What Is Credit Card Skimming, and Do I Need an RFID-Blocking Wallet?
A magnetic-stripe skimmer and someone trying to read a contactless card are different problems. I had been lumping them together under “skimming,” and assuming I probably needed a special wallet.
I live in Japan, where I mostly see people tap their cards or insert them into chip readers. If chip cards are supposed to be safer, what exactly would an anti-skimming wallet be protecting me from?
What does a credit card skimmer actually steal?
Traditional skimming targets the magnetic stripe: the band on the card that a swipe reader reads.
It stores fixed card data, including details such as the account number and expiration date. A hidden reader can capture that data when the card passes through it. Criminals may then use the stolen information to make counterfeit magnetic-stripe cards.
The FBI describes skimmers installed on ATMs, payment terminals, and fuel pumps, sometimes accompanied by equipment that captures PINs.
Whether stolen information can be used depends on the transaction, issuer, and payment system. There isn’t a worldwide rule that small purchases work with stolen stripe data while large purchases always require a PIN.
Why are chip cards harder to copy?
I find it useful to separate three things on a physical card:
- Details printed or embossed on the surface.
- Fixed data stored in the magnetic stripe.
- The chip, which can perform cryptographic operations during a payment.
The chip does more than store a digital copy of the printing. It helps generate a transaction-specific security code. EMVCo explains this feature for contactless chip payments.
Copying readable card details doesn’t give someone the ability to produce all the valid cryptographic responses of the original chip. That’s a much stronger defense against counterfeiting than a reusable stripe.
However, harder to clone doesn’t mean impossible to misuse. A genuine stolen card may still work, and card details stolen elsewhere can create problems for online payments. Those are different risks.
Can someone skim a contactless card through my wallet?
The curved lines on a contactless card look vaguely like Wi-Fi. They indicate that the card can communicate with a compatible reader nearby.
Short-range communication helps, but I wouldn’t use one exact distance as a promise of safety. The more useful question is: what could someone do with the information they obtained?
Contactless EMV payments also use transaction-specific security codes. Reading some information is different from creating a working clone or successfully authorizing another transaction. Visa’s contactless explanation also distinguishes readable information from sensitive authentication data.
That doesn’t make every possible contactless attack irrelevant. It does mean that imagining someone casually photocopying my entire payment card over the air is a poor model of how it works.
What does an RFID-blocking wallet protect against?
RFID-blocking wallets and sleeves are intended to shield compatible cards from radio-frequency communication. For payment cards, that concerns the contactless interface.
They don’t stop a magnetic-stripe reader once I remove the card and swipe it. They also don’t protect a card number I type into a fake website.
So buying one may address a particular concern, but it doesn’t cover everything sold under the word “skimming.” Any shielding also depends on the product and how the card is enclosed.
Why do cards still have magnetic stripes?
Some Japanese cards hide their numbers from view. I own one, and I like that someone behind me in a checkout queue can’t simply read the number from its face. The information is still available through the issuer’s services; it hasn’t ceased to exist.
The magnetic stripe has survived for compatibility with older payment infrastructure, and the transition varies by market.
It would be wrong to say that all cards still need one. Mastercard announced that stripes would no longer be required on newly issued cards in most markets from 2024, with a planned phaseout by 2033 for its credit and debit cards. That is Mastercard’s roadmap, rather than a deadline for every card network.
My own cards still have stripes. Which made me wonder whether I needed to carry quite so many of them.
Could I leave more of the physical cards at home?
A card without a card sounds like a riddle. But digital and virtual cards make more sense when I think of the plastic as one way to access an account.
I once wanted to buy something from an unfamiliar overseas shop and felt uneasy about entering my main credit card details. I used a virtual card from Sumitomo Mitsui, a Japanese issuer, for that purchase instead.
That was my experience with a particular product, rather than a guarantee that every virtual card is disposable or has a low limit. Online virtual cards and cards provisioned into a mobile wallet also aren’t interchangeable terms; their features depend on the issuer.
Mobile wallets can reduce how often I hand over or insert a physical card. For example, Apple explains that Apple Pay uses a Device Account Number and transaction-specific security codes. Payments normally require authentication, with exceptions such as Express Mode. I shouldn’t assume every phone payment always requires an unlock.
What would I do before buying an anti-skimming wallet?
After looking into this, I don’t want “buy a special wallet” to be my entire security plan.
For my everyday use, these steps make more sense:
- Carry fewer physical cards and use a supported mobile wallet where convenient.
- Avoid suspicious or visibly altered readers, and shield PIN entry.
- Check transactions and report unfamiliar charges or a lost card promptly.
- Open the issuer’s app or website directly when a message asks for card details.
A shielding sleeve is still an option if I want to block contactless communication while a card is stored. I would treat it as an optional extra for that purpose. The product link below searches for the Japanese sleeve listed in the original article.
Meanwhile, a chip or a sleeve does nothing to stop me from voluntarily entering my details on a convincing fake page. The FBI’s phishing guidance describes exactly that trick. Payment data can also be stolen through compromised checkout pages, sometimes called e-skimming.
I started out vaguely worrying about someone reading my wallet. Now I have a clearer idea of which problem each precaution addresses—and why the websites and messages I trust deserve attention too.
This whole detour began with another question: why had I stopped signing for credit card purchases in Japan?
