11

Evidence against

Does Aluminum Foil Stop Identity Theft?

Some sources say that if you actually have an RFID-enabled credit card, aluminum foil does the same job, if not better, than an expensive RFID-blocking sleeve. Other sources say that aluminum foil does not block RFID, only merely inhibits it, meaning it only prevents reading the information from long distances.

Evidence for

There Are Plenty Of RFID-Blocking Products, But Do You Need Them? : All Tech Considered : NPR

Finally, if you're worried about e-pickpocketing but don't want to spend much money, you can make your own blocking wallet or wrap your cards or passport in a thick piece of aluminum foil. According to Consumer Reports, that works as well as most RFID protectors on the market.

Roger A. Grimes CPA, Bachelor's degree in Accounting from old Dominion University

You can use a myriad of materials that are poor conducts of electromagnetism to block RFID waves — just a few sheets of thick aluminum foil will do the trick. The RFID-blocking vendors will try to overwhelm you with technical terms and specifications, including frequencies and antenna sizes. Aluminum foil works to block them all; you just may need more foil sheets. Do the “official” RFID wallets and other accessories work? Yes and no. Some have been shown to be less reliable than aluminum foil.

Robert Siciliano graduate of Boston University Center for Professional Education Professional Investigation, a Private Investigator, and a Certified Identity Theft Risk Management Specialist.

Those who sell RFID-blocking devices will definitely try to scare you with stories, and they will probably also use a lot of technical information and specs to push their products. This isn’t to say that RFID-products don’t work…many work just fine, but so does aluminum foil. All it takes to protect an RFID device is to wrap it in some aluminum foil.

Do Credit Card Protectors Work?

Those who sell RFID-blocking devices will definitely try to scare you with stories, and they will probably also use a lot of technical information and specs to push their products. This isn’t to say that RFID-products don’t work…many work just fine, but so does aluminum foil. All it takes to protect an RFID device is to wrap it in some aluminum foil.

  • 5
    So what is your question? You give several sources that tell you that aluminum foil will be adequate. And the source you quote that says foil won't do the job also says that Tyvek will, and that's pure BS -- Tyvek is no more effective than Saran Wrap. – Daniel R Hicks Dec 1 '19 at 13:59
  • I think some kind of link to a fuller explanation of skimming and how that is accomplished, technologically, would be helpful. – PoloHoleSet Dec 4 '19 at 15:18
  • 2
    Worth noting that "skimming" generally doesn't refer to RFID capture, but rather a device added to a legitimate card reader. So aluminum foil doesn't work, because you want the card to work. – jdunlop Dec 4 '19 at 21:14
  • 1
    In the third quote, the phrase "poor conducts of electromagnetism" is clearly a mistake. Conductive materials make great EMI shields; they reflect incoming signals rather than allowing them to leak to the other side.. – Ben Voigt Dec 6 '19 at 21:41
12

Yes.

Duo labs (security vendor) says on https://duo.com/decipher/labs-presents-whats-happening-with-rfid-blocking-gear

It turns out standards for testing these RFID-blocking devices actually exists since the government wants to make sure these sleeves and cards actually work before buying them for government employees and contractors. There is an actual approved vendors list that meet FIPS 201 standards and testing details are outlined in Electromagnetically Opaque Sleeve Approval and Test Procedure(version 13.1.0 is the current version as of this writing).

They conducted testing using the standards and testing details in that procedure and the results are:

In the case of the sleeve, the most expensive sleeve didn’t block LF despite being from a FIPS 201-approved vendor, while two cheapest ones blocked both LF and HF. Neither of them were FIPS-201 approved, either. Just for the sake of it, I asked for foil from Chipotle and wrapped up the cards before testing. Turns out foil is good at blocking both LF and HF.

Those of us who work at Defcon either use approved wallets or leave our cards. And we use test gear ourselves... But be aware that in normal environments this is not considered a likely attack, and while RFID reading has been tested at over 60 metres, realistic attack range is under 15cm so the attack is very limited.

  • Have a link for the "over 60 meters" claim? Was it for NFC used in financial transactions, or other RFID implementations (e.g. inventory management)? I would really like to beat my bank over the head with the reference, if applicable. – Ben Voigt Dec 6 '19 at 21:44
  • I'll find the citation - but it was for a read under very specific conditions (card used in transaction at normal merchant service, and remote high gain read antenna) – Rory Alsop Dec 7 '19 at 0:06
  • Ah, in that scenario I guess my preferred use of NFC (phone, fingerprint unlocked first) could also have been exposed. Still much prefer that exposure to the credit card-integrated NFC which is always responsive to queries. – Ben Voigt Dec 8 '19 at 1:52

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .