Commercial access-control credentials can be cards, key fobs, mobile identities, individual PINs or biometrics. Each approach has different security, usability, privacy, administration and migration requirements. The right choice depends on the complete system, not a reader’s appearance.
The three authentication factors
An authentication factor is something you have (such as a protected card or phone credential), something you know (a PIN) or something you are (a biometric characteristic). Combining different factors can strengthen identity verification where the system genuinely enforces both. A phone protected by a passcode is not automatically proof that a door-access transaction uses two factors.
Legacy proximity cards and secure smart credentials
Many older facilities use 125 kHz proximity cards or fobs that transmit a fixed identifier. Common legacy formats can be copied or replayed with comparatively little effort. Treat their continued use as a documented risk and migration question rather than a security upgrade. They may need temporary support while readers and users transition to a stronger format.
More modern contactless credentials may use cryptographic authentication, for example appropriately configured HID Seos or MIFARE DESFire-based systems. The radio frequency alone does not establish the security level; a 13.56 MHz card may be used in weak or strong modes depending on the credential application and reader. Confirm exact product, keys, provisioning, encryption and controller configuration.
Mobile credentials and phone wallets
Depending on the platform, a mobile credential may use NFC, Bluetooth, a supported wallet or a manufacturer application. Verify user enrollment, device eligibility, phone replacement, lost-phone revocation, offline behavior and who owns or administers the credential service. Some applications require cloud subscriptions; others have additional reader or controller dependencies. A physical-card alternative may remain necessary for certain staff, visitors or contingency situations.
PINs and keypad access
PINs are convenient at selected doors, but shared codes weaken accountability and can persist after someone leaves the organization. Individual PINs, expiration dates, retry limits and controlled administration are preferable where the device supports them. For higher-risk areas, a PIN may be combined with a separate supported credential; determine how the system handles lockouts and emergencies.
Biometrics require careful evaluation
Fingerprint or facial authentication can strengthen identity checks in some applications, but neither is infallible nor impossible to spoof, compromise or misuse. False acceptances and false rejections are possible. Test the actual model and environment, including lighting, protective equipment, enrollment quality and accessibility. Document applicable notice, consent, retention and deletion duties, information security, a workable non-biometric alternative and handling of disputed matches.
Biometric templates cannot be reissued like a misplaced card. Limit collection to an identified need and do not make blanket claims about compliance, accuracy or security without evidence for the deployed configuration.
Reader-to-controller communication is a separate layer
Reader credential support is different from the protocol connecting a reader to a panel. Older Wiegand connections generally lack modern supervision and authenticated channel protection. OSDP supports supervised, bidirectional communications and an optional Secure Channel; verify that the reader, controller and firmware support it and that secure keys are provisioned, enabled and tested. Simply buying an OSDP-capable reader is not equivalent to deploying an encrypted channel. See the equipment and reader manufacturer reference.
How to plan a credential migration
- Inventory current readers, panels, credential formats and cardholder records.
- Identify unsupported, clone-prone or unowned technologies and keys.
- Test new and retained devices with the actual software release and controller firmware.
- Define whether old and new credentials can coexist and when the old format will be turned off.
- Provide an accessible enrollment process and lost-device response.
- Test valid, expired, revoked, after-hours and wrong-area credentials.
- Document owner administration, credential revocation, support, subscription and recovery procedures.
Cost and lifecycle comparisons
Compare the reader hardware, cards or mobile service, deployment time, enrollment labor, expected battery or device changes, administrator training, renewal fees and end-of-support dates. The lowest initial card cost does not necessarily mean the lowest five-year cost, and the most advanced credential is not necessarily appropriate for every employee or opening.
Related references
For overall system design, continue with the commercial access-control planning guide. For phased upgrades, see the upgrade and takeover technical reference. Final product, privacy and life-safety decisions must be verified for the actual site.
Publisher’s related applied reference: access-control credential security and administration.