Does aluminum foil safeguard your credit card from RFID attacks?

Question

Evidence against

Does Aluminum Foil Stop Identity Theft?

Some sources say that if you actually have an RFID-enabled credit card, aluminum foil does the same job, if not better, than an expensive RFID-blocking sleeve. Other sources say that aluminum foil does not block RFID, only merely inhibits it, meaning it only prevents reading the information from long distances.

Evidence for

There Are Plenty Of RFID-Blocking Products, But Do You Need Them? : All Tech Considered : NPR

Finally, if you're worried about e-pickpocketing but don't want to spend much money, you can make your own blocking wallet or wrap your cards or passport in a thick piece of aluminum foil. According to Consumer Reports, that works as well as most RFID protectors on the market.

Roger A. Grimes CPA, Bachelor's degree in Accounting from old Dominion University

You can use a myriad of materials that are poor conducts of electromagnetism to block RFID waves — just a few sheets of thick aluminum foil will do the trick. The RFID-blocking vendors will try to overwhelm you with technical terms and specifications, including frequencies and antenna sizes. Aluminum foil works to block them all; you just may need more foil sheets. Do the “official” RFID wallets and other accessories work? Yes and no. Some have been shown to be less reliable than aluminum foil.

Robert Siciliano graduate of Boston University Center for Professional Education Professional Investigation, a Private Investigator, and a Certified Identity Theft Risk Management Specialist.

Those who sell RFID-blocking devices will definitely try to scare you with stories, and they will probably also use a lot of technical information and specs to push their products. This isn’t to say that RFID-products don’t work…many work just fine, but so does aluminum foil. All it takes to protect an RFID device is to wrap it in some aluminum foil.

Do Credit Card Protectors Work?

Those who sell RFID-blocking devices will definitely try to scare you with stories, and they will probably also use a lot of technical information and specs to push their products. This isn’t to say that RFID-products don’t work…many work just fine, but so does aluminum foil. All it takes to protect an RFID device is to wrap it in some aluminum foil.

Answer 1

Yes.

Duo labs (security vendor) says on https://duo.com/decipher/labs-presents-whats-happening-with-rfid-blocking-gear

It turns out standards for testing these RFID-blocking devices actually exists since the government wants to make sure these sleeves and cards actually work before buying them for government employees and contractors. There is an actual approved vendors list that meet FIPS 201 standards and testing details are outlined in Electromagnetically Opaque Sleeve Approval and Test Procedure(version 13.1.0 is the current version as of this writing).

They conducted testing using the standards and testing details in that procedure and the results are:

In the case of the sleeve, the most expensive sleeve didn’t block LF despite being from a FIPS 201-approved vendor, while two cheapest ones blocked both LF and HF. Neither of them were FIPS-201 approved, either. Just for the sake of it, I asked for foil from Chipotle and wrapped up the cards before testing. Turns out foil is good at blocking both LF and HF.

Those of us who work at Defcon either use approved wallets or leave our cards. And we use test gear ourselves... But be aware that in normal environments this is not considered a likely attack, and while RFID reading has been tested at over 60 metres, realistic attack range is under 15cm so the attack is very limited.