A relay attack does not need a reader pressed to your pocket: a Zurich team pushed the read distance out by 40 to 50 cm with a rig built from under $100 of parts, and a Cambridge lab carried a card's signal 50 m from the card to the terminal it was fooling. The sceptic has heard numbers like these before and does not buy them. Nobody has ever stood behind you in a queue holding a card reader. A wallet lined with metal looks like an answer to a crime that never quite arrived.
That is the sceptic's case, and it is a good one. It is also about half right. The half it gets wrong is not whether a stranger can read your card. It is how far away that stranger has to be, and that distance did not stay where the standard put it. Relay fraud has been documented in criminal use in 2025 and 2026, though in those cases the victim was talked into tapping. The extended-range read is still a lab result, and the kit that produced it is cheap.
We sell RFID-blocking wallets, so weigh our conclusion with that in mind. The measurements below are not ours: they come from standards bodies and university labs, and they point to one question. How far can your cards be reached in an ordinary week? Only you know your week, which is why this piece ends with a fitting rather than a verdict on the category.
What the sceptic gets right
Start with the range, because it is the sceptic's best number. Contactless payments run on NFC, which in normal use works over about 4 cm (American Military University). The ISO/IEC 14443 standard underneath bank cards, transit cards and many ID cards defines close-range operation at 13.56 MHz at up to roughly 10 cm (GoToTags).
So the image of a thief brushing past you and lifting your card is mostly wrong. At 4 cm they would need a reader pressed to your trousers, and you would feel it.
The sceptic's second point is that a wireless read is not a copied card. Take that as read. The attacks that have actually been documented do not copy anything. They extend, and what matters for your week is what a thief does about that 4 cm.
Your commute: a card that can be reached from the next carriage
A relay attack does not read your card and store it for later. It reads your card here and, at the same moment, presents it to a payment terminal somewhere else, so the terminal believes a genuine card is sitting on it. Researchers at the University of Zurich built one from off-the-shelf parts for under $100 and extended the effective distance between reader and card by an additional 40 to 50 cm (University of Zurich). An extra 40 to 50 cm is about the gap between you and the next person on a crowded platform.
Under $100 of relay kit extends a contactless card's reach by up to 50 cm.
Cambridge researchers demonstrated a relay against an ISO 14443A contactless card in which the link between the two relay devices ran to 50 m (arXiv). The device at the card end still has to be within reach of the card, so the figure measures how far the fraud can travel rather than how far the card can be read. Research, the sceptic says, and a lab is not a street, so look at 2025. Security researchers identified RelayNFC, an Android malware family that intercepts contactless card signals and relays them in real time to a second device, so an attacker can pay as if your card were on the counter (Cyble). Kaspersky documented direct and reverse NFC relay attacks being used in 2026 to take money from victims who are told to tap their card or phone on a reader the attacker controls (Kaspersky).
That last clause is where honesty and the product meet. In the cases Kaspersky documented, the attacker still needs you to tap. In the lab they do not, and the kit is cheap. A wallet lining closes the second door, the read you did not agree to, and leaves the first door to your own judgement about which reader you tap, a judgement we covered in our piece on ghost tapping, the tap-to-pay scam.
For the commuter, the question is arithmetic you can do without us. Count the contactless cards in your pocket, then the hours a week they spend within arm's reach of strangers' phones. Our MANHATTAN bifold is built for exactly that pocket: 104 x 76 x 10 mm, 39 g, and its lining blocks close-range reads of every card inside it while it is closed. It does nothing for the card you take out, which is how it should be.
The lining does nothing for the card in your hand at a terminal, and everything for the 5 cards behind it.
Your passport: a shield somebody already decided you needed
Governments built a Faraday cage into e-passport covers, and that is the most persuasive endorsement this category has, since no wallet maker wrote it. E-passports carry an RFID chip built to the ICAO logical data structure, and the cover has a metallic shield built into it to prevent the chip being read while the passport is closed (arXiv). ICAO Doc 9303, the international standard governing how e-passports store and protect chip data, is what those covers answer to (Regula Forensics).
That has two consequences for the traveller. Your passport is already covered when it is shut, so a holder is not adding a shield the passport lacks. It is covering the 4 to 8 bank cards, the hotel key and the rail card that end up tucked into the back of the passport, none of which came with a Faraday cage.
Our KENSINGTON passport holder is lined for that reason and has space for 8 cards beside the passport, so the whole travel stack sits under one lining. The far larger travel loss is still the passport that leaves your possession altogether, which is why our guide on avoiding pickpockets while travelling spends more words on straps and pockets than on chips. A shield is a small part of a travel week. It is also the cheapest part to get right.
Your work pass: the card designed to be read without you
A building pass is the contactless card that is meant to be read while you pay no attention at all. Transit cards sit on the same ISO 14443 standard as bank cards and behave the same way at a gate (GoToTags). If your pass hangs on a lanyard all day, no wallet lining helps it, because it is outside the wallet.
You have two honest options. Keep the pass on the lanyard and accept that it is reachable all day, but keep your payment cards elsewhere, so the exposed card is not one that pays for anything. Or bring the pass inside the shield and let it out only at the door.
Our NOTTING HILL zip-around wallet has a self-retracting Smart Strap for the card you use most: pull the pass out on the strap, tap the barrier, and it retracts back inside a zipped lining that holds 6 to 10 cards, with a coin pocket and a key ring. The zip matters here. A card that is out is a card that can be reached, and the zip is the boundary you can hear closing.
What the lining does, and where it stops
Mechanism, plainly. A shielded wallet is a passive barrier: it stops a reader's field from reaching the chips inside while the wallet is closed, and it does this for every card in the stack at once. When you open it and take a card out to pay, that card is in the open, as it must be to work.
You do not have to take that on trust. The test costs nothing: leave a single contactless card inside the closed wallet, hold the whole wallet flat against the terminal at a purchase you are making anyway, and watch the reader. If the payment goes through with the wallet shut, the lining is not doing its job. Then open the wallet, take the card out and pay with it in your hand, which should work every time. A wallet that passes both halves is doing what the label claims, and one that fails the first half is a leather wallet with a story.
Bound the claim in the other direction too. The lining does nothing for the card in your hand at a terminal, and everything for the 5 cards behind it. It does not cover the phone in your other pocket, and it does not check whether the terminal you are tapping is honest, which is the question Kaspersky's 2026 cases turn on.
If you already own a wallet you like, our VAULTCARD does the same job by a different route: it draws power from a scanner's own field and emits a jamming signal that blocks reads of any RFID card within 4 cm of it, no battery required. Two mechanisms, one boundary: the cards that are put away.
The cost of being wrong, in each direction
Suppose you buy the lining and never need it. You were buying a wallet anyway, and the MANHATTAN is 10 mm closed with the lining in, so the sceptic pays for the shield in millimetres they cannot find.
Suppose instead you skip it, and the reach keeps extending. The distance the sceptic relies on is the 4 cm of a standard read, and the kit that added 40 to 50 cm to it in the Zurich test cost under $100, built from parts anyone can order. Relays have been in criminal hands since 2025, but the documented cases needed the victim to tap, and the extended read that would reach into a pocket remains a lab result. A lining changes nothing about caps or terminals. What it changes is how many of your cards are within reach while they ride in a pocket through a crowd.
That is the asymmetry. One mistake costs you a few millimetres you will not notice. The other costs whatever a relay is worth to someone standing up to 50 cm behind you, and the price of the wallet is the same either way.
Verdict: what we would carry, and who needs nothing more
Not everyone needs to think about this. If you drive to work, carry 2 cards and spend your week in a car, an office and your own kitchen, the lining already built into an everyday wallet such as our CHELSEA is more shield than your week will test. The choice between a cardholder and a fuller wallet is a separate question, and we have three checks for that with your own cards.
For the rest, the fit is decided by which of the 3 weeks above is yours. Here is what we would put in each pocket:
- The daily transit commuter with 3 or more contactless cards: the MANHATTAN(USD), 39 g in a front pocket, or the CITY(GBP & EUR).
- The traveller with an e-passport and a card stack: the KENSINGTON, one lining over the passport and 8 cards.
- The office worker with a pass that opens doors: the NOTTING HILL, with the pass on the Smart Strap and everything else behind the zip.
We would carry the CITY through London, and we say so as the people who make it. If your week has more crowd in it than a car does, the RFID wallets collection has the rest of the range.