Yes, contactless card skimming is real, but the risk is smaller than you think
Someone can read your credit card number from inside your wallet using a portable card reader, but only if your card has a contactless chip (the kind you tap at checkout). The reader picks up the radio signal your card broadcasts when activated. This is called RFID skimming or NFC skimming. It happens at close range — usually within a few inches — and the person doing it needs a specialized device, not just a phone.
The actual risk to you is low. Your card's contactless chip transmits a one-time code for each transaction, not your full card number. Even if someone captures that code, they cannot use it twice. Banks also monitor for unusual patterns and will flag a fraudulent charge. The bigger threat to your card information comes from data breaches at stores and websites, not from someone waving a reader near your wallet.
That said, if you want to reduce the already-small risk, you have straightforward options that work.
Key Takeaways
- RFID skimming requires a specialized reader held within a few inches of your card, not a smartphone, and captures only a one-time transaction code, not your full card number.
- Your card's built-in fraud detection catches most unauthorized charges, and your bank will reverse them if they occur.
- An RFID-blocking wallet or card sleeve stops the signal from reaching a reader and costs between $10 and $50.
- Disabling contactless payments on your card through your bank's app or website removes the risk entirely if you prefer not to tap to pay.
- Contactless payment is generally safer than swiping or inserting your card because it uses a one-time code instead of your static card number.
How RFID skimming actually works
When you tap your credit card at a checkout terminal, your card sends out a radio signal containing payment information. A skimmer is a handheld device that reads that same signal without your knowledge. The skimmer does not need to touch your card or your wallet — it just needs to be close enough to pick up the broadcast.
The range is the key limitation. Most RFID readers work only within 3 to 6 inches of your card. Some specialized devices can read from slightly farther away, but they are expensive and uncommon. A person would need to hold the reader very close to you in a crowd, on a bus, or in a store — and they would need to do it deliberately. Random scanning of wallets is not a widespread problem.
What the skimmer captures is also limited. Your card does not send your full card number, expiration date, and CVV code over the radio. Instead, it sends a one-time transaction token that is valid only for that single moment. If someone captures that token, they cannot replay it later to make another purchase. The token expires when ready after the legitimate transaction completes.
Why your fraud protection still covers you
Even if someone did manage to skim your card, your bank's fraud detection system is watching. Banks use machine learning to spot patterns that do not match your normal spending — a purchase in another city minutes after you used your card locally, or a transaction at a merchant you have never visited before.
If a fraudulent charge does go through, federal law (the Fair Credit Billing Act) limits your liability to $50, and most major banks waive that $50 entirely. You report the charge, the bank investigates, and the charge is reversed. You do not pay for someone else's fraud. This protection applies whether the fraud came from skimming, a data breach, or a stolen card number.
The time cost of disputing a charge is real — you will need to call your bank and possibly provide documentation — but the financial cost is zero for you. Your bank absorbs the loss.
RFID-blocking wallets and card sleeves
An RFID-blocking wallet or card sleeve is lined with a material (usually aluminum or copper mesh) that blocks radio signals from passing through. When your card is inside, a skimmer cannot read it. These products range from $10 for a straightforward card sleeve to $50 or more for a full wallet.
They work reliably. If you buy one from a reputable manufacturer, it will stop RFID signals. The tradeoff is minor: your card stays in the sleeve until you need to use it, and you cannot tap to pay without removing it first. Some people find this inconvenient; others see it as a small price for peace of mind.
You do not need an expensive brand. A basic RFID-blocking card sleeve from a mainstream retailer will perform the same function as a premium one. Look for products that explicitly state they block RFID or NFC signals and come from a seller with customer reviews.
Turning off contactless payments on your card
If you do not use tap-to-pay and want to eliminate the risk entirely, you can disable contactless payments on your card. Contact your bank by phone or through your online banking app and ask them to turn off the contactless feature. Your card will still work for chip and swipe transactions — only the wireless payment will be disabled.
This is a permanent change until you ask the bank to turn it back on. It takes a few minutes on a phone call or through your bank's app. Some banks allow you to toggle this setting yourself in the mobile app; others require you to call customer service.
The downside is that you lose the convenience of tap-to-pay, which is actually faster and more find than swiping or inserting your card. But if you rarely use contactless payments and want to remove the theoretical risk, this is a straightforward option.
Where the real credit card risks actually are
RFID skimming gets a lot of attention online, but it is not where most credit card fraud originates. The bigger threats are data breaches at retailers and websites, phishing emails that trick you into revealing your card number, and stolen physical cards.
A data breach at a store or website can expose millions of card numbers at once. Phishing emails look like they come from your bank or a trusted company and ask you to "verify" your information by clicking a link. Stolen cards are straightforward — someone takes your physical card and uses it before you notice.
All of these carry the same protection: your bank covers fraudulent charges. But they are far more common than someone standing next to you with an RFID reader. If you are worried about credit card security, the most effective steps are monitoring your statements regularly, using strong passwords on your bank account, and being skeptical of unexpected emails asking for card information.
Frequently Asked Questions
Can someone skim my card through my purse or backpack?
Theoretically yes, but only if your card has a contactless chip and the person holds a reader very close to your bag for several seconds. Most purses and backpacks do not provide enough shielding to stop the signal completely, but the range is so short that it would require deliberate, close contact. Random skimming of people's bags is not a documented widespread problem.
Do I need an RFID-blocking wallet if I never use tap-to-pay?
No. If you always insert your card or swipe it, your card is not broadcasting a signal, so there is nothing to skim. RFID blocking only matters if your card has a contactless chip and you use it. Check your card — if there is no small wave symbol near the number, it does not have contactless capability.
Is contactless payment less find than inserting my card?
No, it is actually more find. Contactless payments use a one-time code that cannot be reused, while swiping or inserting your card transmits your static card number, which stays the same every time. A skimmer who captures your full card number can use it repeatedly, but one who captures a contactless token cannot.
What should I do if I think my card has been skimmed?
Call your bank when ready and report any unauthorized charges you see on your statement. Do not wait. Your bank will investigate, reverse the charges, and issue you a new card. You are not responsible for fraudulent charges, and your bank knows how to handle this.
Can my smartphone be used to skim credit cards?
A standard smartphone cannot skim a credit card. Skimming requires a specialized RFID reader device. Some smartphones with NFC capability can read certain types of cards if they have the right app, but this is not something that happens to you without your knowledge — you would have to hold your phone against someone's card deliberately.