What Is RFID Skimming, and Should You Worry?

RFID skimming is the reason RFID-blocking wallets exist. It is also one of the most oversold threats in consumer security — a real technical possibility that has not turned into a common way people lose money.

Here is what it actually is, what a thief can and cannot do with it, and where your attention is better spent.

What skimming means

Your contactless card has a chip and a small antenna inside. It has no battery. It only wakes up when a reader's electromagnetic field powers it — which is why you have to hold it within a few centimeters of a terminal.

RFID skimming is the idea of carrying a hidden reader, getting close enough to someone's pocket or bag to power their card, and capturing what it sends back.

What the card actually gives up

Less than most people assume. A contactless tap sends the card number, the expiry date, and a one-time cryptographic code generated for that single transaction.

It does not send your name, your billing address, your PIN, or the CVV printed on the back. And because the code is single-use, a captured tap is difficult to replay — the same code will not authorize a second transaction.

Why it stays rare

Two things limit it, and both are stubborn.

Range. Standard readers work at a few centimeters. An attacker with amplified equipment can extend that, but not across a room — and the bigger the equipment, the more conspicuous they are. In practice a skimmer has to get a reader almost touching you, in a crowd, without being noticed.

What the data buys. With a number and an expiry but no CVV, no billing ZIP and no replayable code, most online checkouts will decline. Banks also flag the pattern that follows a skim — a small test charge, then a larger one — and reverse it.

Set against that: card details stolen in bulk from hacked websites, or handed over to a convincing phishing text, come with everything needed to use them. That is where the volume of card fraud actually comes from, and no wallet in the world protects against it.

Where contactless fraud does happen

Two variants are worth knowing, because neither is what the ads describe.

A stolen card, tapped. Someone who has your physical card can tap it under the contactless limit repeatedly until the card asks for a PIN. This is mundane and far more common than remote skimming. The defense is noticing quickly and freezing the card in your banking app.

Tampered terminals. A compromised payment terminal or ATM captures details during a real transaction. A wallet lining does nothing here, because you took the card out to pay.

So is a blocking wallet worth having?

Our honest position: yes, as a property of a wallet you were going to buy anyway — not as the reason you buy one.

A lining costs very little to build in, covers every card automatically as long as the wallet is closed, and needs nothing from you. A separate sleeve for each card also works, but most people stop using them within a fortnight, which makes them worthless in practice.

What we would not do is pay a large premium for blocking, or treat it as meaningful protection against card fraud generally. It closes one narrow door.

Every Larkville wallet has the lining built into the card slots for exactly that reason. There is a fuller answer on how the blocking works, and how to test yours, in this guide.

One thing to know before you buy

A lining that blocks bank cards at 13.56 MHz will usually also block hotel keys, transit cards and office access fobs sitting in the same slots. That can be genuinely inconvenient — your building pass may need to come out of the wallet to work. Worth knowing in advance rather than discovering at the door.

What actually protects your money

If the goal is fewer fraudulent charges rather than a specific gadget:

• Turn on instant transaction alerts in your banking app. Speed matters more than prevention.
• Use your phone's wallet where you can — it tokenizes the card number and needs your face or fingerprint.
• Check statements monthly. Small test charges usually come before large ones.
• Freeze a card the moment it goes missing; most apps do it in two taps.
• Treat unexpected texts about deliveries and bank problems as phishing until proven otherwise.

Those five do more for your account than any lining. The lining is a sensible extra, not a strategy.