Badge Cloning: Why Most Access Cards Can Be Copied in Seconds

Most building access cards in use today can be read and copied by someone standing near the holder with a device that costs very little. This is not a vulnerability in the sense of a flaw to patch — it is how the technology was designed, in an era when nobody expected anyone to try.

Low-frequency proximity cards

The oldest and most widely deployed. A 125 kHz card contains a fixed identifier and transmits it whenever it is energised by a reader's field. There is no authentication, no encryption and no challenge — the card says its number to anything that asks.

Which means reading one is trivial, and writing that number to a blank card produces a functional duplicate. The read range is short, a few centimetres for a reader, and purpose-built long-range readers extend it enough to work from a bag as someone walks past.

The number is also frequently printed on the card, so a photograph is sometimes sufficient. That is the state of a very large share of installed access control.

High-frequency cards, and why they are not automatically better

13.56 MHz cards can do cryptography, and whether they do depends entirely on how they were deployed.

Early high-frequency products used proprietary cryptography that was broken years ago, and cloning them is well-tooled. More significantly, many deployments use high-frequency cards in a mode that simply reads the chip's serial number — ignoring the cryptographic capability entirely and behaving exactly like a low-frequency card.

That is the trap: upgrading the cards without configuring the system to use their security features achieves nothing, and organizations believe they have modern credentials because the hardware is modern.

Properly configured modern credentials perform a mutual authentication using diversified keys — each card holding a key derived from a master key and its own identifier — and the exchange is different every time, so capturing one tells an attacker nothing reusable.

The attack in practice

On an assessment the sequence is unremarkable. Identify the card format from a photograph of a badge or the reader model. Read a card, either from a badge left on a desk — the situation a clean desk policy addresses — or by approaching someone in a public area with a concealed reader. Write to a blank. Walk in.

No alarm fires, because the system sees a valid credential. The audit log records a legitimate entry by that employee, which also means the real holder appears responsible for whatever follows.

Relay attacks are the variant that defeats even good cryptography in some deployments: two devices relay the exchange in real time between a genuine card somewhere else and the reader, so the card authenticates correctly while being nowhere near the door. Distance bounding in the protocol is the counter, and it is not widely deployed.

What to do about it

Find out what you actually have. Most organizations do not know their card format or whether the cryptographic features are enabled. Ask the integrator specifically whether readers are configured to use secure messaging or are reading a serial number.

Upgrade to cryptographic credentials with diversified keys, and manage the master keys properly — a system where every site shares one key means one compromise affects all of them. Mobile credentials on phones are increasingly a reasonable option and shift the problem to the phone's own security.

Do not rely on the badge alone for anything sensitive. A card is one factor, and a server room or a records store warrants a second — a PIN at the reader or a biometric. That is the multi-factor principle applied physically, and it is the single most effective mitigation where full replacement is not affordable.

Layer detection behind it. A cloned badge opens the door and does not defeat the sensors and cameras inside — the arrangement under physical intrusion detection. Anti-passback, which refuses a second entry without a corresponding exit, catches the case where the original holder is already inside.

Watch the logs. Entry by a badge whose holder is on leave, badging in at two locations implausibly close together, or use outside normal hours are all detectable, and none of it is noticed if access control events never leave the access control system. They belong in your SIEM alongside logical access, where the correlation with a logon from the same person elsewhere becomes visible.

Exam angles

Know that 125 kHz proximity cards transmit a fixed identifier with no authentication and are trivially cloned, and that 13.56 MHz cards are only secure when the deployment uses their cryptographic capability rather than reading a serial number. Recognize cloning as producing a credential the system accepts as genuine, so the audit log implicates the real holder. Name cryptographic credentials with diversified keys, a second factor at sensitive doors, anti-passback and layered detection as the controls.