Can RFID Readers Read Credit Cards?

Contactless payment has made it normal to hold a credit card near a terminal instead of inserting it. Since that communication happens wirelessly, it is easy to assume that any RFID reader could detect and read the card.

The reality is more specific. A contactless credit card uses a particular type of short-range radio technology, and the reader has to support the same technology before the two can communicate.

Can RFID Readers Read Credit Cards?

Yes, some RFID readers can read contactless credit cards, but not every RFID reader can.

Modern contactless payment cards typically operate at 13.56 MHz and use technology based on ISO/IEC 14443. NFC also operates at 13.56 MHz and builds on the same contactless interface used by payment cards. A compatible HF or NFC reader may therefore be able to communicate with a contactless credit card.

An LF reader operating at 125 kHz or 134.2 kHz will not read the card. Neither will a typical UHF RFID reader operating in the 860–960 MHz range. The reader must support the frequency and communication technology used by the card.

Only cards with contactless capability can be read this way. You can usually identify one by the contactless symbol printed on the card. A card that only has a contact chip or magnetic stripe does not provide the same wireless interface.

What the reader can retrieve is another matter. A contactless credit card is not like a basic RFID tag with a block of memory that a reader can freely browse. The card runs a payment application and controls how information is exchanged.

During a legitimate contactless payment, the card provides the information needed to process that transaction. For example, Visa states that its contactless cards transmit the account number, expiration date, and a one-time code that changes for each in-person transaction. Other information used to secure the payment is generated dynamically rather than remaining the same every time the card is read.

A generic 13.56 MHz reader therefore does not automatically give someone unrestricted access to everything associated with the credit card or bank account. What it can receive depends on the card, the supported protocol, and the software communicating with it.

The distance is also short. Contactless payment systems are designed for close-range communication. A Visa card or payment device normally needs to be within about 2 inches (5 cm) of the terminal for a payment transaction. Mastercard similarly describes holding the card within an inch or two of the reader.

That is very different from long-range UHF RFID systems, where tags may be detected from several meters away.

Can RFID Readers Steal Credit Card Information?

A compatible contactless reader may be able to obtain some information from certain payment cards if it is brought close enough. This is commonly described as contactless skimming.

However, reading some card data is not the same as obtaining everything required to make valid payments.

EMV contactless cards use cryptographic security during transactions. A new security value is generated for each payment, rather than relying only on static information that can be recorded once and replayed indefinitely. EMVCo describes this as a one-time security code, while Mastercard uses a unique dynamic cryptogram for each contactless transaction.

Sensitive authentication information is also treated differently from ordinary card data. For example, Mastercard states that the CVC2 used for card-not-present authentication is not stored as readable chip data.

This does not mean unauthorized reading is impossible or that contactless cards carry no security risk. Some card details may be exposed during contactless communication, depending on the card and payment system. But obtaining those details does not give the reader the cryptographic credentials held securely inside the chip.

Can an RFID Reader Copy a Credit Card?

A normal RFID reader cannot read a contactless credit card and then create a fully functional duplicate simply by copying the data it receives.

EMV payment chips contain cryptographic keys that are used to authenticate transactions. Those secret keys are not transmitted to the reader during a normal contactless exchange. Instead, the chip uses them internally to produce transaction-specific cryptographic data.

As a result, copying readable information onto another RFID chip would not reproduce the original card’s ability to generate valid authentication data.

Reading and cloning are completely two different things. An RFID system with a simple static identifier may allow that identifier to be copied if the tag is not protected. A contactless payment card, however, usually uses a much more complex security system.

Frequently Asked Questions

Conclusion

So overall, yes, a compatible RFID reader can read a contactless credit card. The reader must support the card’s 13.56 MHz frequency and communication standard. Even then, the card does not behave like an ordinary RFID tag with freely readable data.