It took me a while to find more information on whether ExpressPay was optional or not. The official page for the Zync card doesn't even mention it, and American Express does not make an e-Mail address or web form available for non-cardholders. So I contacted them via telephone and AskAmex, their official customer service contact on Twitter. At first I got contradictory information on whether the chip was optional or not. But the final word was that it was built in, and the card could not be procured without an RFID chip.
I didn't get the card because of this. "Why?," you ask. Well, let's just say that RFID and I don't see eye to eye.
Wrong in Implementation
Now, don't get me wrong, I don't think RFID is all bad. There are legitimately logical uses for RFID. It's the technology behind key fobs and badges which have have long been used in banks, businesses, schools and government to open doors and parking gates. It can be used for store security and inventory tracking.
In fact, probably the first exposure most people had to RFIDs were those square tags in CDs and other products that sound the alarm at the exit if they're not properly deactivated. That's a tiny RFIDs at the (more or less) center. The larger area around it is the antenna. Instead of using internal batteries, RFIDs pick up the energy they need to work via electromagnetic induction, usually from the "reader" (in the case of store merchandise, from the exit gates).
Far from those humble beginnings, more sophisticated RFIDs are now being used to transmit financial information wirelessly, à la "ExpressPay". Is it convenient? Perhaps. But in return for the arguable convenience of not having to physically swipe your card, it opens up a whole slew of security and privacy issues.
One of the issues is the weak encryption being used. It's already been cracked. American Express used to offer some of their cards without RFID chips when they first started using them, but they no longer provide this option. Instead, a representative offered to disable the ExpressPay feature for me. That means that charges made using this wireless method would be refused, which does protect the user on some level from unauthorized purchases.
However, the chip is still active and functional and will gladly transmit all the card holder's personal information to anyone who is listening. The representative assured me that the range at which the information could be read was limited to a few feet, but he has not seen what some talented hackers have been able to do, and the equipment and techniques to do so just keep getting better.
Somebody's Tracking You
Then, there are other implications. The same information that could be used for identity theft can be used to track a card holder's movements. And it's not just stalkers and government agencies who would be interested in that, it's the card issuers themselves! Check out this patent filing from American Express.
The idea here is to use the embedded RFID to track a card holder's movement through say, a grocery store, observe and record what products or category of products an individual looks at (information provided by RFID readers placed at strategic points throughout the store) and for how long. And why all this invasion of privacy? To provide you with targeted and personalized ads, and find more ways to manipulate you into spending more money.
It seems that the primary reason behind putting RFID chips in credit and charge cards is to make charging items an even easier, almost impulse action while gathering more information about you to get you to use your card more often, all in the name of the corporate bottom line.
Cut It Out
The tradeoff may be worthwhile for card issuers, but it's certainly not worthwhile for the customer, which is perhaps why card companies are so quiet about RFID and rarely even refer to them as such. They may tout the dubious benefits of contact-less payments, but they won't give you the important details. Oftentimes a regular card suddenly becomes an RFID card the next time it is issued. Such was the case with my Chase Debit card, which I have since cancelled.
Before cutting up my card however, I took it upon myself to attempt to cut out the RFID chip itself. I pretty much butchered the RFID and no doubt broke it in the process, but more careful carvers will be able to remove a perfectly functioning RFID chip. Below are the before and after pictures of my card. Click on the pictures for the full images.
The Customer Decides
To deactivate the chip some people recommend smashing it, cutting it out, using a hole puncher, putting the card in the microwave (which I don't recommend), or an aluminum wallet or sleeve to block the signal. While these may all be acceptable temporary fixes, why should we settle? Admittedly you can do any of these things and just use the magnetic strip as usual. But there may be a time when card issuers drop the magnetic strip altogether in favor of an all-RFID "solution", if they want you to use it bad enough.
The fact is that these products exist for us. We are the customers. And we have the power both individually and collectively to decline, though sadly most of us don't often realize this. Every time you reject or cancel an RFID card you send a message to the card issuer and the industry as a whole. Even better if you let them know why. Eventually it adds up. The product that is rejected by the customer will not be financially successful and will simply drop from the marketplace. We've suffered enough abuse at the hands of the credit card industry. Let's not let them play fast and loose with the security of our personal information. Let's not make it even easier for identity thieves.














