A credential is whatever a person presents to an access control reader: a card, a fob, a phone, a PIN or a fingerprint. Older proximity cards are easy to copy, so most new systems use encrypted smart cards or mobile credentials, and add a PIN or biometric at doors that need more certainty. How credentials are issued and cancelled matters as much as the technology.
Cards and fobs
Low-frequency proximity cards
For decades the standard access card was a 125 kHz proximity card. It holds a number and transmits it to any reader that asks, with no encryption. Inexpensive devices can read a proximity card from a short distance and write the number to a blank card, which is why security professionals treat these cards as convenient but not secure. Many buildings still run on them.
Encrypted smart cards
High-frequency smart cards, operating at 13.56 MHz, contain a small chip that can store keys and perform cryptographic checks. Card and reader prove to each other that they share a secret before the card's number is released, so copying the card requires breaking the encryption rather than simply reading it. Smart card families differ in their security, and some early types have known weaknesses, so the specification should name a current, secure technology and say how the keys are managed.
Fobs, stickers and wristbands
The same technologies come in other forms: key fobs, adhesive tags and wristbands for pools and gyms. The form changes, not the security.
From card to controller
A secure card is only half the story. The reader passes the card's number to the controller over a cable, and on many older systems that link is as weak as a proximity card.
The traditional Wiegand interface sends the number one way, unencrypted, and gives the controller no way to tell whether the reader has been removed or tampered with. OSDP (Open Supervised Device Protocol) is a newer standard for reader communication that is two-way, supervised, and with secure channel enabled, encrypted. When specifying new readers and controllers, ask for OSDP with secure channel, and check that it is actually turned on at commissioning.
Mobile credentials
Mobile credentials turn a phone into the access card. The phone talks to the reader over Bluetooth Low Energy or NFC, and an app or the phone's digital wallet holds the credential. The advantages are practical: credentials can be issued and cancelled remotely without anyone handling plastic, people rarely forget their phones, and the phone's own lock screen or biometric can act as a second factor.
The drawbacks are also practical. Not everyone has a suitable phone or wants a work app on a personal device, dead batteries happen, and some readers need firmware or hardware changes. Most organisations that adopt mobile credentials keep cards available for those who need them.
PINs and biometrics
A PIN on its own is weak because PINs are shared and observed. Combined with a card, it means a stolen card is not enough. Biometric readers use a fingerprint, face, hand or iris. They are hard to share or lend, which is their main strength, but they are slower at busy entrances, can struggle with gloves, dirt or lighting, and need careful enrolment.
Biometric data is especially sensitive personal information. Collecting it should be justified by a real need, explained to the people affected, and handled in line with the privacy law that applies to your organisation, which in Canada may be PIPEDA, a provincial private-sector act such as Alberta's or BC's, or a public-sector act. Many biometric systems store a mathematical template rather than an image; ask where templates are stored and how they are protected.
Combining factors
Security improves most when two different kinds of proof are combined, rather than two of the same kind.
Most buildings do not need two factors everywhere. A common pattern is a single credential at general doors, and card plus PIN or card plus biometric at server rooms, pharmacies, cash rooms, evidence rooms and similar spaces.
Visitors and temporary access
Visitors, delivery drivers and short-term contractors are where credential discipline usually slips. Lending a staff card to a visitor, or keeping a drawer of generic "visitor" cards, means the access log no longer says who went where. Better options include visitor cards issued at reception that are tied to the visitor's name and expire at the end of the day, mobile or QR-code passes sent in advance that only open specific doors during the visit, and escorted access where the host's credential opens the door. Whichever you use, the visitor record and the access record should match, and temporary credentials should expire on their own rather than relying on someone to remember to cancel them.
Comparing the options
| Credential | Security | Practical notes |
|---|---|---|
| Proximity card or fob | Low: easily copied | Cheap and common; plan to replace |
| Encrypted smart card | Good, if a current technology with managed keys | Today's default for most buildings |
| Mobile credential | Good, plus the phone's own lock | Remote issue and cancel; keep cards for those who need them |
| PIN alone | Low | Useful as a second factor, weak alone |
| Biometric | Good, hard to lend | Slower; privacy obligations; enrolment effort |
Moving off old cards
Few organisations can replace every card in one day. A phased migration usually works like this: install multi-technology readers that read both the old and the new cards, issue new credentials department by department, then disable the old card technology at the readers once everyone has switched. Do not leave the old format enabled indefinitely, because a reader that accepts copied proximity cards remains the weak point however good the new cards are. Upgrade the reader-to-controller wiring protocol at the same time if you can.
Managing credentials over their life
The technology choice gets most of the attention, but most real-world access problems come from how credentials are managed.
- Tie issuing and cancelling to HR and contractor processes, so leaving the organisation triggers revocation.
- Give contractors and temporary staff credentials that expire automatically.
- Make reporting a lost card easy and fast, with no penalty that discourages reporting.
- Audit active credentials against current staff and contractors on a regular schedule.
- Avoid shared or generic cards; every credential should belong to one person.
- Record who issued each credential and on what authority.
How ehZee can help
We assess existing credential technology and reader wiring, recommend replacement credentials and readers that fit the site, plan phased migrations, and design access control systems with credential management built into the process. See our access control systems service, and the guides on how access control works and layered security design.
Common questions
How can we tell if our cards are proximity cards?
The card or system documentation usually says. A security integrator can identify the technology with a reader in a few seconds. If the system was installed many years ago and has never been upgraded, assume proximity cards until shown otherwise.
Are mobile credentials secure?
Well-designed mobile credentials are at least as secure as smart cards, and the phone's lock screen adds a second layer. Security depends on the provider, how credentials are issued and whether the readers are configured properly.
Do we need consent for fingerprint readers?
Privacy laws in Canada generally require that collecting biometric data be reasonable for the purpose and that people be informed, and often that an alternative be offered. The details depend on the law that applies to your organisation; get privacy advice before deploying biometrics.