I Dissolved My Credit Card To Understand How It Works

In 1945, Soviet schoolchildren gifted the US ambassador a hand-carved plaque concealing «The Thing» — a listening device with no battery or power source. It remained undetected for seven years because it only activated when the Soviets blasted it with radio waves from outside. The device used a resonant cavity whose frequency changed as sound vibrated a diaphragm, modulating the reflected radio signal to carry conversations back to eavesdroppers. When the CIA finally discovered it in 1952, they kept the find secret and reverse-engineered the technology for their own use.

This same principle — using radio waves to both power a device and extract data — would eventually evolve into RFID and near-field communication. Leon Theremin, the inventor coerced into building the bug while imprisoned in a Gulag, had unknowingly created the foundation for modern contactless payment. The CIA's Project Easy Chair refined the concept by adding a rectifier and amplifier, hiding listening devices inside furniture legs at the Soviet embassy in the Hague. Decades later, engineer Mario Cardullo adapted this for toll booth tags, and by the 2000s, the same technology powered credit card tap-to-pay.

Contactless cards communicate via near-field magnetic induction, which requires proximity of about two centimeters. This enables «ghost tapping» or digital pickpocketing: an attacker with a hidden reader can extract card data through clothing. While the cryptographic protections prevent cloning, the attacker can still authorize a real transaction if close enough. In 2025, a woman was arrested in Rome for tapping tourists' cards in crowded streets, potentially draining accounts one transaction at a time.

Most countries impose transaction limits — the UK caps contactless at 100 pounds — but the United States has no such restriction. That means a single tap could authorize thousands of dollars. Tony Sales imagines embedding readers in subway turnstiles or narrow walkways, harvesting hundreds of cards daily. Countermeasures include Faraday cage wallets, carrying multiple cards together to interfere with reads, and enabling real-time bank notifications. But the safest approach may be abandoning physical cards entirely for mobile wallets — though even those have emerging vulnerabilities.