RFID and Biometric Shielding

RFID (Radio Frequency Identification) technology allows digital information to be securely exchanged to and from a microchip using the principle of electromagnetic induction. This uses either High Frequency (HF) magnetic induction or Ultra High Frequency (UHF) transmission and reflection. The exchange of information is based on asynchronous half-duplex character transmission protocols.

Any smart card, tag or ePassport that does not have its own power source is referred to as a passive RFID device. To function, passive RFID systems require a powered master device, which is a reader, to energise the slave device, such as a contactless tag, by a time-varying electromagnetic radio frequency (RF) wave that is transmitted by the reader. This is typically referred to as inductive coupling between tag and reader. This interaction then makes it possible to transfer power to the card through alternating magnetic field or pulses, allowing information to be transferred by a modulating magnetic field.

Most smart card based RFID systems operate at 13.56 MHz frequency range based on the ISO-14443 standard. Other industry standards such as EMV (for banking cards) and ITSO or Calypso (for transport cards) will be used depending on the application. At 13.56MHz, coupling to allow for the secure exchange of data can only be achieved at distances up to 10 centimetres. Thus when any ISO-14443 compatible reader is placed within 10 centimetres of a passive RFID device coupling will occur. There is no means to “turn- off” the passive RFID device to prevent coupling and therefore it is always possible to detect a passive tag within a short-distance if a reader is presented, no matter if the RFID device is concealed or not.

At the logical level, a passive tag and reader will communicate by exchanging Application Protocol Data Units (APDUs), which are simply sequences of bytes in an identifiable format. This half-duplex form of communication is generally governed by ISO7816-4 standards. The way a passive card responds to any logical command instruction from the reader can be evaluated as this communication is not secured like the encryption protocols used to protect the data stored on the tag. It has been found that not all passive tags or ePassports respond correctly to a range of optional commands and command errors, allowing the reader to determine the supplier / manufacturer of the tag or ePassport through this process.

Thus there are three inherit weaknesses with the use of passive contactless tags, cards or ePassports.

1. Passive tags, cards or ePassports can always be detected by a reader regardless of whether they have been concealed or not. This is a significant distribution issue, as personalised contactless tags, cards or ePassports can readily be detected within envelopes while in transit through the post;


2. The basic identity of passive tag, card or ePassport can be determined by exploiting the fingerprinting technique. This allows for targeting of specific contactless products (for example it may be possible to detect a particular type of contactless banking card or it is possible to detect the nationality of some ePassports); and


3. As most passive tags, cards or ePassports are issued “live” following personalisation there is no means to prevent fraudulent “first-use” of such products – that is, if any passive product has been intercepted before they reach the intended owner, these products can be freely used until such time as the product has been reported missing or the fraudulent activity has been detected in the back-office (which is highly unlikely as there is no reference point to base personalised transaction case history).

The Distribution Dilemma

There is a ten-fold price premium between the cost of standard post versus other distribution methods. This is a significant cost driver if postage was the primary means of distribution for personalised contactless products. For example, if 100,000 contactless cards were distributed by registered post instead of standard post, the cost difference would be 470,000 Euro (based on the costs shown in the above diagram).

Thus it is unusual for an organisation to absorb these costs and therefore these costs are typically paid for by the customer, unless other security measures are put in place. For example, in the case of passports, customers appears to accept this cost premium as more than three quarters of customers pay the 8 Euro premium for the Passport Express service. In the case of bank and credit cards, most cards are sent via standard post with additional security messages, such as a posting a separate chip and pin code and having procedures in place for the customer to initialise the card once received, in order to reduce card fraud and identity theft.

The other form of distribution of personalised contactless products is typically customer collection from a distribution point. Whilst giving ultimate assurance for the customer, this is often inconvenient as the collection times are typically during business hours and involves travel to the collection point, which would be a cost born by the customer.

The alternative method, which is most often seen with contactless transport cards, is the dispensing of non-personalised cards from a vending point and having a post-purchase registration process whereby the customer registers the unique card identifier against their personal details - thereby personalising the card against their name. In this case there are no physical features on the card to show that the card is personalised and the personalisation record is purely electronic with the records typically held back-office rather than on the card itself.

Cost of card replacement is more than you think

The full organisational cost to re-issue a contactless card can easily reach up to 20 Euro per card. This does not take into account any cost or inconvenience caused to the customer, or any damage caused to goodwill or trust about the integrity of the system (especially in the case of Identity Theft). Generally there will be three key steps to get a replacement card back to the customer.

1. The customer has to firstly report that their personalised contactless product has been lost, damaged, mislaid or stolen. This would typically involve a customer service or call centre cost for processing the customer report.


2. A fail-safe administration process will then be required to cancel card and to amend back office systems by updating the card revocation or black-lists. There would be a cost associated with this process. Depending on the design of the transaction model being used, a process may also be needed to post updated lists to all front office systems.


3. Another fail-safe administration process will be required to restore the customer's original information onto the replacement contactless product and to dispatch this product to the correct address or get the customer to collect. Additional card personalisation and mailing or collection costs would then apply.

Toppan's Info Armour^®

RFID shielding is seen as a simple cost-effective mechanism to incrementally enhance the security of passive RFID products by mitigating the risk of these weaknesses impacting the end-customer and thereby affecting their trust in contactless technology.

Toppan identified the need for an RFID shielding product (Info Armour^®) based on their intimate knowledge of RFID technology, ID solutions and paper-based securities.



Info Armour^® is a specially developed and patented 'triple wafer' foil and paper product incorporating the Faraday Cage principle.

Its uniqueness is that it is readily adaptable to most ready-converted and pre-printed stationery. It can be supplied as 110gsm or 350gsm in weight. Thus Info Armour achieves the synergistic benefits of effective RFID shielding with a printed means of communication to the end-user.

A single sheet of Info Armour^® is effective at blocking the coupling process between reader and contactless device no matter when placed above or below the device. Info Armour^® can therefore be used to prevent the detection of a contactless device when concealed, thereby providing a simple and cost-effective solution for postal distribution.

Gerriko is a distributor of Info Armour in Ireland.