Testing RFID blocking cards: Do they work? Do you need one?

Flipper Zero worn on wrist with readout saying Debit Mastercard

The Flipper Zero reading the Apple Pay NFC signal from my Apple Watch Ultra.

Adrian Kingsley-Hughes/ZDNET

RFID is everywhere, even packed into your credit and debit cards, allowing the information to be read in a “contactless” fashion.

Concerns that cards could be read covertly have generated a massive industry of security devices designed to block or somehow interfere with this contactless reading of the cards. 

You can find wallets, purses, and card protectors designed to prevent your cards from being read stealthily.

But do these security devices work?

Well, I have a Flipper Zero, and this amazing device can read NFC.

FAQ: Flipper Zero: ‘Can you really hack Wi-Fi networks?’ and other questions answered

So, let’s try it out.

What I’m using it to test out here are Vulkit RFID blocking cards, which are designed to protect credit cards, debit cards, and ID cards using 13.56MHz-frequency RFID from unauthorized scanning.

The blocking card looks like any other credit or debit card, and doesn’t need any charging or anything. All you need to do is pop it into your wallet or purse, and it’s supposed to block RFID reading.

A black card with a logo of a lock in a shield and the words Your Personal Information

The Vulkit RFID blocking card looks like any other credit, debit, or ID card.

Adrian Kingsley-Hughes/ZDNET

But does it work?

First I fired up the Flipper Zero, and tested an unprotected debit card. It read the data (see the picture below).

Also: How to unlock the Flipper Zero’s true power

Note that while the Flipper Zero can read NFC cards, it cannot decode the card’s encrypted security code, also known as CSC, CVV, CVC, CAV, and a bunch of other three-letter abbreviations.  

Flipper Zero readout giving type of credit card and currency

The Flipper Zero can read the unencrypted data on a debit card.

Adrian Kingsley-Hughes/ZDNET

OK, now let’s add the blocking card to the equation.

Flipper Zero readout saying "Apply Card to Flipper's Back"

The Vulkit RFID blocking card does indeed block the RFID signal.

Adrian Kingsley-Hughes/ZDNET

Yup, it blocked the reader. The Flipper couldn’t read anything from it.  

What if the blocking card is behind the target card — meaning it isn’t a physical barrier between the credit card and the reader?

Flipper Zero with blocked readout, on top of credit card on top of Vulkit card.

The Vulkit RFID blocking card works even if it is behind the target card.

Adrian Kingsley-Hughes/ZDNET

Yup, it even blocked that. 

So, does Vulkit’s blocking card work? 

Yes. It’s very effective.

Do you need one?

It depends. 

The Vulkit RFID blocking card certainly adds a layer of security between you and someone wanting to access your data. For example, I’ve seen hotel safes that can be locked and unlocked using credit or debit cards, and a Flipper Zero could be used to clone the card and unlock the safe. 

So, while I think the chance of someone reading your card and using it for bad things is small, these cards cost about $4 each, which means they’re cheap and easy-to-use insurance against such attacks. 

READ MORE HERE