Can credit cards be cloned remotely with an RFID reader?

Question

This news story from "13 Investigates" shows Walt Augustinowicz (an RFID expert, and seller of RFID proof pouches) who has a portable reader than picks up credit card details while they are still in people's wallets and purses.

He also demonstrates copying the cloned information onto a magnetic credit-card, and using it to purchase goods without needing to sign or enter a PIN.

Is it that easy to clone an RFID-based credit card?

Note: Adam Savage reports that when Mythbuster's considered investigating RFID's security, they were warned off by legal counsel for several major credit card organisations.

Answer 1

Without getting too deep into the technology behind credit cards with RFID (which you can find here if you're interested), yes, it is possible to copy the data that credit cards broadcast, but it is unlikely that that information will be useful to a criminal if the card issuer was using modern security methods that are now common practice.

Snopes posted a response to this video in 2012 that contained a pretty good summary by security analysts:

The data streams emitted by contactless cards don't include such information as PINs and CVV (Card Verification Value) security codes — or, in newer cards, customer names — and without those pieces of information a card skimmer should not be able to utilize the stolen card numbers to print up counterfeit cards or engage in Card Not Present (CNP) transactions:

None of the cards transmits the additional number on the front or back, known as the card validation code, that some businesses require for online purchases.

[C]ompany representatives argued [that] the process of making purchases with the cards involves verification procedures based on powerful encryption that make each transaction unique. Most cards, they said, actually transmit a dummy number that does not match the number embossed on the card, and that number can be used only in connection with the verification "token," or a small bit of code, that is encrypted before being sent.

"It's basically useless information," said David Bonalle, vice president and general manager for advanced payments at American Express. "You can't steal that data and just play it back and expect that transaction to work."

(Emphasis mine.)

So the information sent (at least with newer cards) is a signature on the specific transaction, not information on how to sign any future transactions, making it essentially useless to a thief.

Now, of course there is some doubt as to whether this is the method employed by older cards, but it's more likely that these older cards are not being used anymore.

I'm not sure what to think about the Adam Savage video, but given the information above, I don't think you have to worry about it. :)