A passenger tracking system that combines fobs carried by passengers and a passenger detector that detects when a fob is nearby. The fobs are battery powered and consume very little power; therefore, they can be sealed and waterproof, and may last for years before replacement. A fob is asleep until awakened by a short-range magnetic field broadcast by the passenger detector. After awakening, the fob listens for an encrypted message from the passenger detector, and responds with an encrypted response that contains the fob's identity. Tracking is secure because a fob is completely invisible unless and until it receives a magnetic field of the correct frequency and time-varying pattern, and an encrypted request message from an authorized sender; responses are also encrypted so that listeners cannot discover the fob's identity. The system is suitable for example for tracking schoolchildren entering or exiting a school bus.