Do You Need an RFID Wallet? What Contactless Skimming Can and Cannot Do

Short answer: for the payment cards in your pocket, the risk that someone reads them through your trousers and empties your account is small, well understood and well contained by the card system itself. An RFID-blocking layer still has real uses, and in a well-built wallet it costs nothing in thickness or weight. But it is not the thing standing between you and fraud, and anyone selling it that way is selling fear. We put RFID shielding in every COLDFIRE wallet, so this is not an argument against it. It is an explanation of what it does, what it does not do, and where your actual exposure is.

What a contactless card actually sends

A contactless payment card is a passive chip with an antenna. It has no battery; it draws power from the reader's field at 13.56 MHz, which is why the working range is a few centimetres and why the card has to be practically touching the terminal. Once powered, the card speaks the EMV protocol, the same standard behind chip-and-PIN, and gives the reader three kinds of information.

First, the card number and expiry date. These are readable by any device that can talk EMV, including a phone with an NFC reader and a free app. Second, a one-time cryptogram: a code the chip calculates for that specific transaction, including the amount, using a key that never leaves the chip. It cannot be reused and cannot be predicted. Third, nothing else of value. The three-digit security code is printed on the card and is not stored on the chip. The cardholder name used to be included on some cards and was removed from the contactless interface around 2013. Your address, PIN and bank details are not on the chip at all.

So the realistic worst case from a read through your pocket is a card number and an expiry date. That is the same information printed on the front of the card and visible to every waiter and shop assistant you hand it to. It can be used at online merchants who do not ask for the security code, and when that happens the liability sits with the merchant, not you, and the charge is reversed. What it cannot be used for is a cloned chip card, because the cryptogram cannot be copied, and that is why the "someone tapped my pocket and paid with my card" scenario does not appear in fraud statistics in any meaningful number.

Why the experts keep saying the same thing

Visa describes contactless skimming as very unlikely and limited in scope. The Identity Theft Resource Center's chief operating officer told AARP it is not a real risk and that chip cards and digital wallets are the safest ways to pay short of cash. The head of consumer banking at Chase said he does not worry about it. These are not people with a wallet to sell. They are the people who pay for fraud when it happens, and they do not see this kind.

Where the money actually goes missing is well documented. Card-not-present fraud, meaning online purchases with stolen card details, accounts for the majority of card fraud in the UK and has for years. The details come from data breaches at merchants, from phishing sites, and from malware on phones. The most sophisticated contactless fraud of the last two years, which security firm ThreatFabric named Ghost Tap in November 2024, does not involve your physical card at all: criminals phish your card details and one-time code, load the card into a mobile wallet on their own phone, and relay the NFC payment to accomplices standing at shop tills anywhere in the world. An RFID wallet does nothing against any of this, because your card never left your pocket.

Where shielding does earn its place

Having said all that, there are four honest reasons to want a shielded wallet, and none of them involves panic.

The first is card clash. If you carry two contactless cards and tap your wallet on a transit gate or a payment terminal, the reader may pick the wrong one, charge both, or refuse. Transport for London has a whole page explaining the problem. A shielded wallet forces you to take out the card you mean to use, which is mildly inconvenient and also the only reliable fix.

The second is cards with weaker protection than a bank card. Payment cards have the strongest security of anything in your wallet because banks carry the losses. Office access badges, hotel keys, gym cards and older transit cards often use chips whose encryption was broken years ago, and some can be cloned by a reader held against your pocket for a second. If you carry a building pass that opens a door worth protecting, shielding it is sensible.

The third is identity documents with a chip. A biometric passport has shielding built into its cover and releases data only after the reader has optically scanned the data page, so it needs no help from your wallet. An American Enhanced Driver's License or passport card is different: its chip answers from further away, and the Department of Homeland Security issues each one with a shielded sleeve for exactly that reason. A shielded wallet replaces the sleeve.

The fourth is simply that it costs nothing when done properly. A conductive layer of 0.08 mm adds no visible thickness and no weight you can feel. Given that, the argument for leaving it out is weaker than the argument for putting it in, provided nobody pretends it is more than it is.

How RFID blocking works, and how to check it

The physics is a Faraday cage. A conductive layer around the card absorbs and reflects the reader's 13.56 MHz field, so the chip never receives enough power to answer. Copper, nickel, aluminium and conductive textiles all do this; a sheet of kitchen foil around a card works perfectly well, which tells you how little magic is involved. What matters in a wallet is that the layer surrounds the card compartment on both faces, that it does not crack when the wallet flexes, and that it survives years of folding. A sleeve that slides in loose, or a thin foil that fractures along the fold line after a few months, stops working without telling you.

Testing takes ten seconds and needs no equipment. Put a contactless card in the shielded compartment, close the wallet, and hold it against a payment terminal or a transit gate the way you would to pay. If the terminal reads the card, the shielding is not working. If it does not, take the card out and tap it alone to confirm the terminal is fine. A phone with NFC and any free card-reader app gives the same answer at home. Do this test on any wallet that claims RFID protection, including ours, because the claim is cheap and the layer is invisible.

One thing to know before you buy: a blocking wallet blocks. You cannot tap to pay with the card still inside. Some brands market a wallet that "lets your transit card through while blocking skimmers", and that is not physically possible with a passive shield; a layer that lets a gate read your card lets anything else read it too. The honest designs either shield everything and ask you to slide the card out, or leave one unshielded outside pocket for the card you tap most.

What is in a COLDFIRE wallet

Every COLDFIRE wallet carries what we call RFID Data Armor: a 0.08 mm copper-and-nickel conductive layer laminated into the card compartments and into the body of the wallet during construction, so the cards are shielded from both faces whether the wallet is open or closed. It is part of the structure, not a sleeve, and because the kangaroo leather and flexible carbon fiber around it do not stretch, the layer is not worked back and forth the way it would be in a leather wallet that sags. It blocks the 13.56 MHz band used by payment cards, biometric documents and most modern access cards. It does not block 125 kHz, the older low-frequency band some office badges still use, and we would rather say so than let you find out. On models with an outside pocket, that pocket sits outside the shield so one card stays tappable. Shielding is covered by the same five-year guarantee as the rest of the wallet.

We include it because it is cheap to do well, because card clash and badge cloning are real, and because a buyer who wants it should not have to choose between it and good materials. We do not include it because a thief is going to walk past you and take your money. He is far more likely to send you an email.

Questions, answered

Do I need an RFID wallet?

For payment cards alone, no. Contactless cards send a one-time code for each transaction and never transmit your security code or name, and fraud experts, card networks and banks all describe skimming through a pocket as a theoretical risk. An RFID wallet is worth having if you carry two contactless cards and get card clash at transit gates, if you carry access badges or hotel keys with weak encryption, or if you hold an American Enhanced Driver's License. It is also reasonable to want it simply because a good one costs nothing in thickness.

Do RFID blocking wallets actually work?

Properly made ones do. A continuous conductive layer around the card compartment stops a reader's 13.56 MHz field from powering the chip, and you can verify it in seconds by trying to tap a card through the closed wallet at any terminal. Poorly made ones fail silently when the foil cracks along the fold, so test any wallet that makes the claim.

Can someone steal my credit card information by walking past me?

In theory a reader within a few centimetres can collect the card number and expiry date, the same details printed on the card's face. It cannot collect the security code, which is not on the chip, and it cannot clone the chip, because each transaction uses a code generated inside the card. Confirmed real-world cases are vanishingly rare, and liability for any resulting online charge sits with the merchant. The fraud that actually happens comes from phishing, data breaches and phone malware.

Does RFID blocking stop me paying with my phone?

No. Your phone is not inside the wallet. Apple Pay and Google Pay are unaffected, and they are in fact the most secure way to pay contactless, because the phone uses a device-specific token and requires your face, fingerprint or code for each payment.

Does an RFID wallet protect my passport?

A biometric passport already protects itself. Its cover contains shielding, and the chip releases data only after the reader has scanned the printed data page to derive the keys. A shielded wallet does no harm but adds little. The exception is the US passport card and Enhanced Driver's License, whose chips are read from a distance and which are issued with a shielded sleeve; a shielded wallet does the same job.

Why can't I tap my transit card through the wallet?

Because the shield cannot tell a transit gate from a skimmer; both are 13.56 MHz readers. Any wallet that lets your card be read at a gate is not shielding it. Slide the card out to tap, or keep it in an unshielded outside pocket if your wallet has one.

Sources

• AARP, Are RFID-blocking wallets and purses worth buying? Quotes from the Identity Theft Resource Center, RFID Journal, Point Predictive and JPMorgan Chase. aarp.org
• Consult Hyperion (Dave Birch), Still a touchy subject it seems, November 2013: what a contactless card discloses to a reader and why the data is of limited use. chyp.com
• ThreatFabric, Ghost Tap: new cash-out tactic with NFC relay, 20 November 2024. threatfabric.com
• Transport for London, Card clash. tfl.gov.uk
• US Department of State, The US electronic passport: anti-skimming cover and Basic Access Control. travel.state.gov
• US Department of Homeland Security, Enhanced Driver's Licenses: what are they? Chip contents and shielded sleeve. dhs.gov
• SlashGear, Are RFID-blocking wallets still needed or useful in 2026? May 2026. slashgear.com

Written by Todor Georgiev, founder of COLDFIRE and a leather goods manufacturer in Plovdiv since 2000. Published 2 November 2026. Shield specification is COLDFIRE's own; fraud and protocol facts are drawn from the sources above.