# RFID Theft of Pasport Info **URL:** \ **Category:** Factual Questions\ **Created:** [September 28, 2015, 12:48am UTC](https://boards.straightdope.com/t/rfid-theft-of-pasport-info/732782 "2015-09-28T00:48:28Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![UncleFred](https://avatars.discourse-cdn.com/v4/letter/u/f0a364/32.png) [@UncleFred](https://boards.straightdope.com/u/UncleFred)\ **Post date:** [September 28, 2015, 12:48am UTC](https://boards.straightdope.com/t/rfid-theft-of-pasport-info/732782/1 "2015-09-28T00:48:28Z")
On one hand I’ve been hearing that hackers can scan your passport (the newer ones with RFID chips) and get your critical information and then go off and do all the bad things associated with identify theft. There is a market for rf-blocking products to protect against such behavior. On the other hand I’ve been hearing that those hackers don’t get anything useful - the hackers don’t have access to the encryption key that truly gine them access to your data. The only time they can get your info is if they ‘snoop’ while your passport is being scanned by a valid security agent. I find the later a little suspicious in that (to my experience) customs agents don’t scan your passport - at most they look at your photo-id to verify you are you. ANy ‘scanning’ is done at the kiosk where I have to insert my passport and the machine scans it. I have to assume that has shielding against transmission. So, what’s to scoop on hackers accessing my passport? ---
**Author:** ![jasg](https://avatars.discourse-cdn.com/v4/letter/j/f0a364/32.png) [@jasg](https://boards.straightdope.com/u/jasg)\ **Post date:** [September 28, 2015, 3:02am UTC](https://boards.straightdope.com/t/rfid-theft-of-pasport-info/732782/2 "2015-09-28T03:02:12Z")
I have an RFID drivers license. When scanned by hack #1, it returns a number. A hacker can take that number and use it to look up my record in the state database (hack #2). That record must then be decrypted (hack #3) to get my information. Color me not worried. Might be one step less with my passport, still not worried. ---
**Author:** ![Kiwi\_Fruit](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/kiwi_fruit/32/12_2.png) [@Kiwi\_Fruit](https://boards.straightdope.com/u/Kiwi_Fruit)\ **Post date:** [September 28, 2015, 3:30am UTC](https://boards.straightdope.com/t/rfid-theft-of-pasport-info/732782/3 "2015-09-28T03:30:04Z")
As far as I knew, the biometric passports only have the information that’s printed in the passport. Height, eye colour, etc and the picture. It’s so the kiosks can check against that when they take your photo. If a human checks your passport they don’t need to do that as they can read it in plain english/Maori (if it’s a New Zealand one). ---
**Author:** ![jasg](https://avatars.discourse-cdn.com/v4/letter/j/f0a364/32.png) [@jasg](https://boards.straightdope.com/u/jasg)\ **Post date:** [September 28, 2015, 4:29pm UTC](https://boards.straightdope.com/t/rfid-theft-of-pasport-info/732782/4 "2015-09-28T16:29:56Z")
I need to renew my passport, so the OP made me curious. A little googling gives lots of hits for RFID protectors, quite a few portents of doom articles for a few years starting around 2006, then not so much. Even noted security guru Bruce Schneier seems to have stopped talking about the risks. Also lacking are any reports of actual theft of passport data. I did find one scolarly [article](https://queue.acm.org/detail.cfm?id=1626175), an ACM paper from 2009 that might answer some of your questions. It concludes with : > [@ACM Study](#): > > Having looked at the potential attack, the costs of that attack, and the returns, we can now ask how concerned we should be about such an exploit. Should you really be worried as you walk through the airport that someone behind you might be stripping you of your passport information in a grand scheme to rob you? > > The technical hurdles are surmountable, at least in proof-of-concept demonstrations. It is possible that such an attack could occur, but this possibility needs to be balanced against the complexity of the attack, the difficulty of obtaining the required high-priced blank passport, and the limited return the attack is likely to produce. > > It seems much more likely that most perpetrators would resort to old-fashioned means of stealing your passport information, by stealing your physical passport itself. We recommend that it is more important to be careful about keeping your physical passport safely in hand than to be wary of perpetrators lurking behind you in line at the airport attempting to exploit the RFID tag in your passport. ---
**Author:** ![Omar\_Little](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/omar_little/32/269_2.png) [@Omar\_Little](https://boards.straightdope.com/u/Omar_Little)\ **Post date:** [September 29, 2015, 7:37pm UTC](https://boards.straightdope.com/t/rfid-theft-of-pasport-info/732782/5 "2015-09-29T19:37:27Z")
Color me stupid, but what is a hacker going to do with my passport # that I need to be worried about? He’s not going to apply for credit with it. He’s not going to rent an apartment with it. He’s not going to enroll in University with it. I guess if he was really good at forging US government documents, he could make fake passport with my number on it, and enter another country as me. But should I really care? I guess if he was a terrorist and did terroristic things in my name, I probably might care, but I’m thinking that the probability of that occurring is pretty low. ---
**Author:** ![kferr](https://avatars.discourse-cdn.com/v4/letter/k/71e660/32.png) [@kferr](https://boards.straightdope.com/u/kferr)\ **Post date:** [September 30, 2015, 1:43pm UTC](https://boards.straightdope.com/t/rfid-theft-of-pasport-info/732782/6 "2015-09-30T13:43:18Z")
There are two types of RFID passports. On the older version the only data that is stored on the RFID chip is what you can see on the picture page. These passports are protected with what is called Basic Access Control. BAC insures the integrity and authenticity of the chip and prevents eavesdropping between the passport and the passport reader. The newer biometric passports also contain things such as your fingerprints and/or iris scans. These use Extended Access Control which is a layer on top of BAC and is used to unlock the biometric data stored on the chip. If you have an NFC enabled smartphone you can get a passport reading app. For a BAC protected passport the ‘password’ for the chip is the machine readable code at the bottom of the picture page. The app used the camera to scan this then you hold the passport to the phone and it will read the data and show it to you. ---
**Author:** ![Really\_Not\_All\_That\_Bright](https://avatars.discourse-cdn.com/v4/letter/r/e8c25b/32.png) [@Really\_Not\_All\_That\_Bright](https://boards.straightdope.com/u/Really_Not_All_That_Bright)\ **Post date:** [September 30, 2015, 1:53pm UTC](https://boards.straightdope.com/t/rfid-theft-of-pasport-info/732782/7 "2015-09-30T13:53:36Z")
> [@Omar\_Little](#): > > Color me stupid, but what is a hacker going to do with my passport # that I need to be worried about? > > He’s not going to apply for credit with it. He’s not going to rent an apartment with it. He’s not going to enroll in University with it. He can get your full name and date and place of birth with it, and find out lots of other handy information about you with those. But I’m not worried either.