Do RFID Wallets Work? What Real NFC Scams Look Like

Search for whether RFID wallets work and most of the answers come from people selling them. Leather goods brands, travel gear shops, wallet makers answering the question on their own product pages. The pitch rarely changes: a stranger brushes past you on the subway with a reader in his jacket, and a moment later your credit card has been cloned. So do RFID wallets work? In a narrow physical sense, yes. Whether you need an RFID blocking wallet is a different question, and the honest answer is usually no.

We have nothing to sell you, which makes this easier to say. The crowded-subway attack is technically possible, barely worth a thief’s time, and all but absent from real fraud cases. Tap-to-pay fraud does exist, though, and it is growing. It just looks nothing like the ads. In the schemes that are draining accounts today, victims hold their own card up to their own phone, or type card details into a text message link, because someone asked them to.

What happens when you tap a card

RFID is the umbrella term for radio chips that run without a battery. The reader creates a small field, the chip draws power from it and answers. NFC, near field communication, is a very short-range flavor of RFID, and it is what sits in a contactless card and in your phone. The little sideways wave symbol on the card tells you it speaks this language.

The range is tiny. Germany’s federal cybersecurity agency BSI puts the upper limit at about ten centimeters, a bit under four inches. That is why you have to bring the card almost down onto the terminal before it beeps. Researchers with oversized antennas can stretch it a little in the lab. Nobody reads a bank card from across a train car.

What gets sent matters more than the range. Each time you tap, the chip computes a cryptogram that is valid for that one transaction only. Capture it, and you hold a code the bank will refuse the second time around. This is the same EMV chip logic that made counterfeit card fraud at US stores drop after the chip rollout, just without the card touching anything.

What a skimmer could actually get

A reader pressed against your pocket does not come away empty. In 2015 the British consumer group Which? tested ten contactless cards and pulled the card number and expiration date off all of them. That sounds alarming. Not one card gave up the three-digit security code from the back, because that code is not stored on the chip.

A number and a date alone do not get a thief very far. Most online stores ask for the security code, and many banks add a verification step on top. Building a card that works at a checkout is out of reach, since the secret key that produces the one-time cryptograms lives inside the chip and never leaves it.

That leaves the last trick in the book: charging you directly with a mobile card terminal hidden in a bag. It is conceivable. It also requires a merchant account with a payment processor, which leaves a paper trail pointing straight at whoever opened it. And your liability for unauthorized charges on a credit card tops out at $50 under the Fair Credit Billing Act. The big card networks advertise zero liability policies that waive even that.

This matches what people who study fraud say. Consumer Reports quoted a security expert in 2020 saying there have been no documented cases of RFID-based credit card fraud. An AARP piece from 2026 reached the same verdict, with the Identity Theft Resource Center calling it not a real risk. Visa’s own wording is that skimming fraud is “very unlikely and limited in scope.”

Where NFC fraud really happens

The real cases look very different. One of the first to be picked apart in detail took place in the Czech Republic. On August 22, 2024, the Slovak security firm ESET published an analysis of Android malware it named NGate, used against customers of three Czech banks.

It started with a text message about a tax refund. People who tapped the link installed a fake banking app and typed in their login details. Then the phone rang. A caller posing as a bank employee said the account was at risk and sent a second app to “protect” it. Inside, victims were asked to enter their old PIN, choose a new one and then hold their bank card against the back of the phone to confirm the change.

That second app was NGate. It relayed the real card’s radio traffic over the internet to a phone held by the criminals, which then posed as the card at an ATM. The PIN had just been typed in by the victim. In March 2024, Czech police in Prague arrested a 22-year-old who had been withdrawing cash from ATMs. He was carrying 160,000 koruna, about $6,500, which police said came from the last three victims alone.

The tool behind it came from a university. NFCGate was built by students at the Technical University of Darmstadt in Germany to study and modify NFC traffic. It is open source, and criminals simply repurposed it.

The method has spread since. ESET reported that detections of NFC threats rose more than thirty-five-fold in the first half of 2025 compared with the half year before, then grew another 87 percent in the second half. ESET itself notes the absolute numbers remain modest. In April 2025 the Italian firm Cleafy described SuperCard X, a relay kit rented out to criminals as a subscription service. A version of NGate adapted for Brazil turned up later that year. As recently as September 25, 2026, Austria’s Erste Bank and savings banks warned customers about calls from fake bank staff pushing a “security app” over WhatsApp and asking them to hold their card to the phone.

Ghost Tap: your card on someone else’s phone

The version most likely to hit Americans does not need your plastic card at all. In November 2024 the Dutch firm ThreatFabric described a cash-out method it called Ghost Tap. It begins with stolen card details, usually harvested through fake toll or package texts, the kind we covered in our piece on smishing. To load a stolen card into Apple Pay or Google Wallet on their own phone, the criminals still need the one-time code the bank sends. The phishing page simply asks for that too.

Once the card sits in their wallet, they relay payments through NFCGate to accomplices, known as mules, standing at store checkouts. The person holding the stolen card can be in another country. The mules mostly buy gift cards, which are easy to resell.

It has turned into a small industry. In late May 2025, the Knox County Sheriff’s Office in Tennessee said it had arrested more than ten people tied to Ghost Tap schemes. In July 2026 CNBC described a man at a self-checkout in a Louisiana home improvement store who spent about seven minutes buying $95 gift cards one after another, tapping his phone for each. Law enforcement officials told CNBC that Chinese crime rings make as much as $1 billion a year from this kind of fraud.

Would an RFID blocking wallet stop any of this?

The honest answer is in the right half of this table.

The pattern is hard to miss. Wherever money actually disappears, the radio part comes last, at the end of a chain that starts with a text or a phone call. The criminals need you to cooperate. A layer of foil in your wallet does nothing about the moment you believe you are talking to your bank.

When a blocking sleeve does make sense

Some cards are a different story. Many older office, garage and apartment badges run at 125 kilohertz and broadcast a fixed number with no encryption at all. Copiers for them sell online for a few dollars, and the copy opens the door just like the original. If your badge is one of those, a sleeve is a reasonable precaution, especially if it opens more than your own mailbox.

The US passport card is the other exception. It is designed to be read from several feet away as you drive up to a land border crossing, and the State Department sends it out in a protective sleeve for that reason. Keep it there.

The passport book is not in the same category. Its cover contains shielding, and the chip only answers a reader that already knows details printed on the photo page. Anyone holding the open passport long enough to read that page has no need for the chip.

If you already own an RFID blocking wallet, it does no harm. You will just have to take the card out at the register.

Should you turn off NFC on your phone?

After the NGate headlines, a lot of people asked this. For most, it makes little difference. Apple Pay and Google Wallet only release a payment after you confirm with a face, a fingerprint or a passcode. A stranger holding a reader to your locked phone gets nothing.

On Android you can switch NFC off under connection preferences if you never use it. More useful is the setting right next to it, which requires the device to be unlocked before NFC does anything. The iPhone has no NFC switch at all. The closest thing is Express Mode for transit cards in the Wallet settings, which lets a transit pass work without unlocking, and you can set it to none.

Against relay scams, switching NFC off only goes so far, because the caller will simply ask you to switch it back on. The step that counts comes earlier, when you are asked to install an app from a link. NGate was never in the Google Play store. Leaving the install-from-unknown-sources setting blocked does more than any NFC toggle.

What actually protects you

The most effective settings cost nothing and live in your banking app. Almost every issuer offers a push alert for each card transaction. It gets a little noisy with every coffee, but you see a stranger’s charge within seconds rather than at the end of the month. Many apps also let you lock a card instantly, switch off contactless payments or set spending limits.

Against relay attacks and Ghost Tap, what matters most is suspicion at the right moment. Both start with pressure: a suspicious charge, a frozen account, an unpaid toll. It is the same playbook as QR code scams, just with a text or a phone call doing the job of the QR code. Stopping and calling your bank at a number you looked up yourself breaks almost every one of these schemes.

If it already happened, lock or cancel the card, take the phone offline and remove the app. The FTC’s guidance on lost and stolen cards spells out that the faster you report, the better your protection, especially for debit cards, where waiting more than two business days can raise your liability to $500. If you are unsure what else is running on the device, our guide on whether your phone has been hacked walks through the checks.

So, do RFID wallets work?

They block radio signals, so in that sense they work. They protect you against an attack that almost never happens. That does not make them a scam, only unnecessary for most people. The one real use is an old access badge whose number can be copied in seconds.

The NFC fraud that costs people money has moved into the phone. It begins with a text or a call and ends with an app you installed or a code you typed in yourself. No lining stops that. What does is the simple rule that a card belongs on a payment terminal and never against a phone just because someone on the line asked for it.

Frequently asked questions

Do RFID blocking wallets actually work?

Physically, yes. A layer of metal foil or mesh stops the radio field a card needs, so a decent RFID blocking wallet does keep a reader from talking to the cards inside. The better question is whether that matters. Security experts quoted by Consumer Reports and AARP know of no documented cases of credit card fraud through RFID skimming, and Visa calls skimming fraud very unlikely and limited in scope. The wallet works. It mostly protects against a threat that is not happening.

Can someone steal my credit card info by walking past me?

Not in any useful way. A contactless card only talks over a few centimeters, roughly an inch or two, so a thief would need to press a reader against your pocket. Even then, tests have found only the card number and expiration date on some cards, never the security code on the back. Each tap also produces a one-time cryptogram that cannot be replayed, so the data cannot be turned into a working clone for a store terminal.

What is a Ghost Tap scam?

Ghost Tap is the name security firm ThreatFabric gave in November 2024 to a cash-out method in which criminals load stolen card details into Apple Pay or Google Wallet on a phone they control. They usually get the card data and the bank verification code through phishing texts. The phone then relays payments to accomplices standing at store checkouts, often buying gift cards. Your physical card is never involved, so no wallet or sleeve can stop it.

Should I turn off NFC on my phone?

For most people it makes little difference. Apple Pay and Google Wallet only pay after you unlock or confirm with a face, fingerprint or passcode, so a stranger cannot tap your locked phone and take money. On Android you can switch NFC off if you never use it, or turn on the option that requires the device to be unlocked for NFC. The iPhone has no separate NFC switch. Refusing to install apps from links sent by text is far more important.

Does my passport need an RFID sleeve?

A US passport book has shielding built into its cover and a chip that only opens up to a reader that already knows data printed on the photo page. Anyone who can read that page does not need the chip. The wallet-sized passport card is different: it is built to be read from several feet away at land border crossings, and the State Department ships it in a protective sleeve for exactly that reason. Keep that one in its sleeve.