The Flipper Zero reading the Apple Pay NFC signal from my Apple Watch Ultra.
Adrian Kingsley-Hughes/ZDNET
RFID is everywhere, even packed into your credit and debit cards, allowing the information to be read in a “contactless” fashion.
Concerns that cards could be read covertly have generated a massive industry of security devices designed to block or somehow interfere with this contactless reading of the cards.
You can find wallets, purses, and card protectors designed to prevent your cards from being read stealthily.
But do these security devices work?
Well, I have a Flipper Zero, and this amazing device can read NFC.
FAQ: Flipper Zero: ‘Can you really hack Wi-Fi networks?’ and other questions answered
So, let’s try it out.
What I’m using it to test out here are Vulkit RFID blocking cards, which are designed to protect credit cards, debit cards, and ID cards using 13.56MHz-frequency RFID from unauthorized scanning.
The blocking card looks like any other credit or debit card, and doesn’t need any charging or anything. All you need to do is pop it into your wallet or purse, and it’s supposed to block RFID reading.
The Vulkit RFID blocking card looks like any other credit, debit, or ID card.
Adrian Kingsley-Hughes/ZDNET
But does it work?
First I fired up the Flipper Zero, and tested an unprotected debit card. It read the data (see the picture below).
Also: How to unlock the Flipper Zero’s true power
Note that while the Flipper Zero can read NFC cards, it cannot decode the card’s encrypted security code, also known as CSC, CVV, CVC, CAV, and a bunch of other three-letter abbreviations.
The Flipper Zero can read the unencrypted data on a debit card.
Adrian Kingsley-Hughes/ZDNET
OK, now let’s add the blocking card to the equation.
The Vulkit RFID blocking card does indeed block the RFID signal.
Adrian Kingsley-Hughes/ZDNET
Yup, it blocked the reader. The Flipper couldn’t read anything from it.
What if the blocking card is behind the target card — meaning it isn’t a physical barrier between the credit card and the reader?
The Vulkit RFID blocking card works even if it is behind the target card.
Adrian Kingsley-Hughes/ZDNET
Yup, it even blocked that.
So, does Vulkit’s blocking card work?
Yes. It’s very effective.
Do you need one?
It depends.
The Vulkit RFID blocking card certainly adds a layer of security between you and someone wanting to access your data. For example, I’ve seen hotel safes that can be locked and unlocked using credit or debit cards, and a Flipper Zero could be used to clone the card and unlock the safe.
So, while I think the chance of someone reading your card and using it for bad things is small, these cards cost about $4 each, which means they’re cheap and easy-to-use insurance against such attacks.
