Are RFID Chips a Personal Security Risk?

Now that RFID (radio frequency identification) chips are becoming more common, travelers are worried about the threat they pose to personal information security. One reader recently asked about the issue this way:

“I have heard lately that thieves can steal your identity in airports and other public places by somehow zoning in on the RFID tags imbedded in passports and credit cards. Some catalogs are offering special wallets to shield RF data from thieves. I’m leaving soon for a trip to Europe. Do you recommend any special measures or special wallets?”

The short answer: The experts in the field don’t seem to have a single viewpoint. If you’re wary, err on the side of caution.

RFID—What Is it?

RFID chips enable sensors to “read” information contained in the chip’s memory at a distance of several feet. When attached to cartons, those chips are finding increasing use in tracking goods through the distribution process and maintaining accurate warehouse inventories. Airlines are starting to use them in baggage tags to help speed the sorting and forwarding process. Employers are using RFID-equipped ID cards to expedite employee check-in and exits from their premises. And some transit systems are using RFID encoded fare cards to speed commuters through entrance doors and gates.

Varying Technologies

Not all RFID systems are created equal; they use varying radio frequencies in different ways, and some are more vulnerable than others:

• Some systems employ a technology that permits reading at only a short distance—a few inches. Reading devices are generally obvious.
• Other systems, however, permit readings at distances of at least 20 feet, allowing someone to read a chip unobtrusively and completely unbeknownst to the person carrying the chip.

As far as I can tell, even now, nobody is sure the extent to which various types of shielding can completely protect documents with chips.

Hackers Vs. the System

In electronics, technology generally moves very quickly, and the ongoing struggle between data protectors and hackers will undoubtedly apply to RFID chips in passports and credit cards as well as in such current battlefields as audio and video encoding. No matter where the balance is now, you can bet that hackers will ultimately breach each security innovation, which, in turn, will trigger another round of improvements and still more hacks.

Travel Smarter! Sign up for our free newsletter.

By proceeding, you agree to our Privacy Policy and Terms of Use.

Sign Up

Overall Consumer Risks

The general public risk from RFID chips is that someone other than legitimate users can obtain and use systems that read RFID-equipped cards and documents at a distance, as well as to hack into the chips and alter the information in memory.

As long as RFID chips contain no personal information, any security risk to consumers is low. Transit systems may have to worry about people who hack the system and use fake cards for “free” transit rides, but that’s not a problem for individuals.

Credit card data and personal passport information, on the other hand, pose a serious risk. Both types of document contain personal information that someone could use to track a traveler’s movements or even for identity or monetary theft.

Travelers’ Risks

Travelers’ concerns center on use of RFID chips for several important documents:

• New U.S. [[Passports | passports]] contain RFID chips embedded in a cover. Although passports contain potentially valuable personal information, they use a short-range system, data are encoded, and the passport covers include shielding.
• The new State Department passport cards for travel to Canada, Mexico, and the Caribbean also include a chip. They contain less personal information than a full passport, but they use a long-range system that is potentially vulnerable. To counter possible threats, the State Department issues protective shields with the cards.
• The nationally standard driver’s licenses that are starting to appear use the same technology as the passport cards.
• Some credit cards now contain RFID chips. I’ve written before that use of such “smart” cards is now common in Europe, but, as far as I know, a few American Express cards are the only ones issued by a U.S. institution so far.

What Should Travelers Do?

Given today’s uncertainties, I suggest that you take the State Department’s word that standard passports have adequate protection. However, a passport card should probably have some sort of protective shield.

To date, very few Americans carry “smart” credit cards, and our usual “dumb” cards aren’t vulnerable. However, if you carry one of the few smart cards, I suggest you err on the side of caution by using some sort of shielding case.