Return to story

Security of RFID credit cards is worrisome

November 4, 2006 12:53 am

By MICHAEL ZITZ

It's already a major trend in Japan--and a growing one in America.

A harried mother hops out of her vehicle. As the kids scream louder and louder inside her minivan, she fills the tank, counting the moments.

Then, instead of taking the extra step and additional 30 seconds to slide her credit card in and out of the scanner, Mom simply waves it in front of the pump. She hops back behind the wheel, tells the kids to settle down and drives away.

Radio-frequency identification (RFID), or "contactless" technology--which transmits digital information minuscule distances--certainly is convenient. It's definitely a time-saver. And it's cool.

A tiny chip transmits a signal to reader devices.

It's being used on credit cards, on passports, on airline baggage. Big cities such as New York have been testing public transport contactless ticketing systems. Stores are using it to keep track of stock. There are even plans to put RFID tags in clothes that will communicate with washing machines, telling them whether to use hot water or cold.

But as more and more less-than-tech-savvy credit card users are waving instead of sliding, techno-geeks and libertarians are on edge.

They say a small, simple, $200 device can be used to intercept personal data transmitted by the cards--even while that minivan mom has the card in her purse several feet away.

Industry insiders say such concerns are overblown. But as American companies become more committed to RFID, they're working to make the technology more secure to head off potential consumer resistance.

There's enough anxiety that a company in Tokyo is making colorful "Hello Kitty" credit card cozies that are touted to protect cards from "skimming," a term for using devices to steal information.

Another company is working on "blocker tags," which can be carried in handbags or watches to disrupt the transmission of information just enough to prevent illicit scanning devices from surreptitiously collecting data.

But safeguards are already built in on both ends of the system, according to Jonathan Collins, an RFID/contactless industry analyst in the London office of ABI Research, a New York-based group that studies global technology trends.

During a telephone interview from Britain yesterday, Collins told The Free Lance-Star that RFID generally transmits information only about 10 centimeters, or 4 inches.

And he said "environmental factors" like metal and glass and water deflect and diffuse the signals in such a way that it would be difficult to efficiently intercept them in the way some fret about.

"It's short-range," he said. "There are definite limits."

Growth of the contactless industry is so rapid, according to ABI, that 556 million tiny RFID "tags" were used in 2005--mostly for credit cards and passports.

Sara Shah, an ABI analyst in New York, reported that American credit card companies "are becoming more bullish about contactless payment." They're introducing the technology to customers through media campaigns, trials and new contactless-card distribution, she said.

Collins said credit card companies already have their antennae up--so to speak--against RFID theft, adding new layers to "traditional back-end systems" that monitor card use and raise flags when use strays from charges typical of the customer.

Still, he admitted, a precautionary Hello Kitty credit card cozy couldn't hurt.

To reach MICHAEL ZITZ: 540/374-5408
Email: mikez@freelancestar.com





Copyright 2009 The Free Lance-Star Publishing Company.