The short answer
Organizations usually pick a non-biometric credential by price, but the deciding factor should be the threat model. Low-frequency 125 kHz prox cards broadcast a static number and are cloned in seconds; a PIN alone is guessed, shared or observed; mobile keys and AES smart cards resist copying but move risk to the phone and to key management. The resilient default is a strong possession credential (Seos, DESFire EV3, secure mobile) plus a PIN as a second factor, with disciplined revocation.
Key takeaways
- The format (card, fob or phone) matters less than the technology inside: a 125 kHz prox fob and an AES-128 DESFire fob differ enormously in how easily they are cloned.
- 125 kHz proximity cards (HID Prox, EM4100) and MIFARE Classic rely on static or legacy data that attackers capture and replay with inexpensive readers.
- Modern smart credentials (Seos, MIFARE DESFire EV3) use mutual authentication and AES-128 encryption, making cloning economically unattractive.
- Mobile keys (NFC/BLE) cut loss and enable instant remote revocation, but tie entry to phone battery, device security and the app ecosystem.
- A PIN alone is the weakest factor: prone to shoulder-surfing, sharing, brute force and reuse; its correct role is a second factor alongside a credential.
- Credential lifecycle — issuance, expiry, revocation — matters more than the chip; an active lost credential defeats even strong technology.
- Match method to risk: prox for low-consequence interior doors, AES smart and mobile credentials for perimeters and high-value areas.
Choose the technology, not the plastic
Access credentials divide into three factors: something you have (card, fob, phone), something you know (PIN, password) and something you are (biometrics). This guide compares the first two families and deliberately skips biometrics, which stores sensitive personal data and triggers strict regulation, for example under GDPR in Europe.
The most common purchasing mistake is confusing the physical format with the credential technology. Two identical white PVC cards can behave completely differently at the reader: one may hold a chip from the 1980s that broadcasts a fixed number to anyone who asks, while the other runs mutual authentication with encryption. Saying 'we need more access cards' never tells a supplier what security level you actually need.
It also helps to separate identification from authentication. A basic proximity card answers only the question 'which number is this?', and anything that can read that number can reproduce it. A smart or mobile credential answers 'prove you are genuine', which requires a cryptographic exchange between the credential and the reader.
- 'Have' — an object that can be lost, handed over or copied.
- 'Know' — a code that can be observed, guessed or extracted.
- Biometrics is excluded here because it stores sensitive personal data under special rules.
Cards: the gap between prox and smart credentials
Low-frequency 125 kHz proximity cards (HID Prox, EM4100, Indala families) still sit on millions of interior and perimeter doors. Their weakness is architectural rather than a single flaw: the card transmits a static identifier and performs no mutual authentication or encryption. Any device able to read the number can reproduce it, and tools such as the Proxmark family plus cheap blank writable tags make copying straightforward.
High-frequency 13.56 MHz smart cards (ISO/IEC 14443) can hold a genuine two-way conversation with the reader. MIFARE Classic was hugely popular, but its proprietary Crypto1 cipher was publicly broken by researchers in 2008, so today it is treated as a legacy technology closer to prox than to modern smart credentials. MIFARE DESFire (EV1 through EV3) and HID Seos use AES-128 with three-pass mutual authentication; DESFire EV3 adds Common Criteria EAL5+ certification and proximity checks against relay attacks.
A caution: the words 'smart card' or 'MIFARE' on a datasheet do not by themselves indicate a secure credential. A DESFire EV3 card issued with a default or shared key, read by a reader running in a backward-compatible mode, is not delivering the protection the chip is capable of. Key generation and custody, reader configuration and credential encoding decide the real outcome.
- 125 kHz prox — cloned in seconds, no encryption, no mutual authentication.
- MIFARE Classic — Crypto1 broken; treat as a legacy technology.
- MIFARE DESFire EV3 and Seos — AES-128, mutual authentication, hard to clone.
- Encryption keys decide everything: even a strong chip fails with a leaked shared key.
Mobile keys: NFC and BLE, and where the risk moves
A mobile credential turns a smartphone or smartwatch into a digital key issued to that specific device and stored in a protected area. Two delivery methods dominate. NFC operates at 13.56 MHz with a working range of a few centimetres, and that short range is itself a security feature because it forces a deliberate tap — a natural fit for turnstiles and elevators. BLE works in the 2.4 GHz band and can authenticate from a few metres out, which suits parking gates and accessible entrances where a user cannot easily reach a reader.
Mobile credentials have clear strengths: people guard their phones more closely than cards, lose them less often, and when a phone is lost a cloud-based system can deactivate the key remotely so it 'vanishes' from the device without anyone collecting plastic. That solves one of the worst problems with physical cards, which is slow revocation.
But the risk does not disappear; it moves to the device. If the phone is compromised, left unlocked, or kept open by auto-unlock features, the credential is available to an attacker. NIST's Mobile Threat Catalogue describes Android Smart Lock device spoofing, where an attacker imitates an allowed Bluetooth device to keep the phone unlocked while it is paired. Mobile access therefore makes the phone's own lock code and disabling of auto-unlock features a matter of access-control policy.
- NFC: a range of a few centimetres, requires an intentional tap.
- BLE: works from several metres, with presence-detection accuracy questions.
- A lost phone is manageable only if cloud revocation is immediate.
- The new single point of failure is the security and lock state of the smartphone itself.
PINs: a weak first factor, a useful second factor
Codes remain common as a backup method or as the confirmation leg of two-factor access (for example, RFID plus PIN), and for one-time or time-limited entry for cleaners, couriers and contractors. Yet PINs have serious weaknesses: they are easy to pass to unauthorized people, hard to verify at the point of entry, and vulnerable to shoulder-surfing — a threat that grows as cameras and recording devices capture the keypad.
People choose predictable values such as significant dates, repeated digits and sequences. A four-digit PIN offers only 10,000 combinations, and without a lockout after failed attempts it can be exhausted by systematic or automated guessing. The human factor adds leakage: codes are written down, shared with colleagues and reused across systems.
The correct role for a PIN in a biometric-free scheme is as a second factor on top of a strong credential. The card or phone proves 'what you have'; the code proves 'what you know'. Personal codes instead of a facility-wide code let the audit trail attribute each entry to a named individual, and a duress code can silently signal alarm without being obvious at the keypad.
- Shoulder-surfing, sharing and one code for everyone are the typical failure modes.
- Without lockout, a four-digit code is exhausted quickly.
- A PIN is logical as a second factor: possession plus knowledge.
- Personal codes yield audit trails; a duress code adds protection under coercion.
Layering factors without biometrics
No single factor protects on its own: a card can be stolen, a code observed, a phone compromised. In schemes without biometrics, the accepted standard is a two-step check on sensitive actions: present a valid physical credential (card, fob or smartphone) and then enter a valid code. Routine entry can stay single-factor, while disarming an alarm or entering a server room can demand both.
Permissions live in the software, not on the credential. One badge might open the front door on weekdays, the second floor around the clock and nothing else; revoking it takes seconds in the management system and requires no return of the physical token. This is the single biggest advantage of electronic credentials over mechanical keys: a lost key means rekeying cylinders, while a lost card means deleting a record.
Effectiveness depends less on the access method than on lifecycle discipline — who generates and holds the encryption keys, how fast a loss is acted on, and whether a departed employee is deactivated the same day. Poor credential management defeats even the strongest cryptography.
- Strong possession credential plus a PIN equals two-factor entry without biometrics.
- Permissions and revocation live in the software, not on the card.
- Key custody and revocation speed define the real security level.
Put it into practice
Non-biometric credential selection worksheet
Work through these items before you buy and record each decision. The goal is to tie the access method to the risk level of each door and to your real ability to manage credential lifecycle, rather than to the price on the purchase order.
- Classify every door by risk: interior with low consequences versus perimeter, server room, cash handling or other high-value areas.
- For perimeter and high-value doors, require mutual authentication — Seos, DESFire EV3 or a secure mobile credential, not 125 kHz prox.
- Map all legacy credentials (125 kHz prox, MIFARE Classic) and schedule a migration; do not treat them as the standard for new installs.
- If you use mobile keys, enforce a device lock code and disable auto-unlock features that leave the phone open to a nearby attacker.
- Enable a second factor for the most sensitive doors: a card or phone plus a personal PIN.
- Configure lockout after repeated wrong code entries and log failed attempts for review.
- Issue personal codes rather than one shared facility code so the audit trail attributes each entry to a named person.
- Revoke credentials within minutes of loss, departure or transfer; for mobile, deactivate in the cloud so the key disappears remotely.
- Record who generates and stores encryption keys — a hosted vendor service or your own security team with a custody obligation.
- Periodically test cloning resistance with an internal red-team check of issued cards and reader behavior.
- Where coercion is plausible, provision a duress code that raises a silent alarm without revealing itself at the keypad.
Questions people ask
Are 125 kHz proximity cards secure for access control?
They remain acceptable for low-consequence interior doors, but not for perimeters or high-value areas. Proximity cards (HID Prox, EM4100) transmit a static identifier without encryption or mutual authentication, so the number can be captured and replayed with inexpensive tools such as the Proxmark family. When the consequence of an unauthorized entry is real, choose AES-based smart credentials (DESFire EV3, Seos) or a secure mobile credential.
What is the difference between MIFARE Classic and MIFARE DESFire?
MIFARE Classic relies on the proprietary Crypto1 cipher, which researchers publicly broke in 2008, so it is treated as a legacy technology closer to prox cards in strength. MIFARE DESFire (EV1–EV3) uses AES-128 with three-pass mutual authentication; DESFire EV3 carries Common Criteria EAL5+ certification and proximity checks against relay attacks. Real-world protection still depends on how keys are generated and held, not only on the chip.
Is mobile access more secure than cards?
For loss and cloning, usually yes: people guard phones more closely, and a cloud-based system can deactivate a lost mobile key remotely without collecting plastic. But the risk shifts to the device — if the phone is compromised, left unlocked or kept open by auto-unlock features, an attacker can use the credential. Mobile access therefore requires a device lock code and disabling auto-unlock, and the NFC-versus-BLE choice should follow the door's use case.
Can a PIN replace biometrics?
Not as a single factor. A PIN can be observed, guessed or shared, and a four-digit code without lockout is exhausted quickly. In a biometric-free scheme the correct role of a PIN is as the second factor on top of a strong possession credential: the card or phone proves what you have, and the code proves what you know. That two-step combination covers most scenarios where biometrics would be introduced, without storing sensitive personal data.
How quickly should a lost credential be revoked?
Ideally within minutes, because an active lost card or phone negates even the strongest technology. With electronic credentials, revocation happens in the management software: the record is deleted, permissions disappear, and for mobile keys a cloud deactivation instantly removes the key from the device. Unlike mechanical keys, no lock rekeying or physical collection is needed — which is the main operational advantage of electronic credentials.
Sources and further reading
Sources were checked when this page was generated. Confirm changing dates, rules and prices with the original publisher.
- The Battle for Entry: Which is the Best Door Access Control Technology?2N
- From Safety Illusion to Real Protection: the Ajax Approach to User AuthenticationAjax Systems
- Android Smartlock Device Spoofing (AUT-6)NIST Mobile Threat Catalogue
- Goodbye Passwords, Hello Single-Card Simplicity: FIDO-Enabled Seos and DESFire EV3 Cards Are HereHID
- Access Control Credentials Guide: Cards, Key Fobs, Mobile Credentials, Smart Cards & MoreCablify
- RFID CloningCyberGlossary
- The March to Mobile: How Mobile, Cloud-based Access Control is Changing SecuritySecurity Today