How to foil electronic pickpockets

By Jennifer Waters, MarketWatch

CHICAGO (MarketWatch) — The Internet has been abuzz recently with tales of fraudsters who can now steal your credit card accounts just by walking past you with an electronic scanner.

Though the device, similar in size and look to a touch pad, is out there you’re more likely to have your wallet stolen than a card in it scanned. And even if a thief can get close enough to you — and stay there long enough — to skim the card, the chances of getting enough information off it to ring up large purchases are pretty slim.

Credit card travel deals get sweeter

Scott McCartney says competition among credit-card companies has led to a sweetening of credit card travel rewards.

“It can happen,” said Margot Mohsberg Johnson, a security-issues spokeswoman for the American Bankers Association who has studied the fraud. “But it’s just not a very lucrative crime. It’s more prudent for a criminal to steal your whole wallet.”

Call it the electronic pickpocket, a modern type of theft that turns out to be a classic criminal game of cat and mouse: Banks and credit-card issuers come up with newfangled ways for you to swipe or wave your credit card rather than handing it over to a clerk and the bad guys find a new means to steal from you.

In this case, it’s the radio-frequency identification chips that major banks like J.P. Morgan Chase are embedding in credit and debit cards for speedy service at the check-out counters. The RFID chip carries such information as your account number and expiration date. Older cards include your name on the chip, but newer ones don’t.

Unlike skimmers thieves use at ATMs, this device can’t completely duplicate your card because it can’t read the security number on the back of the card, known as the credit verification value or the credit verification code, or get your personal identification numbers. See Consumer Confidential on ATM skimming.

But because not every store clerk routinely looks at the back of your card, simple manifestations of your cards can be reproduced. And yes, those can be used to, as banks say, “compromise” your account.

But the thief has to be crafty, desperate and fearless. It’s not easy to capture the information. The swindler has to have the scanner right next to your purse or wallet pocket. And it has to be there, unmoved, for about 30 seconds — quite long in the hustler world.

In that time, you are likely to notice the invasion of your space, wonder what’s going on and pull away as a defense mechanism. In a traditional pickpocket situation, you’re likely to feel a tug, turn to see where it came from and face a surprised expression. But your wallet has already been handed off to someone else who by then is a block away. The electronic pickpocket, on the other hand, is still there with the device.

“There are better ways to go about trying to steal money,” Johnson said of electronic pickpockets.

That’s not to say consumers shouldn’t guard themselves but there’s no reason to be afraid that everyone in the mall or shopping center who bumps into you is a fraudster. Consumers should be more wary about restaurant waiters, and hotel, car-rental and retail clerks, according to John Sileo, who is the author of a newsletter called ThinkLikeaSpy.com.

“Every person you hand your credit card to has more information than a scanner on your wallet might get,” Sileo said.

Foiling the evildoers

Here’s what else to consider: If you have two cards with RFID chips in your wallet, the scanner can’t read them because they confuse the information and cancel each other out.

Of the major credit cards, new Chase cards are the most likely to be chip-embedded, or what card issuers refer to as “blink” in that a scan light blinks when the card is waved in front of it. Yet, Chase isn’t worried that this electronic pickpocketing is at a high-stakes fraudulent level to the likes of outright wallet theft or massive data breaches.

“We thoroughly test our products and security on an ongoing bias,” Chase spokeswoman Gail Hurdis said. “To date, we have not experienced incremental fraud levels with Chase cards with blink.”

If you’re still worried about getting ripped off by someone invading your space with a notepad-like scanner, here’s a tried-and-true precautionary move: Put a piece of aluminum foil in your wallet.

“That’s the good news for the average consumer,” said Linda Foley, spokeswoman for the Identity Theft Resources Center. “That little piece of aluminum foil prevents the scanner from reading the card.”

Jennifer Waters is a MarketWatch reporter, based in Chicago.