A Few Tips To Avoid Scams Involving RFID Skimmers

A skimmer scam has now become another thing to be aware of, and to deter. After learning to discern fake calls and emails from CRA,  Amazon, shipping companies, and banks, this is an even more insidious, and invasive trick.

RFID tracking has been used legitimately in businesses for years. It is used for inventory management, asset tracking, and security.

For inventory, it allows businesses to track the location, and movement of inventory in real time thus reducing time, labour, and errors. It is especially useful in retail, so they know when stock levels are low on certain products.

For asset tracking, RFID tags can be attached to valuable assets, tools, equipment, and even vehicles. This helps protect against theft, misplacement, and disorganization.

When it comes to security, RFID chips can be embedded into employee access badges, if there is sufficient reason to restrict and monitor access to a building.

Supply chain management has used this technology to track products from manufacturing, to shipping, movement, and purchases of  inventory throughout the system. It is also used in healthcare, and pharmaceuticals to track medications, and patient records.

As with all things that are useful, and help to organize complex systems, there can also be ways the technology is exploited. There is a whole new genre of high tech crooks, taking advantage of this type of technology.

The scam is carried out through RFID skimming, using a card reader. All they have to do is get close to you, and they can read information off your credit and debit cards. Both credit and debit cards now have embedded microchips. The contactless payment, or tap feature on a debit card, is what makes it most vulnerable to RFID skimming.

Radio frequency identification (RFID) involves the use of radio waves to read and capture information on embedded computer chips. Thieves can use small portable readers, to capture the information from the embedded computer chips without the victim knowing, and without them taking the card out of their wallet.

This information can then be used to make online purchases, or to make counterfeit cards. Some sources claim the risk is overstated because the criminal has to get close to the card, and apparently the information is encrypted to make it more difficult to read.

People are told to avoid crowds, public transport, and areas where there is a likelihood of card skimming. It is also worth noting that not all cards have RFID technology. The older cards with the magnetic stripe are less vulnerable.

This has brought another consumer product for specialized wallets that supposedly prevent the skimming. However, if the wallets are made of plastic, or polymers, they are not likely to be effective.

Leather wallets do not prevent RFID skimming, unless they are lined with foil, or have copper infused fabrics, or carbon fibre sheets. A quick check on Amazon shows RFID wallets ranging from $12-$60.

For RFID protection, you need metal. Whether you decide to wrap your cards with aluminum foil, or buy a special wallet, it is the metal that blocks radio waves. Metal is a good conductor of electricity, and will reflect or absorb the radio waves, preventing them from having access to your cards.

Metal is not 100% safe, depending on the power of the RFID reader, the proximity to your wallet, as well as the thickness of the metal surrounding your cards.

An idea is to use one or two metal business card holders for your cards, depending on how many cards you carry. They are small, compact, cheap, easy to open and close, and each one easily holds four cards. I have used one for years, and still have the same one.

The other tip is to put the card holder in a location on your person, not in a handbag. If you put it in a non-traditional location, the RFID reader may miss it. An inside breast pocket, or a small waist bag for the card holder, are not as typical places for wallets to be carried, compared to handbags for women, and back pockets for men.

Although there are claims this method of skimming and scamming is overstated, we can be sure that if it is possible, and already being done, it will only get more sophisticated, not less. I have heard many people talk about having this happen, without them knowing about it.

One woman in BC said their credit card was read, and then used for multiple purchases in Toronto. She and her husband believed it happened when her husband was travelling in BC. Neither one of them had been to Toronto, and were shocked to see all the charges from Toronto, to include multiple Uber and taxi rides.

During this conversation, several other women talked about similar incidents. This was just a random conversation in a local store, so it became clear to me that credit card information was somehow being intercepted without the person’s awareness.

Fortunately the use of metal, or special wallets is a fairly simple protection. The main thing to take note of is that not all wallets being sold, are effective.

In the meantime, we will have to check periodically to see if some mastermind develops an RFID reader that can penetrate metal. 

This article was originally written in June. It is now December, and it appears the RFID skimmers are becoming stronger, and more prevalent. Apparently many of the wallets, and/or aluminum foil is not always adequate, because the RFID skimmers can be cranked up.

Many of the wallet sales claim to protect the cards, but for the most part they have not been tested. On Reddit various people have tested their cards inside the protective wallets, and found them to be ineffective.

You may read about faraday cages, which is named after Michael Faraday, the scientist who invented the technology in 1836. Faraday cages work on the principle of electrostatic induction. They are made of a conductive material that blocks the electromagnetic fields by distributing the electrical charges around the exterior. The electrons end up being redistributed, thus cancelling each other and protecting the interior. 

There are many types of faraday cages, to include microwave ovens, the shielding on electronic cables, and various types of boxes, key fob holders, laptop bags, and wallets. A quick look on Amazon shows a wide variety of sizes, and uses for this technology.  

Since crooks use RFID skimmers to read key fobs as well, so they can steal cars that have a keyless entry – a faraday cage key holder is probably a very good idea. 

I suppose we all have to do a risk evaluation, and determine what kind of best practices we can implement to protect keys, gates, cards, and the devices we use on a daily basis. When I first learned about this, I did not realize the RFID skimmers could target passports, driver’s licenses, and transit cards as well.

Apparently criminals can quickly install RFID skimmers on ATM machines, and even self check-outs. It is advisable to use ATM’s during times the bank is open. 

Without becoming totally paranoid, and depending on where you live, this is a topic to be aware of, and take measures to protect ourselves.

Just a decade ago, we did not see that many phishing scams. We might get targeted once in six months. Now we are getting phishing emails, phone calls, and text messages on a daily basis. As criminal technology becomes more sophisticated, we can expect to be subjected to more scams. 

Keep a close eye on all of your accounts. Never respond to unsolicited texts, emails, or phone calls. When dealing with accounts, always be sure to be the one who is initiating the contact or login. Keep in mind, if someone is contacting you, they want something from you. When it comes to accounts and personal information, we are the ones who control what we do with our own information, not someone else. Once again, it is all about boundaries. 

Don’t respond to enquiries or random job offers, or online surveys. After awhile you will notice patterns. A year or so ago, there were frequent CRA scam attempts. A few months ago, it was Amazon. Just this past week or so, I have been getting texts with remote job offers showing the Indeed logo. The text tells you to press Yes if interested. Even if you are interested in a remote job offer, do not respond. Go to a legitimate job posting site, and see what is there. Organizations do not usually send job offers to random people who are not looking for a job. 

The risk of being scammed is increasing, so vigilance must also increase. It is like those trollers are out fishing, and they are doing what they can to bait, and hook us. I hope they get caught.