The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Yes, a smartphone was used to trigger flaws in some NFC payment readers—but that does not mean a phone alone can make an ATM dispense cash. Researcher Josep Pi Rodriguez reported that a specially crafted contactless message could crash certain readers or, in some cases, enable code execution. The ATM cashout scenario he described required additional vulnerabilities in the ATM’s software and was not demonstrated in WIRED’s 2021 report.
What was the NFC vulnerability?
The issue was in how some payment readers handled NFC application protocol data units, or APDUs: messages used in communication between a contactless device and a reader. WIRED reported in 2021 that Rodriguez found readers that did not properly validate an APDU’s size. A custom Android app sent an unusually large, carefully crafted message—described as hundreds of times larger than the reader expected—and triggered a buffer overflow.
A buffer overflow happens when software writes more data into a memory area than it can hold. Depending on the device and flaw, the result can be a crash or a more serious effect such as executing code. IOActive’s August 10, 2023 DEF CON 31 event page described code-execution vulnerabilities involving specially crafted APDUs in both bare-metal reader firmware and Android- or Linux-based devices. That describes findings across the research, not a claim that every NFC terminal or every attack produced code execution.
Recommended Free Tools
What could an attacker do to a compromised reader?
WIRED attributed several possible consequences to Rodriguez’s findings. The precise outcome depended on the reader and vulnerability; a reader flaw should not be confused with a demonstrated compromise of every connected payment system.
#1 Best Overall
- SECURE YOUR WALLET FROM e-PICKPOCKETING: Prevent potential identity and financial theft through your contactless cards. This is the simplest and most effective prevention solution! Block RFID and NFC signals, protect your personal information, and enjoy peace of mind wherever your travels or business take you.
- JAMMING CHIP: An antenna and jamming chip makes up the main components of the card. The antenna will sense incoming radio waves and draw power for the chip to create a jamming signal. Lifetime usage as the card does not require battery.
- BROAD WORKING DISTANCE: With a 2.4” working distance, your entire wallet stays protected. The premium RFID blocking card helps secure cards within 1.2” on either side, providing reliable protection against electronic pickpocketing.
- ULTRA-THIN & COMPACT: At the size of a standard credit card and at only 0.03” thick, the card will fit into any wallet, purse or card case. Keep your wallet compact with no added bulk from this card. Best for travel, business, and everyday use.
- TEST THE CARD: Test the card is working at your local supermarket. At the self-service checkout machines, combine the card and a contactless card on the payment reader. Payment with the contactless card will be blocked and an error message should occur on the reader.
- Disrupt the reader: a malformed message could make a device crash or stop reading cards.
- Run code on some devices: the later IOActive disclosure described code execution through NFC in affected reader implementations.
- Interfere with transactions: WIRED reported that Rodriguez demonstrated changing transaction values or logic for later transactions. ThinkstScapes’ Q3 2023 summary said a demonstration altered subsequent transaction logic while the host system and LCD showed nothing unusual.
- Collect magnetic-stripe data: WIRED reported card-data collection and transmission as a possible consequence of reader compromise.
- Lock a reader: WIRED also reported a ransomware-style lock screen.
These findings do not establish theft of a cardholder’s PIN or EMV-chip data. Karsten Nohl of SRLabs, who reviewed the work, told WIRED that the reader attack could expose magnetic-stripe data, but would not give an attacker the victim’s PIN or chip data.
Did Rodriguez show a phone making an ATM dispense cash?
No. WIRED’s 2021 report said the cashout scenario depended on additional vulnerabilities in ATM software, separate from the NFC-reader flaw. Rodriguez did not disclose those additional bugs under vendor nondisclosure obligations, and the report did not include a cash-dispensing demonstration. WIRED said the video it reviewed showed an ATM reader displaying an error and then failing to read a card—not dispensing money.
Rank #2
- RFID Protection: An electromagnetically opaque layer helps block unauthorized scans, protecting credit card, debit card, and passport information from nearby readers; This RFID blocking card helps prevent digital skimming by shielding your wallet from electronic theft
- Threats Stay Outside: Digital pickpockets use hidden readers to skim contactless cards in crowds, transit and checkout lines; This credit card protector works as an RFID blocker the moment it's placed in your purse or wallet, stopping electronic theft before it occurs
- Invisible Yet Active: Ultra-thin and sized to fit any wallet slot, this rfid blocking card adds no bulk; Invisible protection helps shield your debit cards and IDs from electronic skimming without changing the way you carry your wallet
- One Card Protects All: Forget slipping every card into a separate RFID sleeve, just one RFID blocking card protects every contactless card, passport, and license all at once; Carry it in a purse, travel pouch or cardholder and stay shielded at airports, transit hubs and during daily commutes
- Drop and Defend: Keep the RFID blocking card in your wallet or travel bag, or save it as a backup; Simply insert it alongside your credit and debit cards for immediate protection against identity theft — no charging, no setup
So “a phone can hack an ATM” is an incomplete description. The reported phone-based technique targeted an NFC reader. A cashout would require the reader compromise to be chained with other weaknesses in the ATM itself.
Which devices and companies were named?
WIRED’s 2021 account named ID Tech, Ingenico, Verifone, Crane Payment Innovations, BBPOS, Nexgo, and an unnamed ATM vendor among the companies whose devices Rodriguez said he had examined or found affected. The report does not establish that every model made by those companies was vulnerable.
Rank #3
- 1. [Blocks 13.56MHz Thieves Cold] This RFID Blocking card works on the 13.56MHz frequency (most common for contactless cards/passports/IDs). Built-in antenna + jamming chip detects radio waves and emits anti-scanning signals—stops high-tech pickpockets, keeps your cards/IDs/passport safe from data theft.
- 2. [Lifetime 24/7 Protection] No batteries, no charging—works 24/7/365 non-stop. Just slip 1 card into your wallet or passport holder, and you’ll get instant dual-sided defense. Perfect for daily runs, shopping trips, or travel—shield your identity and finances from theft, no extra effort needed.
- 3. [Ultra-Slim & Hassle-Free] Same size as a standard credit card, only 0.03in thick—slides right into wallet slots, cardholders, or even pockets without bulking things up. Best of all: 1-2 cards protect all your sensitive cards in the wallet. Save space, skip the hassle.
- 4. [Practical Gift for Loved Ones] Each pack comes with 5 RFID blocking cards—small, powerful, and thoughtful. Give family and friends the peace of mind that their credit cards and passports are safe—an ideal gift for any occasion.
- 5. [24-Hour Customer Support] Thank you for choosing our RFID blocking cards. If you have questions, concerns, or need help, our team is here for you 24 hours a day. We’re committed to solving issues quickly and ensuring you have a happy, worry-free shopping experience.
IOActive’s 2023 DEF CON event page described findings in NFC readers used in major ATM brands, portable point-of-sale devices, gas stations, vending machines, and transportation systems. ThinkstScapes’ Q3 2023 summary characterized the research as involving “almost 10 different OEMs” integrated into “thousands of devices.” Those are descriptions of the research findings at that time, not a current count of exposed machines or a model-by-model list.
Were the vulnerabilities fixed, and are devices still at risk?
The published accounts describe historical disclosures, not the current patch status of particular machines. WIRED reported disagreement about the significance and remediation of some findings:
Rank #4
- Secure Your Information: Simply insert the RFID blocking card into your wallet to protect against digital pickpocketing. Block unauthorized scanning of your contactless cards, including credit/debit cards, passports, driver's licenses - to safeguard your identity and financial security
- Effective Protection: Our RFID blocking card utilizes advanced electromagnetic shielding technology, which features an embedded antenna mesh and chip that instantly detects and scrambles scanning attempts, providing consistent and reliable protection for the entire wallet
- Ultra Slim & Easy to Use: Credit-card-sized and just 0.03 inches (0.76 mm) thick, it slips easily into your wallet, purse or card holder adding no bulk. No charging or batteries needed. It will not demagnetize other cards, nor interfere with your phone signals
- A Thoughtful Gift: Give the practical gift of security. Effortlessly protecting your loved ones from digital theft – offering instant peace of mind, which is a truly meaningful way to show your care
- Test the Card: Test our RFID blocking card at self-checkout: Layer your contactless card with our RFID card on the reader - payment fails instantly, error message pops up
- Ingenico: the company told WIRED that its mitigations limited the reported technique to crashes and that it had issued a fix because of customer impact. Rodriguez questioned the mitigation but had not built a proof of concept against it.
- Verifone: the company said it had fixed vulnerabilities it found in 2018. Rodriguez told WIRED that he later encountered a vulnerable device.
Neither that historical exchange nor the 2023 research summaries establish whether a specific terminal or ATM is vulnerable today. The reviewed sources do not provide a complete list of affected models and firmware versions, a current remediation rate, or an industry-wide count of unpatched devices. Determining the status of a particular machine requires current vendor information or an authorized device-specific assessment.
Free tools Windows power users keep installed
One-click scans. No signup required.
Why was an Android phone used?
The phone was a way to send the crafted NFC message, not a special tool that independently defeats payment security. WIRED described a custom Android app, while ThinkstScapes’ Q3 2023 summary said Pixel devices gave Rodriguez enough flexibility in NFC handling to send the larger packet. That explains the research setup; it does not mean ordinary phone tapping can reproduce the attack, or that a phone by itself can complete the ATM cashout scenario.
Quick Recap
Best Value
- 1 Protect your wallet;RFID card blocker protects all your contactless smart cards, such as credit cards, ATM cards, ID, passports, and driver's licenses. Simply place the card in your wallet, and it offers complete protection against scanning and data theft.
- 2 Effective protection; Our RFID-blocking card, compatible with all standard-sized cards, utilizes the latest 13.56 MHz RFID/NFC technology. It emits a jamming signal that disrupts radio frequency signals within a 2.4-inch range (1.2 inches on each side), efficiently secure your entire financial and identity information
- 3 Ultra-thin design;The Matte Surface Design offers fingerprint resistance and features an ultra-slim profile, ensuring a perfect fit for any clip holder.his RFID card blocker seamlessly integrates into wallets or purses without adding bulk.
- 4 The perfect gift；Our RFID-blocking cards make excellent gifts for family and friends, providing them with added peace of mind knowing their wallets are secure
- 5 PERFECT SERVICE5: Thank you very much for purchasing our products, to provide customers with satisfactory products and services is our eternal pursuit, at any time if you have any questions, please feel free to contact us, we are very happy to help you,
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
