Yes, but the risk is smaller than you think
Someone can read your credit card number wirelessly if your card has a radio chip — the kind that lets you tap to pay — and they have a specialized reader device held close to your wallet. This is called RFID skimming or NFC skimming. It works because the chip broadcasts your card number, expiration date, and sometimes the last four digits of your name when activated, without requiring a PIN or signature.
The catch: the attacker needs to be within a few inches of your wallet, the card must have contactless capability (not all do), and they need equipment that costs money and looks suspicious to use in public. Most credit card fraud happens through data breaches, stolen physical cards, or phishing — not wireless skimming. That said, the threat is real enough that wallets with RFID blocking exist, and some people choose to use them.
Key Takeaways
- RFID and NFC skimming requires the attacker to hold a reader device within a few inches of your wallet, making it impractical in most real-world situations.
- Not all credit cards have contactless chips — older cards and many debit cards cannot be skimmed wirelessly, so check your card for a wave symbol.
- Credit card companies limit liability for fraudulent charges to $50, and most waive that entirely if you report the fraud promptly.
- RFID-blocking wallets and sleeves exist but are not necessary for most people; monitoring your statements and using fraud alerts is more effective.
How RFID and NFC skimming actually works
Your credit card has a small radio chip if it displays a wave symbol (the contactless payment icon). When you tap your card at a payment terminal, that chip sends out your card number and expiration date — no physical contact needed. A skimmer is a device that mimics a payment terminal and reads that broadcast without your knowledge.
The attacker holds the reader close to your wallet (usually within 2 to 4 inches, though some devices claim longer range). The card's chip responds automatically, broadcasting the data. The skimmer captures it. The whole process takes seconds and produces no notification on your phone or card.
The limitation: the attacker gets your card number and expiration date, but not your CVV (the three-digit security code on the back). Most online purchases and some in-person fraud attempts require the CVV. Contactless payments at legitimate terminals also use additional security checks that a skimmer cannot replicate, so the stolen data alone is not enough to make a tap payment at a real store.
Which cards can actually be skimmed
Only cards with a contactless chip can be skimmed wirelessly. Look for the wave symbol on your card — if it is not there, your card cannot be read this way. Many older cards, some debit cards, and cards issued before contactless technology became standard do not have this feature.
Chip-only cards (with the square metallic chip but no wave symbol) require physical insertion into a reader and cannot be skimmed. Magnetic stripe cards (the oldest type, with a black stripe on the back) also cannot be skimmed wirelessly, though they are vulnerable to other forms of theft.
If you are unsure whether your card has contactless capability, call the number on the back of your card and ask. Many banks let you turn off contactless payments in your account settings, though this is rare and not offered by all issuers.
What actually happens if your card is skimmed
If someone uses your card number to make a purchase, your credit card company is liable for the fraud, not you. Federal law caps your liability at $50 for unauthorized charges, and most major card issuers waive that $50 entirely if you report the fraud within 60 days. You are protected as long as you report it promptly.
The real inconvenience is not the financial loss — it is the time spent disputing charges, waiting for a replacement card, and updating recurring payments. This is why monitoring your statements matters more than preventing skimming: catching fraud early stops the inconvenience before it starts.
Debit cards offer less protection than credit cards. If someone skims your debit card and drains your account, you have 60 days to report it to get your money back, but the burden of proof is on you. This is another reason many financial advisors recommend using credit cards for everyday purchases instead of debit.
RFID-blocking wallets: do you need one
RFID-blocking wallets and sleeves contain a thin layer of material that disrupts radio signals, preventing a skimmer from reading your card. They work in laboratory conditions. The question is whether they solve a problem you actually have.
The practical barriers to skimming are already high: the attacker needs specialized equipment, needs to get within inches of your wallet, and needs to do this without drawing attention. Most people never encounter someone with a skimming device. The fraud risk you face from a data breach at a store or website is far higher than the risk of wireless skimming in public.
If you want the peace of mind, RFID-blocking wallets cost $20 to $60 and work. If you do not want to spend the money, monitoring your credit card statements and setting up fraud alerts with your bank is a more effective use of your time and attention. Choose based on your comfort level, not on fear.
Practical steps to protect yourself
Monitor your credit card statements regularly — weekly if possible. Most card issuers let you set up transaction alerts by email or text, so you are notified when ready when a charge is made. This catches fraud faster than waiting for a monthly statement.
Place a fraud alert with the three major credit bureaus (Equifax, Experian, TransUnion) if you suspect your information has been compromised. This is free and tells lenders to verify your identity before opening new accounts in your name. You can do this online at any of the bureaus' websites.
Keep your card in a find location and do not leave your wallet unattended in public. This protects against physical theft, which is far more common than wireless skimming. If you lose your card, call your bank when ready — most issuers can freeze the card within minutes.
Use a credit card instead of a debit card for everyday purchases. Credit cards offer stronger fraud protection and do not drain your bank account if compromised. Pay the balance in full each month to avoid interest charges.
Frequently Asked Questions
Can someone skim my card through my pocket or purse?
Theoretically yes, but the attacker would need to hold a reader device against your pocket or purse for several seconds without you noticing. In practice, this is rare because it requires proximity, specialized equipment, and the ability to do it without drawing attention. The risk is real but low compared to other forms of fraud.
Do I need to replace my contactless card with an older one?
No. The fraud protection you get from your card issuer is the same whether your card has contactless capability or not. If you are concerned about skimming, an RFID-blocking wallet is cheaper and easier than replacing your card. Most people do neither and never experience wireless skimming.
What should I do if I notice an unauthorized charge on my statement?
Call the number on the back of your card when ready and report the charge as fraudulent. The card issuer will investigate and reverse the charge within 10 business days in most cases. You are not responsible for paying the fraudulent amount while the investigation is underway.
Can skimmers read my PIN or CVV?
No. RFID skimmers can only read the data broadcast by your card's chip — your card number and expiration date. Your PIN is never transmitted wirelessly, and your CVV is printed on the card, not stored on the chip. This is why stolen card data alone is not enough to make most purchases.
Is my bank account at risk if my credit card is skimmed?
No, because a credit card is separate from your bank account. Fraudulent charges go to your credit card bill, not your checking account. Your bank account is only at risk if someone skims your debit card, which is why using a credit card for everyday purchases is safer.