Traveling abroad nowadays requires more than just watching out for pickpockets; you might not realize that the credit cards and passports you carry are facing an "invisible" threat: RFID skimming. In recent years, many Hong Kong travelers visiting Europe or popular tourist spots have shared experiences of receiving mysterious transaction notifications from their banks despite their credit cards never leaving their possession. Criminals are exploiting vulnerabilities in RFID (Radio Frequency Identification) technology to steal your credit card data remotely without physical contact. How exactly does RFID skimming occur? Do we need to purchase RFID-blocking wallets or RFID-blocking bags? This article provides the answers.
1. What is RFID skimming? A 3-minute guide to understanding the principle of contactless theft
Before choosing anti-theft gear, let’s understand the technology and how criminals abuse it.
How does RFID work? Which cards are at risk of being stolen?
RFID (Radio Frequency Identification) is a contactless identification technology that uses radio waves to transmit data. Most of the contactless cards we use daily, including Octopus cards, passports, and Visa PayWave cards, have built-in RFID chips.
These cards contain microchips and antennas. When brought near a card reader, the electromagnetic field emitted by the reader powers the chip, allowing data to be read.
What is RFID skimming? How do digital thieves perform proximity theft?
RFID skimming refers to criminals using modified handheld RFID readers, the NFC function on smartphones, or mobile POS terminals to get close to your pocket or bag in crowded places (such as subways, airports, or tourist queues).
Without needing any physical contact or to have you take out your card, the skimmer can remotely sense and read the card number, expiration date, and even initiate small contactless transactions. While chip cards currently feature dynamic authentication codes that make it difficult for criminals to clone a physical card directly, obtaining the card number can still lead to fraudulent charges on foreign websites with lax verification.
