons for doing this, though. Hospitals have a duty of care over their patients and need to know where they are. Likewise, countries have to know who is coming and going. Using RFID doesn't materially weaken your privacy in these situations, since your whereabouts can already be tracked via CCTV, or even which Wi-Fi network you're connected to. Rather, these RFID implementations exist to save time, improve efficiency, and keep you safe.

What about unauthorized access? Organizations face steep fines if sensitive data is breached, often costing them hundreds of thousands of dollars. It doesn't matter whether it was stolen via RFID, the internet, or in-person: if your data was improperly handled or inadequately protected, the company that lost it is in serious trouble. Rest assured that careful consideration is given to what information is collected and how it is stored.