'Magic wand' can pick your pocket of credit card info

'Magic wand' can pick your pocket of credit card info »Play Video
A card reader can be hidden in a small case. Scammers can then wave it within four inches of a person's wallet or purse and capture credit card or ATM numbers.

PORTLAND, Ore. – A crook using equipment bought online for $20 can easily steal your credit card or ATM numbers without the cards ever leaving your pocket.

RFID stands for “Radio Frequency Identification.” It’s a chip embedded in new credit and ATM cards that allows you to make a purchase by simply waving your card past a reader. It’s supposed to be quick and easy. But KATU Problem Solvers found it’s way too easy for a scammer to steal your number and then rack up purchases in your name.

Walt Augustinowicz, a security expert, demonstrated at the airport how scammers can rip off your card number by concealing a reader in a tablet or iPad case and waving it near back pockets or backpacks of travelers. His device was turned off for the demonstration, but when it’s turned on, it can pick up a person’s credit card number and the expiration date if it’s held just four inches from a wallet or purse.

With permission from purse and wallet owners, Augustinowicz and the KATU Problem Solvers, scanned dozens of wallets and purses at the airport looking for cards with RFID technology.

They found cards with RFID in about 50 percent of the wallets they tested. Owners were shocked and angered that their credit card information could be “magically” snatched from them.

How do you know if you’re at risk? First, you can look for the sign (at right) on the back of your card. If you see it, you definitely have RFID.

But the technology is also in cards that go by the following names: American Express – Express Pass, Chase Blink, Discover Zip, Mastercard Pay Pass and Visa Pay Wave.

You may not yet have a card with RFID technology “but in two to three years, you’re gonna,” said Augustinowicz. “You see, the thing is in two to three years, every card is using that new technology.”

So how do you protect yourself? There are shielded wallets and sleeves. Augustinowicz’s company, Identity Stronghold, sells them, so admittedly he’s got a dog in the fight. But he also says wrapping cheap tinfoil around a card works, too.

So what do the credit card companies have to say about this? The Problem Solvers contacted the major players: American Express, Discover, Mastercard and VISA.

They contend a scammer wouldn’t get enough information to make a purchase and that the reader doesn’t transmit the cardholder’s name, billing address or the security code on the back of the card.

That’s true, but the Problem Solvers tried to make an online purchase with a name and address that didn’t match the account holder. It went through, and a security code wasn’t even required.

The Problem Solvers did the same with a phone order. They gave false information and the purchase went through.
 
The Problem Solvers canceled all the orders.

In a patent application filed by VISA, its own product development director admitted electronic pick-pocketing is “a major concern for consumers.”

So check your ATM and credit cards for RFID technology. If you have it and don’t want it, call your credit card company and ask for a new card. Some will reissue your card but others won’t. Also, consider using a protective wallet or sleeve or wrap the card in tinfoil.

Credit and ATM cards aren’t the only cards with RFID technology. The Washington State “enhanced” driver’s license – the one that allows you to cross the border more easily – also has the chip. That’s why the state includes a protective sleeve with the card.

Your passport has the chip too, though Augustinowicz says it has other protective measures, making it more secure – at least from the time being.

For more information on shielded sleeves & wallets, go here: www.idstronghold.com