Is this RFID blocking wallet actually secure?

Question

This question is based on a quick experiment that I ran when questioning the effectiveness of my RFID blocking wallet (this one). In my experiment, I walked out of my office, placed my RFID id card in the wallet, and attempted to use the wallet containing the card to open the office door. To my surprise, the door opened with no issue!

My question is this: does the opening of the door indicate that this RFID blocking wallet is not actually doing it's job? I physically tap the wallet against the reader in order to open the door, so does the wallet just reduce the effective range at which the card can be read? Without the wallet, the card also needs close proximity (within a few cm) to the reader to open the door.

Edit: reading this question's accepted answer, it is mentioned that RFID frequency can vary- would it be reasonable to assume that the difference in operating frequency between a credit card and ID badge would be large enough to cause a credit card but not ID badge to be obfuscated by the wallet?

Edit #2: I went back to try some more controlled experiments based on the answer by @Herringbone Cat and comments from @AdamShostack below. Varying the orientation of the card does not appear to make any change. HOWEVER, I tested for distance at which the card could open the door, and found it effectively halved by the use of the wallet.

In terms of frequency vs. power, I would not expect power to be the issue here, as this is a passive card (should have specified earlier). I would expect a malicious RFID reader to be of arbitrary power, and therefor comparable to the door reader at a minimum. Investigating further, I suspect that my ID card is this brand, which has an operating frequency of 13.56MHz. This is the operating frequency for credit cards as well.

That said, halving the range a reader must be to the card may be an effective deterrent for RFID card theft.

Answer 1

It appears as though this RFID blocking wallet is simply not forming a strong enough faraday cage, and sufficient amount of RF power is able to simply go through the "RFID blocking" wallet; or it's not a complete seal and it simply goes around. This means the product was likely poorly made, and at the least, clearly defective.

RFID Obeys Inverse Square Law

Radio waves, like all other forms of electromagnetic energy, obey inverse square law. So, holding it closer does exponentially increase the ability to send/receive radio from the transmitter to card. In this case, holding it closer allows it to be read in the wallet....meaning the wallet is somewhat blocking the waves, but not enough.

Frequency vs. Power

It's not necessarily just the operating frequency of the RFID card that matters here, but the amount of power that the receiver/transmitter is using. If it's a passive tag, then only the receiver is powered -- meaning the RFID blocking wallet would be more effective. Active tags have a battery and their own transmitter, and depending on the freshness of that battery and the electronics within can make a much stronger signal than other RFID cards.

Most RFID cards these days are HF/UHF, with LF being seldom used. UHF/HF RFID cards will work at a much greater range =than the lower frequency cards. However, credit cards are typically passive while door tags active..which probably explains the experience here moreso than the frequency difference.

High-powered RFID receivers (like those used for hacking) can scan RFID cards remotely at distances of up to 10 meters.

Going around the shielding

In the case of poorly designed RFID "blocking" wallets, there is often room for the omnidirectional radio waves to essentially seep out of the wallet through a fold. This is because it's not 100% sealed, and as such not a true Faraday cage. By contrast, an Altoids tin container can typically block 100% of attempts at reading RFID cards held inside...if it's kept shut, once the lid is open or even ajar the card can be read.

Thus, in order to defeat RFID-reading based hacks, you'll need an RFID-blocking wallet that forms a strong enough Faraday cage (thick enough to attenuate RFID HF) and has sufficient insulation and sealing to prevent being read by high-powered readers.

Answer 2

Captain Calvert, this video demonstrates how shielding reduces the read range quite effectively, it may not have your wallet, but visibly demonstrates the reduction in read range and compares different shield products. https://youtu.be/LTVxe9sEUE4

Answer 3

Short version: try your experiment using 13.56mHz inlays to see how well your wallet blocks 13.56mHz RFID.

It's possible you've set up a poor experiment if you want to determine how well your wallet blocks signals from payment cards.

Edit: reading this question's accepted answer, it is mentioned that RFID frequency can vary- would it be reasonable to assume that the difference in operating frequency between a credit card and ID badge would be large enough to cause a credit card but not ID badge to be obfuscated by the wallet?

There are stark differences in how different kinds (UHF/HF/LF) of RFID transponders function. For example, most unshielded passive ultra high frequency (UHF) inlays are rendered completely useless when in contact with metal surfaces while high frequency (HF, think NFC) inlays are practically unaffected. Typical UHF inlays also tend to be built to be highly directional while HF tend to be omnidirectional. Not all of these differences are due to the frequency range used, but rather some are differences manufacturers (who use frequency ranges to group their products) build in.

Most access control systems I've used were on the low frequency (LF) range of the spectrum (as are many HID products).

I suspect that my ID card is this brand, which has an operating frequency of 13.56MHz

The page you linked is documentation for HIDs 125kHz cards/readers line, which is very commonly used for access control and also LF RFID, as opposed to the 13.56mHz you correctly stated is used for payment. This is a suboptimal item to test how well your wallet blocks HF(13.56mHz) due to the potential differences in the way HF and LF RFID transponders work.

I suggest you try your experiment using a wireless payment card and kiosk to get more useful data. Alternatively, you could try using a phone since as of a few months ago (written late 2018) even iOS devices have had their NFC readers enabled so you should be able to find an application to let your read NFC(HF RFID) inlays. If you have trouble getting a card to read (there are security measures that will prevent an RFID transponder from responding, I'm not familiar with what payment systems use) you might try getting a wireless transit pass as a test card if available. Most bus/rail cards that have wireless capability rely on NFC (HF RFID) technology and would be more suitable tests. For that matter, you can purchase NFC inlays relatively cheaply (maybe a few USD per) online.

It's quite possible your wallet doesn't do it's job, but if you want to know for sure you should collect better data.

EDIT: reference to support my claims above that 125kHz/13.56mHz are LF/HF respectively.