Finally they are worried over privacy, especially if bad guys can read
your personal data as you walk past.
As you point out, deciphering RF signals from afar is not uncommon.
Here's one: http://www.eham.net/articles/9982
The actual transmit
power was .0000406 watts at 3.5455 MHz. The precise distance between
the two stations is 546.8 miles. That's 40.6 microwatts. For
purposes of comparison, a GSM phone is one or two watts. QRP (low
power) is a subculture all its own, and there are people who
specialise in operating at very low transmit powers. Many people have
worked Europe from the US on a watt. If one is interested,
is one spot to watch.
Attenuation is based on frequency, so without knowing the frequency
the biometric card is transmitting on, it's tough to guess how far it
can be read.