High-Tech Pickpockets Can Steal Credit Card Info

High-Tech Pickpockets Can Steal Credit Card Info

CREATED Nov 8, 2011

By Jennifer Kraus
Consumer Investigator

NASHVILLE, Tenn.- How many people these days actually carry cash? Many people instead use credit or debit cards. If you do, NewsChannel 5 Investigates found you could fall victim to something called electronic pickpocketing.

We hear how technology is supposed to make our lives easier. But, in this case, it's also making us more vulnerable to theft. 

More and more bank cards have tiny chips in them, and if you've got these specific credit cards, we found out someone could easily steal your credit card information right out from under you.

It's everything someone would need to make a purchase.

Most people have no idea that this is even possible, or that many credit and debit cards these days now have something called RFID -- or Radio Frequency Identification Technology -- in them.

They are tiny chips that allow customers to simply wave their cards in front of a reader in stores to complete a transaction.

But Walt Augustinowicz, who calls himself a consumer advocate, found the same kind of reader online for less than a hundred dollars. And, all he had to do was wave it near someone's wallet or purse and instantly he had their entire credit card number plus the expiration date sent to his phone screen.

If you think that's scary, thieves can also now steal your credit card information just by tapping into your smart phone.

Augustinowicz told NewsChannel 5 Investigates, "You set your phone in your purse next to your credit cards. You put it in your pocket with your wallet. It can scan those credit cards, and send them off to an email address anywhere in the world with no record on the phone."

You see, the latest generation of phones has something called Near Field communication technology. It's a radio signal that allows people to just wave their phone at a cash register to pay for items.

"That radio can scan your credit card," Augustinowicz said,

He showed NewsChannel 5 Investigates how a thief could easily create something like a game with a hidden line of code in it. Phones that downloaded the app would detect any credit cards nearby with the RFID chip and then would send the cards' information straight to the thief.

"It's explosive. You're going to literally have in the next year millions of phones that can scan hundreds of millions of cards," Augustinowicz predicted.

But ,in statements sent to NewsChannel 5 Investigates, the major credit card companies insist their RFID cards are "secure." MasterCard calls electronic pickpocketing "a myth," while Visa says its cards are designed to "protect against fraud."

The credit card companies also insist that, because the information sent using RFID doesn't include customer names or the three-digit code on the back of the card, someone couldn't actually go out and make purchases.

But Augustinowicz says he's done just that on more than one occasion.

"I know they like to say that this isn't really doable, but it really is," Augustinowicz said.

With permission, of course, he's taken the account information he's swiped and been able to order products over the phone from well-known companies. He's also been able to transfer someone else's account information onto the magnetic strip of a hotel room key and then used the key, believe it or not, to go shopping.

"I walked into a Burger King and waved it and it just said, 'approved,' and I was kind of shaking myself and walked out and said, 'I can't believe that worked,'" Augustinowicz recalled.

So how do you know if you have a bank card with an RFID chip in it? Most likely it will have a symbol that looks like sound waves or the word "blink" or "PayPass" on either the front or back of the card.

If you do have one of these cards and are wondering what you can do, Augustinowicz runs a company that sells protective sleeves for credit cards. You slide your card in and your information is shielded. You can also wrap your card in aluminum foil. 

Augustinowicz's company's website can be found here: Identity Stronghold.

Another option is to simply ask your bank to re-issue your card without RFID.

The credit card companies, at least publicly, claim data skimming, as it's called, is not a problem. You can read their full statements here:

Statement from American Express

Statement from Discover

Statement from Visa

Statement from MasterCard

But in patent applications filed by Visa, the company acknowledged that data skimming is "entirely possible" and that it should be "a major concern for consumers and businesses alike."

Read Visa patent applications here:

Visa patent application 1
Visa patent application 2

RFID chips are also now used in U.S. passport cards. But unlike the credit card companies, the federal government admits there are potential dangers and sends out a protective sleeve with each passport card.

E-mail: jkraus@newschannel5.com

Tell Us What You Think!

On Facebook:
Become a NC5 Investigates fan: facebook.com/nc5investigates
Become a Jennifer Kraus fan: facebook.com/nc5jenniferkraus

On Twitter:

Back to NC5 Investigates: Consumer Alert
Back to NewsChannel 5 Investigates