Short answer: Partly, yes. Many contactless cards will answer a nearby reader, and inexpensive readers and phone apps can pull basic card details from some of them. The catch is distance. Standard readers work from only a couple of inches away, so the risk is highest in tight crowds, not on an open sidewalk.
Key takeaways
- Contactless cards are passive, so they respond to any compatible reader that gets close enough.
- Standard range is very short, and longer ranges generally need specialized equipment.
- On many cards, the card number and expiration date can be read. Modern chip cards also use one-time codes that make a copied transaction hard to replay.
- Close-contact places like transit, elevators, and packed lines are where proximity matters most.
How does a contactless card respond to a reader?
Your card has a small antenna and chip but no battery. When a reader's field reaches it, the card powers up and answers. That is why you can tap to pay without doing anything else. It also means the card does not check whether the reader is a store terminal or something else.
What information can actually be read?
It varies by card and issuer. On many cards, the card number and expiration date can be read wirelessly. Those two details are what online card-not-present fraud often starts with. The security code on the back is not transmitted, and tap-to-pay transactions use unique codes, which limits what a thief can do with a copied tap.
Where is the real risk?
Think about places where a stranger can stand within a few inches of your pocket or bag without it seeming odd: subway cars, concert crowds, airport security lines, elevators, and festival entrances. In those moments you have no way of knowing what is near your wallet.
How do you reduce the risk?
- Keep cards in a front pocket or a zipped bag in crowds.
- Use a blocker so your cards cannot respond to an unexpected reader.
- Check your statements often and turn on transaction alerts.
- Learn the signs of fraud in our guide: How to Tell If You've Been Skimmed.
Frequently asked questions
Is RFID skimming common?
It is far less common than data breaches and phishing, and anyone who tells you otherwise is overselling. The attack is real, though, and blocking it is cheap and takes no effort once your protector is in your wallet.
Can a thief clone my card by reading it?
A tap read generally does not give a thief what is needed to make a working copy of your physical chip card, but exposed card details can be misused in other ways. Prevention is simpler than cleanup.
Does a blocking card stop a reader?
A tested blocker prevents a reader from communicating with the cards near it. SignalVault was independently tested at 13.56 MHz, where a reader could not read the test card with SignalVault placed behind or in front of it. No RFID protection is 100% effective in every scenario.
Cheap insurance for crowded places: the SignalVault RFID Blocking Card Protector (2-Pack) is $20, battery-free, and slides into your current wallet. U.S. orders over $25 ship free.