RFID Skimming in the US: Where It Actually Happens and How to Stop It (2026)

RFID skimming gets talked about in two unhelpful ways: as a constant threat that justifies panic, or as a myth that never happens. The truth for US travelers and commuters sits in between. The signal is real and readable, the risk is situational, and the fix is inexpensive and permanent. This guide covers where skimming actually happens in the United States, which of your cards are exposed, and how to stop it without paranoia.

Is RFID skimming actually a real risk in the US?

The underlying capability is real: every contactless card communicates with a reader over a 13.56 MHz radio signal, and security researchers have repeatedly demonstrated reading that signal at short range with inexpensive equipment. What has changed is the payoff. Modern US payment cards use EMV tokenization, so an intercepted payment transaction is far less useful for fraud than it was a decade ago. But payment cards are not the only cards you carry, and tokenization does not stop the signal from broadcasting. The honest framing: skimming is not an everyday certainty, but it is a real, low-cost-to-prevent exposure in specific crowded settings.

Where does RFID skimming actually happen in the United States?

Risk rises wherever a reader can get within a few centimeters of your cards in a crowd, where bumping into a stranger is normal and unremarkable.

• Busy airports and security lines: ATL, ORD, DFW, DEN, JFK, LAX, where dense queues put strangers inches from your bag

• Urban transit at rush hour: packed subway cars and turnstiles in New York, Chicago, Boston, and San Francisco

• Stadiums, arenas, and theme parks on cashless event days, where everyone taps to pay

• Hotel lobbies and conference floors, where bags sit close together for long periods

• Crowded festivals and farmers markets where contactless wristbands and cards are out constantly

Which of your cards actually broadcast a signal?

Not everything labeled a card is a radio. The cards that broadcast at 13.56 MHz, the frequency defined by the ISO 14443-A standard, include:

• Contactless bank cards (Visa, Mastercard, American Express, Discover tap-to-pay)

• US transit cards: OMNY (New York), CharlieCard (Boston), Clipper (San Francisco), ORCA (Seattle), Presto

• FIPS-201 government and federal employee ID cards

• Many hotel key cards and building access badges

Older 125 kHz access fobs exist, but your bank, transit, and ID cards are 13.56 MHz, and that is the frequency a verified RFID blocking sleeve is built to stop.

Does card tokenization mean you no longer need RFID protection?

This is the nuance most articles skip. EMV tokenization protects the payment transaction, not the card itself. The card still broadcasts, the card number and expiry can still be readable depending on the issuer, and transit and ID cards are typically not tokenized the same way as payment cards. So tokenization lowers the fraud value of an intercepted payment, but it does not make the signal disappear or protect the non-payment cards in your wallet. The risk in 2026 is lower than in 2012. It has not dropped to zero.

How do you actually stop RFID skimming?

RFID blocking is binary: either the signal reaches the card and a read happens, or a shielding material blocks it and nothing happens. The reliable fix is a sleeve made from a material that has actually been tested at 13.56 MHz. Alpine Rivers® sleeves use PolyShield™ polymer, which was independently verified to the US federal FIPS-201 shielding standard in 2016 (GSA Approved Products List #1424). That certification category has since been retired, so Alpine Rivers® does not claim a current certification, but the build still meets the same 13.56 MHz shielding performance it was measured against. Most RFID products have never been tested to any standard at all.

What should you look for in an RFID blocking product?

• It names a specific frequency (13.56 MHz), not just the word RFID

• It references a recognized standard (FIPS-201, ISO 14443-A)

• It points to independent verification, not manufacturer self-testing

• There is a public record you can check, such as a GSA APL number

Alpine Rivers® answers all four: 13.56 MHz, FIPS-201, an independent GSA process, and the public record GSA APL #1424 (2016). Each 18-sleeve pack (14 numbered card sleeves and 4 passport sleeves) is available on Amazon for typically under $20: go.alpine-rivers.com/bswx.

Frequently asked questions

Is RFID skimming common in the United States?

It is not an everyday certainty, but it is a real, low-cost-to-prevent exposure in crowded settings like airports, packed transit, and cashless events, where a reader can get within a few centimeters of your cards.

Which US transit cards can be read at 13.56 MHz?

OMNY in New York, the CharlieCard in Boston, Clipper in San Francisco, ORCA in Seattle, and Presto all operate at 13.56 MHz, like contactless bank cards and FIPS-201 IDs.

If my cards are tokenized, do I still need RFID blocking?

Tokenization protects the payment transaction, not the card. The card still broadcasts, and transit and ID cards are typically not tokenized the same way, so a sleeve still removes the exposure entirely.

What actually stops RFID skimming?

A sleeve made from a material tested at 13.56 MHz. With a verified blocking material between the reader and the card, no data exchange can occur. Alpine Rivers® PolyShield™ polymer was independently verified to FIPS-201 in 2016 under GSA APL #1424.

How much does RFID protection cost?

An Alpine Rivers® 18-sleeve pack (14 card sleeves and 4 passport sleeves) is typically under $20 on Amazon and protects a whole household's cards and passports.

Practical security, not paranoia. Move freely. Live fully. - the Alpine Rivers® team