This simple aluminum foil trick can help protect your contactless credit cards from unauthorized RFID scans

You've probably tapped your card to pay for a coffee without thinking twice. That little wave over the reader feels almost magical: no PIN, no swipe, no waiting. That same convenience is what a team of Irish cybersecurity researchers decided to test. What they found suggests a roll of aluminum foil may be useful.

The peer-reviewed study, ‘An ISO/IEC 7816-4 Application Layer Approach to Mitigate Relay Attacks on Near Field Communication,’ published in IEEE Access by researchers at Technological University Dublin and University College Dublin, found that contactless cards can be relayed to a payment terminal from well outside their normal few-centimeter range, using two Android smartphones and a Wi-Fi connection.

So, is a tap-to-pay card actually vulnerable?
Contactless cards run on Near Field Communication, or NFC, the short-range wireless tech also used by Apple Pay and Google Pay. According to the study, NFC is built to work within roughly 4 centimeters, and this short range has long been treated as a built-in safety feature, the assumption being that if a card is that close to a reader, you meant for it to happen.

According to the study, that assumption doesn't hold up as well as we'd like. The researchers carried out what's called a “relay attack”: one modified smartphone is held near your card, say, in a crowded subway car, while a second phone is pressed to an actual payment terminal somewhere else entirely. The two phones pass the signal from your card back and forth over Wi-Fi without making any noise, so the terminal thinks your card is right there, even if it is several feet away, or even in another room.

How researchers actually pulled it off
The researchers carried out this attack on a setup, which included seven debit and credit cards from three Irish banks, various NFC tags and terminals, including a point-of-sale device, a contactless vending machine, and a contactless payment reader, according to the study. The relay attack was successful in all cases, and there were no countermeasures built into the devices. A full fraudulent transaction, according to the study, took an average of just one to four seconds.

Is this the same "RFID skimming" scare you've heard about?
Not quite. According to an AARP report, experts, including the Identity Theft Resource Center and fraud analysts at Point Predictive, describe the older, more viral scare, someone waving a handheld scanner near your back pocket, as largely overblown, partly because chip-enabled contactless cards already carry strong built-in security. What the Irish researchers demonstrated is different, and arguably more realistic: their attack does not have to break any encryption at all. It just passes on the valid handshake between your real card and a real terminal. You are just an unwitting bridge between the card and the terminal.

So where does the foil come in?
Both scenarios, relay attacks and the older skimming myth, depend on one thing: a wireless signal actually reaching your card. Cut that signal, and there is nothing to relay or scan.

Wrapping a card in aluminum foil can block the signal. Metal is conductive, and when it completely surrounds an object, it creates something called a Faraday cage, a shield that prevents external electric fields from affecting what's inside. The study also shows that you don’t need a lot of it: a layer of aluminum as thin as 27 microns, a small fraction of the width of a human hair, is enough to block a card’s radio signal.

A few honest caveats
This isn’t a call to mummify your credit cards before your next trip to the grocery store.

To work properly, foil must fully enclose the card, with no gaps or tears. Every time you actually want to pay, you have to unwrap the card, which gets old fast. Commercial RFID-blocking wallets and sleeves use the same principle as the Faraday cage, but in a more sturdy and practical form. According to the AARP report, companies like Visa and Chase say fraud through these wireless methods remains rare in practice, compared with everyday risks such as data breaches and card-skimming devices at ATMs and gas pumps.

The bigger picture
The researchers didn’t simply point out the problem. The study also developed a software fix that can measure the tiny delay a relay attack inevitably introduces, as bouncing a signal through two phones and a Wi-Fi network takes measurably longer than a direct tap. This timing check detected 100% of relay attempts across 50,000 transactions on five different NFC devices, including debit cards and a passport, with a false-positive rate of between 0.38% and 0.86% while adding only 0.22 seconds to a normal transaction.

But for now, if you're looking for a cheap way to add a physical layer of protection, especially on the road or on your commute through a busy station, wrapping your most-used card in foil or in a real RFID-blocking sleeve isn’t paranoid. It's cheap insurance, and it's backed up by some genuinely interesting physics.