Electronic pickpockets can steal credit card numbers out of air
LOUISVILLE, KY (WAVE) - We all know to keep an eye out for criminals during the holiday shopping season. What you may not know is that thieves can now steal your credit card information without the card ever leaving your purse. The WAVE 3 Troubleshooter discovered technology that is supposed to make your life easier could actually be making you a target.
You may have one of these at risk cards, and not even know it. But the Troubleshooter Department found some simple ways you can protect yourself.
As he walked across Fourth Street Live! In downtown Louisville, Nathan Lee watched his credit card information swiped right from his pocket, right out of the air. All thanks to technology he didn't even know he had in his wallet.
"Kind of an eye opener," Lee said. "I didn't think it was that easy."
But Walt Augustinowicz, CEO of a company called Identity Stronghold, said it is surprisingly easy to steal account information off credit or debit cards equipped with RFID, or radio frequency identification. Cards equipped with RFID have a small chip inside connected to an antenna that lets you wave your card to pay using special readers found at an increasing number of stores. But Augustinowicz said that tiny chip can cause you big problems.
"The word has not got out to most people," Augustinowicz said. "They don't realize these cards are just broadcasting their credit card numbers."
Augustinowicz's company makes sleeves for federal and state agencies that want to protect information contained in RFID badges and ID cards.
"You know people need to know they can get a sleeve or get a shielded wallet so that they are protected," he said. "If they don't do that they might as well just print their credit card information on the back of their shirt and walk around in public because it's no different."
Using a homemade device pieced together from electronics bought off the Internet for around $100, Augustinowicz showed us how easy it is for thieves to get a return on that investment. Using willing participants in public areas, Augustinowicz was able to electronically obtain the card type, number and expiration date from 4 different people with RFID credit cards in about an hour.
"It's really creepy to know that people can get your credit card information without you ever even knowing it," said Elizabeth Garcia after Augustinowicz used his device to get her card information without ever taking it out of her purse.
In response to questions from the WAVE 3 Troubleshooter Department, American Express called the threat of electronic pick pockets "extremely small. MasterCard said they are seeing "zero fraud from contactless transactions" using RFID cards.
But the Troubleshooter Department uncovered documents from Visa that seem to indicate the threat is real. A 2005 patent request from Visa included this: "it is entirely possible that a contactless reader may be used for surreptitious interrogation (e.g., data skimming)."
Visa said that patent request was written when RFID technology was first being developed and additional layers of security have been added to cards since then. Visa also said security code and addresses cannot be skimmed using RFID, making fraud difficult. The company repeated what other card companies told us: that data skimming using RFID is simply not an issue. But Augustinowicz said the card companies are trying to minimize the problem.
"They know this is an issue," Augustinowicz said. "They know these cards can be read."
Augustinowicz suggests slipping RFID cards into a sleeve that blocks the radio frequency so thieves can't grab it out of the air, or keep RFID cards in an electromagnetic sealed wallet. Both products can be found on his company website.
Visa suggested the only reason Augustinowicz is peaking out is to sell his card sleeves and wallets.
Copyright 2011 WAVE News. All rights reserved.