RFID technology has been around for decades, and its use is proliferating in retail, manufacturing, warehousing and logistics, and other industries for the speed, efficiency, and accuracy it brings to inventory management and data handling.
But questions, myths, and misconceptions around RFID and data security persist.
Here we debunk five of the most common myths about this transformational supply chain data capture technology to help you understand why most companies don’t need specialized RFID security investments beyond general IT and enterprise data best practices.
Top 5 Myths Around RAIN RFID & Data Security:
- RFID Tags Are Easy for Hackers to Access Remotely
- Data Transmitted Via RFID is Vulnerable
- RFID-Transmitted Data is Like NFC Payment Data
- RFID Tags Can Be Easily Cloned by Counterfeiters
- Companies Need to Fortify RFID Equipment to Secure Enterprise Data
Myth 1: RFID Tags Are Easy for Hackers to Access Remotely
Some mistakenly believe RFID tags themselves are less than secure and can be easily scanned or “hacked” by unauthorized parties—say, near a dock door. But in reality, this is unlikely due to physical and technological constraints.
Since RAIN RFID devices operate within the ultrahigh frequency (UHF) band between 860 and 960 MHZ, these readers have a limited read range and usually require the reader to be within several feet of the tags it’s reading. A theoretical hacker would need to gain very close physical access to scan tags. And on its own, an RFID tag’s data is virtually meaningless to an outsider without access to backend databases.
While compromising an RFID tag is theoretically possible under controlled conditions, widespread remote hacking of RFID tag data is prevented by practical limitations.
RAIN RFID exchanges also happen really fast. They’re encrypted, and they include built-in data verification mechanisms. Given the security protocols, it would be tough to successfully intercept and decipher RFID data exchanges in transit. Nothing’s impossible, but real-world conditions make RFID data interception attacks unlikely.
Myth 2: Data Transmitted Via RFID is Vulnerable
Related to the remote hacking myth, some assume the data communication between an RFID tag and reader is easily intercepted or “sniffed” from the air. But in reality, RAIN RFID transmissions aren’t particularly at-risk.
GS1 retail RFID tags typically contain standardized product identification and attributes to enable supply chain automation, visibility, and loss prevention. But they do not encode sensitive information beyond basic item details. At most, a scanned tag is likely to reveal product information similar to what’s included in a barcode, such as:
- Global Trade Item Number (GTIN): uniquely identifies the product, which allows tag data to be matched in a product database
- Unique serial number assigned to that specific item, which enables item-level tracking and tracing
- Batch or lot number that the item belongs to, which is especially useful for recalls and inventory management
- Expiration dates on perishable goods help manage stock rotation and keep expired items off retail shelves
- Production or manufacture date, also useful for perishable/expiry monitoring
- Electronic Product Code (EPC): encodes the above data into a compact data structure
Industry data standards like GS1 actually help improve RFID security. When companies follow consistent conventions for encoding RFID data, their data practices increase the value of using RAIN RFID among supply chain partners while mitigating potential risks. Uniform standards allow disparate systems to exchange serialized tag data seamlessly.
But the data itself reveals nothing particularly sensitive or confidential to external parties. Fundamentally, GS1 standards provide a language for encoding RFID data to be shared securely between authorized partners without risk of exposing enterprise data. So RFID data standardization actually helps improve supply chain efficiency without inherently compromising confidentiality.
Myth 3: RFID-Transmitted Data is Like NFC Payment Data
Many people associate RFID technology with near-field communication (NFC) payment cards used for point-of-sale transactions. For a decade or so, wallet and purse marketers have pushed “RFID blocking” materials in their products, triggering concern among consumers that sometimes seeps over into the territory of RAIN RFID. But NFC and RAIN RFID are distinct technologies optimized for totally different purposes.
RAIN RFID uses far-field technology capable of scanning tags from distances up to 300 feet for industrial tracking and inventory management. NFC uses close-proximity technology with transaction distances under 4 inches for cashier interactions.
While copying credit card information via NFC may be hypothetically possible, in practice, payment data is at greater risk of being compromised due to traditional database hacking rather than wireless interception. One-off NFC data hacks are just not easy enough to be a cost-effective criminal enterprise in most cases.
The same holds true for RAIN RFID. Generally, on a tag-by-tag basis, the data is incredibly valuable to its user—but holds little use for those parties that aren’t supply chain partners. The aggregate data moved in a facility via RFID over a day, week, or month could potentially be interesting to a competitor but, realistically, it’s difficult to siphon data in quantity without being discovered well before meaningful amounts would be collected.
Myth 4: RFID Tags Can Be Easily Cloned by Counterfeiters
A common concern is that RFID tags can be easily cloned or counterfeited for use in product counterfeiting or diversion, insurance fraud, or other forms of criminal tag manipulation. However, this is virtually impossible with modern RAIN RFID tags.
Every RAIN RFID tag contains a unique, unchangeable tag ID (TID), encoded during initial tag manufacturing, that’s separate from any item data the tag may also store. Even if product data matches exactly between two tags, this TID can’t be copied and overwritten.
While non-unique product data could be replicated, the built-in TID is fixed during chip production, making each tag trackable back to its original production source, too.
Myth 5: Companies Need to Fortify RFID Equipment to Secure Enterprise Data
Adopting RFID technology doesn’t require additional or extraordinary measures to secure RFID hardware from data theft or manipulation above typical IT safeguards. So how do companies ensure RFID data remains secure?
Responsible RFID users take steps like:
- Following GS1 data standards for retail item tagging
- Working with experienced system integrators to properly implement technology
- Securing backend databases that store RFID data, not just the RFID equipment
- Controlling network and database access to authorized devices/personnel only
- Encrypting data communications from RFID readers to business systems
But for most applications, RFID functions a lot like barcode scanning for inventory management—only much faster and easier, and without direct line-of-sight access to every item.
Onerous RFID-specific security investments are simply unnecessary for most applications. General IT security best practices typically provide adequate safeguards against external threats related to RFID data management. (Learn more about RAIN RFID and security best practices from our partner, Impinj.)
The Bottom Line
RFID provides substantial benefits like inventory visibility, asset tracking, and loss prevention. While data security matters, concerns around business information compromised via RFID hacking are largely overstated compared to more mundane threats. While data security always merits reasonable precautions, many unrealistic fears stem from misunderstandings of how the technology actually functions.
For most applications, following sound RFID implementation and IT security practices is enough. Most companies just don’t need extraordinary defensive investments specifically for their RFID systems.
In most applications, RFID functions quite simply as an automatic data collection mechanism, comparable in many ways to a barcode. If reasonable care is taken to implement RAIN RFID in line with best practices, the technology doesn’t introduce new risks beyond what already exists throughout an enterprise’s IT infrastructure.
With retailers increasingly requiring suppliers to deliver products already source-tagged, manufacturers face new opportunities to glean operational performance improvements from the technology investment they’re making anyway. Learn how you can reduce human error, gather more and better operational data, introduce automation, and gain better insights to drive your decision-making by downloading our ebook.
