Science Buddies: "Ask an Expert"

Dear Expert,

Thank you for the great resource at Science Buddies. It is a great help for students. I am doing a project about how RFID scanners can pickpocket credit card numbers. What I know so far about RFID is that RFID communication works when a reader can communicate with a RFID tag, thus causing many card numbers to be stolen. As far as I know, the type of tag in the new credit cards is a passive tag (one that is not battery powered). What I want to find out is what kind of reader reads a credit card? Is it a Low frequency scanner, High frequency scanner, or an Ultra High frequency scanner? In addition, do the frequencies of the card and the reader have to be the same for them to communicate? My abstract (which is below) is a basic version of the project, I am actually going to have a few more variables so my data is accurate.

RFID scanners can be used for many things, such as paying for transportation, entering an office building or even paying for a toll road. But, some people use RFID scanners for identity theft or stealing your card numbers. Recent cards by major credit card carriers made cards that have RFID chips inbuilt in them. They are called “contactless credit cards”. Contactless credit cards don’t require a swipe in the card machine to pay. You only have to put the card near the machine to purchase items. This is the wonder of NFC, otherwise known as Near Field Communication. Two devices near each other can communicate with each other and can take certain information. NFC is also what causes the communication between the reader and the tag. This is the process in which a thief can take your credit card number. In my project, I will show you what materials are best to use to shield your credit cards from thieves. My hypothesis is that all metal will effectively block the RFID scanners from reading your information. For my project, I bought an RFID kit that included three tags and the reader itself. The reader and the tag is a simulation of what happens in reality. I then placed certain materials in between the tag and the reader. Our test materials are: Cotton, Leather, Plastic, Cardboard, Aluminum Foil, and a Steel Pan. The thickness will be changed and recorded as well. The reader can read through Cotton, Leather, Plastic, and Cardboard. Wallets are made of leather and your pants are made of cloth. This indicates that an RFID scanner can easily scan your credit card numbers. The only materials that the RFID scanner cannot scan through were aluminum foil and a steel pan. The best one over all was aluminum foil because even a thin sheet blocked the scanner from reading. What I suggest as a solution is that you should outline you wallet with aluminum or you can line your contactless credit cards with aluminum foil so readers can’t scan your credit card. Is it better to spend $25 - $75 to get something branded when you can spend a dollar and get the same safety?

Sincerely,
Safiullah Rifai

Safiullah-

Thank you for your question. RFID itself is a big subject and security issues related to it make it even a bigger project. The Science Buddies project clearly got you thinking about the bigger picture; whether it's worth the convenience for the possible exposure of your confidential information. Unlike the little hobby reader and tags you bought, the systems used by the credit card companies are much more sophisticated and not as easily fooled. But still, whether to carry one of these cards or not is a question.

You will need to study the differences between the various types of RFID systems a little more, and particularly the difference between RFID and NFC (they are not interchangeable terms). I'm sure you realize that the tests you ran with your little Parallax reader may or may not be fully valid with the different frequencies used in credit cards. As you noted, it's a demonstration. You can't easily purchase a system that can read a credit card.

Your abstract suggests that you understand the topic and I'll wager that you did a good thorough job in your testing. I'd suggest that if you can find some copper foil or copper tape, that would be a good material to test as well. I like that you included leather and cloth - showing that these materials do nothing to shield cards is an important part of the story.

Thank you for the kind words about Science Buddies. Students like you are why we do this. If you have any specific questions we can help with on your project, fire away. Your abstract looks solid and i think you're well on your way to a good showing at the fair. Best of luck to you!

Howard

P.S. Even though I'm a factory-trained consultant on ThingMagic RFID equipment (or was a little ways back), I'm not a fan of the credit cards. I like magnetic stripes. What people will sometimes do if they want to use their credit cards in mag stripe readers only, is to locate the RFID chip (it's a little bump in the middle of the card), place the head of a nail on the bump and whack it with a hammer to smash the chip. The card still works fine, but not with RFID. It's totally and completely safe from bad guys with portable RFID equipment. Other uses are really good though. I have a reader in my basement that can pick off a passive warehouse palette tag from 100 feet away. I tied it into the garage door opener and put a tag in my car. When I enter the driveway, the door can open automatically and close when I leave. It's rather fun, but most people don't have warehouse RFID equipment hanging about to play with.