Access Card Cloning: Detect and Stop Copied Badges

A cloned access badge opens the door in the real cardholder's name, so the access log records a normal entry and points investigators at the wrong person. Card cloning is now cheap: open-source research tools and consumer multi-tool devices read, store and emulate many of the badge technologies still installed in offices, data centres and plants. This guide explains, at a defensive level, which credential properties make a badge copyable, how cloning risk shows up in an estate, how to detect cloned badge use in access logs, the compensating controls to apply while old cards remain, and how to test and assure the result. It is for physical security managers, security operations teams and auditors. The full card replacement project, from reader survey to legacy switch-off, is covered in the Legacy Access Card Migration Guide; this page does not repeat it.

Key takeaways

Cloning is a property of the credential, not of the attacker's skill. A badge that presents a fixed number, or protects its data with a broken or shared key, can be copied by anyone who gets close enough to read it.
Secure cards can still be read insecurely. Readers configured to read only the card serial number (UID), or cards left on a default or leaked key, give up the protection the card was bought for.
Detection is hard but not hopeless. Impossible travel between doors, use outside a person's pattern, duplicate presentations and reads of retired formats are the signals that a copy is in use.
Compensating controls buy time. PIN at sensitive doors, anti-passback, tamper-monitored readers and fast revocation reduce the value of a cloned badge until the technology is replaced.
Test the doors you think are safe. Authorised assessments should check every credential type and reader configuration on site, because a single door still accepting a legacy format undoes the rest.

What makes a badge copyable

Every access badge is an identifier plus, optionally, a way of proving that the card is genuine. Cloning succeeds when the reader accepts something an attacker can read and reproduce. Four credential properties decide the risk.

Static identifier, no cryptography: low-frequency (125 kHz) proximity cards transmit a fixed facility code and card number every time they are energised. Nothing in the exchange distinguishes the original from a copy written to a blank card. Flipper's own documentation notes that low-frequency RFID cards "don't usually provide high levels of security" and describes reading, saving, emulating and writing them.
Broken cipher: MIFARE Classic protects sectors with the proprietary CRYPTO1 cipher and 48-bit keys. Radboud University disclosed on 7 March 2008 that keys can be recovered offline in under a second from a small amount of captured reader traffic, and demonstrated the attack against its own building access system.
Shared, default or leaked keys: a cryptographic card is only as strong as its key management. A key shared across every card and reader on a site means one recovered key exposes the whole population, and cards left on a manufacturer default key can be copied with public information.
Weak chip implementations: in 2024 Philippe Teuwen (then at Quarkslab) published research on the FM11RF08S, an unlicensed "MIFARE compatible" chip, reporting a hardware backdoor that lets someone who knows it compromise all user-defined keys within minutes of card access, and a shared backdoor key in older cards from several manufacturers. Cards you believe are MIFARE Classic may be compatible chips from a different supplier.

Credential risk at a glance

Use this table to classify the credentials found in an inventory. It describes risk properties, not products to buy.

Credential or configuration	Frequency	Why it can be copied	Cloning risk	Interim action
Proximity card or fob	125 kHz	Fixed number, no authentication, readable at a distance with long-range readers	Very high	PIN on sensitive doors, schedule replacement
MIFARE Classic or compatible chips	13.56 MHz	CRYPTO1 key recovery; backdoored compatible chips; shared site keys	Very high	Treat as equivalent to prox; diversified keys do not fix the cipher
Legacy proprietary 13.56 MHz formats with a public master key	13.56 MHz	Default or long-leaked key	High	Move to custom keys where supported, then replace
Modern AES card on a default key	13.56 MHz	Cryptography is sound but the key is known	High	Rekey to an organisation-owned custom key
Any secure card read as UID only	13.56 MHz	Reader ignores the secure application and trusts a serial number that can be emulated	High	Reconfigure readers to authenticate the card's secure application
AES card with mutual authentication and diversified, organisation-owned keys	13.56 MHz	No practical clone when keys are managed well; relay remains a residual risk	Low	Protect keys, enable relay countermeasures where offered
PIV or PKI card read with challenge-response	13.56 MHz	Private key never leaves the card	Low	Follow the PIV authentication mechanism guidance in NIST SP 800-116 Rev. 1

For AES-based cards, vendor documentation lists the features that resist copying and relay. NXP documents MIFARE DESFire EV3 as supporting hardware AES-128, mutual three-pass authentication, CMAC-authenticated encrypted RF traffic, a Proximity Check against relay attacks and a Transaction Timer against man-in-the-middle attacks, with Common Criteria EAL5+ certification. These properties only help when the reader is configured to use them.

How cloning happens, at a defensive level

Defenders do not need attack procedures to plan controls, but they do need to understand the stages, because each stage offers a control point.

Reading the credential: an attacker brings a reader near the victim's badge, for example in a queue, a lift or a café, or near a badge left on a desk or lanyard. Long-range readers extend the distance for low-frequency cards. Badge photos posted online can also reveal card type and, on some cards, printed numbers.
Recovering protected data: for cryptographic cards this means recovering a key, which is feasible only when the cipher is broken, the key is default or leaked, or a chip has a weakness. Pen Test Partners notes that sequentially issued card numbers can make other cards in a batch predictable once one is read.
Reproducing the credential: the data is written to a writable blank card or emulated by a handheld device. Open-source research platforms such as the Proxmark3, which its maintainers describe as able to interact with the vast majority of RFID tags, are widely used for legitimate assessment work and are the same capability an attacker would use.
Presenting the copy: the copy is used at a reader. Unless the reader authenticates the card cryptographically, the panel cannot tell it apart from the original.

Two adjacent attacks are often grouped with cloning. A relay attack forwards the live exchange between a genuine card and a distant reader without copying the card, which is why proximity checks and transaction timers exist. A wire-level capture intercepts card data on an unencrypted Wiegand link behind the reader (MITRE ATT&CK T1200 Hardware Additions describes the broader technique of attaching devices); that is a reader infrastructure problem addressed by OSDP Secure Channel, covered in the Physical Access Control Systems Security Guide.

Finding cloning exposure in your estate

Most organisations do not know which of their doors accept a copyable credential. Build the picture from data you already hold, then confirm on site.

Question	Where to look	What a bad answer looks like
Which card formats are enrolled?	PACS cardholder export: card format, bit length, facility code	26-bit or other low-frequency formats still active on staff records
Which technologies does each reader accept?	Reader configuration records, installer documentation, door-by-door survey	Multi-technology readers with legacy reading still enabled after a card refresh
Are secure cards read securely?	Reader configuration; integrator statement of how the secure application is used	Readers set to UID-only or CSN mode
Whose keys are on the cards?	Card supply contract, key ceremony records, integrator documentation	Manufacturer default keys, or nobody can say who holds the site key
Who supplied the chips?	Purchase records; sample testing by an authorised assessor	Unverified "compatible" cards bought on price
Which other systems trust the badge?	Facilities, finance and HR: print release, lockers, canteen, lifts	Systems reading the legacy credential that nobody owns

Give the results a door-level risk rating: a copyable credential at a reception turnstile backed by staffed security is a different exposure from the same credential on an unattended server room door.

Detecting cloned badge use

A perfect copy produces a perfectly normal "access granted" event. Detection therefore relies on context the copy cannot reproduce. Send PACS events to the SIEM and build rules around these signals, consistent with NIST SP 800-53 PE-6 Monitoring Physical Access and NIST CSF 2.0 DE.CM-02.

Signal	Data needed	What it may indicate	Tuning note
Impossible travel between doors or sites	Door events with reader location and timestamps	Two badges with the same number in use	Set minimum travel times between zones; exclude known shared-credential doors
Anti-passback violation	Entry and exit readers on the same area	Badge entered twice without exiting, or a copy used while the owner is inside	Distinguish hard (deny) and soft (alert) anti-passback
Badge use while the holder is known to be elsewhere	HR absence, travel or remote-login data, VPN location	Copy used while the owner is on leave or abroad	Agree data sharing with HR and privacy teams first
Off-pattern access	Baseline of each holder's usual doors and hours	Copy used at night or at doors the holder never visits	Start with restricted areas only to keep volume manageable
Retired format or revoked card presented	Invalid-card and wrong-format events	An old badge or a copy of one still in circulation	After legacy switch-off this should trend to zero
Sequential card number probing	Invalid-card events with card numbers	Attempts across a number range	Alert on several invalid numbers at one reader within minutes
Reader tamper, offline or forced door	Reader supervision and door contact events	Interference with reader or wiring	Route to the monitoring desk with CCTV call-up

Pair alerts with video: an impossible-travel alert is resolved in minutes if the monitoring desk can view the camera at the second door. See the IP Camera and CCTV Security Guide for securing that video estate.

Compensating controls while legacy cards remain

Replacement takes years in large estates. These controls reduce the value of a copied badge in the meantime. Choose by door risk rather than applying everything everywhere.

Second factor at sensitive doors: a PIN or biometric at server rooms, labs and cash areas means a copied card alone does not open the door.
Disable legacy reading where it is no longer needed: multi-technology readers often still accept the old format long after the cards were replaced. Turning it off is the cheapest high-value fix.
Rekey off default keys: where cards and readers support custom keys, move to an organisation-owned key and confirm that readers do not expose it. Pen Test Partners recommends exactly this for cards still on default keys.
Anti-passback and mantraps: on high-security areas these make simultaneous use of an original and a copy fail or alarm.
Fast revocation: link badge disablement to HR leaver events and lost-badge reports, so a copied badge of a departed person stops working within the same day. See the Orphaned and Dormant Accounts guide.
Shielding and badge hygiene: RF-shielding sleeves and a rule against wearing badges outside the building reduce casual reading of low-frequency cards. They are a supplement, not a control you can rely on.
Tailgating controls: cloning and tailgating are alternatives for the same goal, so strengthening one while ignoring the other moves the attacker rather than stopping them. See the Tailgating and Piggybacking Guide.

Choosing a response by organisation size

Situation	First moves	Next 12 months
Small office, one controller, prox cards	Turn on PIN for the comms room, link badge revocation to leavers, stop badge photos on social media	Replace cards and readers at next refresh with an AES credential or mobile credential
Corporate estate with mixed generations	Inventory formats and reader settings; disable legacy reading where cards are already replaced; start SIEM rules for impossible travel	Zone-by-zone replacement, restricted areas first, via the migration project
Data centres, labs, critical sites	Two factors and anti-passback on restricted areas, tamper monitoring, video call-up on alerts	Cryptographic credentials with organisation-owned keys and OSDP Secure Channel end to end

Testing and assurance

Cloning resistance should be tested, not assumed. Auditors assessing NIST SP 800-53 PE-3 Physical Access Control and ISO/IEC 27001:2022 control A.7.2 Physical entry increasingly ask for evidence that credentials cannot be copied.

Authorise the work in writing: scope the doors, credential types and test cards, and agree that only test badges issued for the assessment are read, never staff badges without consent. See the Red Team Rules of Engagement Template.
Test every credential type and reader model: the assessor checks whether each can be copied or emulated and whether each reader accepts the copy.
Test negative cases after changes: a legacy test card on a converted reader must be refused, an emulated UID must be refused, and a revoked card must be refused within the expected time.
Check detection end to end: confirm that test activity produced the expected SIEM alerts and that the monitoring desk responded.
Record and retest: keep results per door and repeat after reader firmware or configuration changes, and at least annually for restricted areas.

Responding to a suspected cloned badge

Disable and reissue: revoke the affected card number at once and issue a new credential, preferably of a secure type, rather than re-enabling the same number.
Preserve evidence: export the door events for the card number, the invalid-read log for nearby readers and the relevant video before retention expires.
Widen the search: if numbers are sequential or a site key may be exposed, review the whole batch or site, not just one card.
Check for wider compromise: treat unauthorised physical entry to network or server areas as a possible cyber incident and check for rogue devices on the network.

Framework mapping

Framework	Reference	Relevance to cloning
NIST SP 800-53 Rev. 5	PE-2 Physical Access Authorizations	Authorised holder lists and timely revocation
NIST SP 800-53 Rev. 5	PE-3 Physical Access Control	Enforcing access with credentials that authenticate the holder
NIST SP 800-53 Rev. 5	PE-6 Monitoring Physical Access	Reviewing logs and responding to anomalous entries
NIST CSF 2.0	PR.AA-06	Physical access managed, monitored and enforced commensurate with risk
NIST CSF 2.0	DE.CM-02	Monitoring the physical environment for adverse events
ISO/IEC 27001:2022	A.7.2 Physical entry	Secure areas protected by appropriate entry controls
MITRE ATT&CK	T1200 Hardware Additions	Devices attached to reader wiring to capture credentials

Measuring progress

Copyable exposure: percentage of doors, by risk rating, that still accept a copyable credential or UID-only reads.
Default key exposure: number of card populations still on a manufacturer default key (target zero).
Revocation latency: median time from HR leaver event or lost-badge report to badge disablement.
Detection coverage: percentage of restricted-area readers feeding impossible-travel and anti-passback rules into the SIEM.
Retired format reads: legacy-format presentations per week after switch-off, trending to zero.

Common failure patterns

Buying secure cards, reading the serial number: readers left in UID-only mode make an expensive card refresh as copyable as the old prox cards.
Leaving legacy reading on: multi-technology readers keep accepting the old format for years after a migration because nobody owns the switch-off.
Default keys in production: modern cards deployed on the manufacturer's default key, with no record of anyone ever rekeying them.
Unverified compatible chips: cheap "compatible" cards bought without checking the chip, inheriting weaknesses such as those reported for the FM11RF08S.
No log review: PACS events kept only on the head-end server, so impossible travel and off-pattern use are never seen.
Treating it as facilities only: physical entry to network rooms leads to cyber compromise, yet the PACS sits outside security monitoring. See the Physical Access Control Systems Security Guide.

Practitioner checklist

Export enrolled card formats and classify each population with the risk table above.
Survey readers for enabled technologies and UID-only configuration; fix UID-only reading first.
Confirm who owns the card keys and move off default keys where cards support it.
Verify chip provenance on any card bought as "compatible".
Add PIN or a second factor at restricted doors until credentials are replaced.
Feed PACS events to the SIEM with impossible-travel, anti-passback, off-pattern and invalid-format rules.
Link badge revocation to HR leaver and lost-badge events and measure the latency.
Commission an authorised assessment covering every credential type and reader model, and retest after changes.
Plan the replacement through the migration project and set a legacy switch-off date.

Access Card Cloning: How Badges Get Copied and How to Detect It