Card Cloning: Why Old Badges Copy in Seconds and Bank Cards Do Not
By Thomas Lovas Lokoy · Published August 9, 2026 — researched and drafted with AI assistance from published sources; edited and published by NorwegianSpark SA.
Can a keycard be cloned and used to get into your building? Often, yes — if the building still uses the older 125 kHz "proximity" cards and fobs. Those simply broadcast a fixed number, and a cheap reader held close to the card can copy it in seconds. Modern 13.56 MHz cards that perform real cryptography cannot be copied that way, and the contactless bank card in your wallet is the hardest of all to clone. The exception is the first generation of 13.56 MHz cards, whose cipher was broken in 2008 — so the question is not how old your card looks, but which system your building installed.
Everything in your wallet that opens a door or pays for coffee answers a radio. What separates the items that can be copied from a distance from the items that cannot is not the plastic, the size or the price. It is whether the card performs cryptography or simply recites an identifier.
That distinction is invisible from the outside, which is why the subject generates so much confused advice. It is worth learning once, because the conclusion is reassuring about the item people worry about most and unsettling about the one they never think about.
The card that just says a number
The oldest widely-deployed access credentials operate on the 125 kHz band and are, functionally, a radio barcode. Present the card, it transmits a fixed identifier, the reader checks the identifier against a list. There is no secret, no challenge, no proof of possession. The number is the whole credential.
A credential like that can be copied by anything able to read it and repeat it. It does not require breaking anything, because there is nothing to break — the design simply predates the idea that someone might want to. These cards are still extremely common in older office buildings, gyms, car parks, storage facilities and blocks of flats, and the copying hardware is cheap and sold openly for the entirely legitimate purpose of duplicating your own fob.
If your building fob is a thin white card or a plain plastic tag with no chip visible and no contactless payment logo, it is quite likely in this category. That is not a reason to panic — it is a reason for whoever runs the building to have a plan.
The card that proves itself
The newer generation works on 13.56 MHz and does something fundamentally different: the reader issues a challenge, the card performs a computation using a key that never leaves it, and returns a response. Listening to that exchange does not let you repeat it, because the next challenge will be different. Copying the card would mean extracting the key, and on a modern implementation that is a hardware attack, not a proximity attack.
The important caveat is that "13.56 MHz" is a radio band, not a security level. The most widely deployed early card of this type used a proprietary 48-bit cipher called Crypto1, which was kept secret rather than published for review. In 2008 it was reverse-engineered and broken — the Digital Security group at Radboud University Nijmegen was central to that work, alongside other researchers — and the practical result was that those cards could be cloned in seconds. The manufacturer sought a court injunction to stop publication and lost; a Dutch judge ruled against it in July 2008. The Netherlands ended up replacing a national transit card system.
The lesson is the one security engineering keeps re-teaching: secrecy of the algorithm is not security. Modern successors use published, reviewed ciphers with proper key lengths, and they hold up. But a building that installed cards in 2007 and has not touched the system since is running the broken generation, and the fact that it is "contactless" and "encrypted" in the brochure does not change that.
Your bank card is the safe one
This is the part people get backwards. The contactless payment card in your wallet is among the best-protected items you own.
It does not transmit a copyable secret. Each tap produces a single-use cryptographic value that authorises one transaction and is worthless afterwards. There is a strict low-value limit before a PIN is demanded, transactions are monitored for velocity, and — the part that actually matters — consumer liability for fraudulent card transactions is limited by law in the EEA, the UK and the United States. Even in the failure case, the loss is generally not yours.
So the RFID-blocking wallet industry is selling a solution to a problem your card already solves. It does no harm, and if it makes you comfortable that is a legitimate reason to own one. It is not a security necessity, and it should not be the item you buy after reading an article about card cloning.
The card fraud that actually happens to people is overwhelmingly not proximity-based. It is data stolen in a breach, skimmers physically fitted to a machine, and card details phished or entered on a fraudulent checkout page. What to do if your data has leaked and phishing are the relevant reading, not this one.
How to tell whether your keycard can be cloned
You cannot tell reliably by looking, but three checks get you most of the way:
- Ask the building manager two questions: what frequency the system uses, and whether the credentials are cryptographic. A 125 kHz answer means the badge is copyable by design.
- Try your phone. Phone NFC works on 13.56 MHz only. If an NFC reader app on your phone cannot see the card at all, it is very likely a 125 kHz proximity card. If it can, the card is at least the newer band — which still leaves the question of whether it is the broken first generation.
- Look at the age of the installation. A system fitted before the 2008 break and never upgraded is the one to worry about, whatever the brochure says about "encrypted" cards.
| Card type | Can it be copied by holding a reader nearby? |
|---|---|
| 125 kHz proximity card or fob | Yes, in seconds — it only recites a number |
| First-generation 13.56 MHz card (Crypto1) | Yes — the cipher was broken in 2008 |
| Modern 13.56 MHz card with published ciphers | No — each exchange uses a fresh challenge and a key that never leaves the card |
| Contactless bank card | No — each tap creates a single-use value |
| Passport chip | Not from a passing bag — the document must be read optically first |
Where the real exposure sits
Ranked by how likely it is to affect you:
- A building or office using 125 kHz fobs. The credential is copyable by design and there is no consumer-side fix. This is a facilities decision.
- A first-generation 13.56 MHz system that was never upgraded. Broken since 2008, still installed in plenty of places.
- Hotel keys. Wide variation, generally not your problem to solve, and generally not the way a hotel room gets entered.
- Passports. These implement access control that requires optically reading the document before the chip will talk, so a chip cannot simply be read from a passing bag.
- Contactless bank cards. Cryptographically sound, liability-limited, and the least of your worries.
What to actually do
- Do not buy the blocking wallet as a security measure. Buy it if you like it.
- If you manage a building, ask which generation is installed. Two questions: what frequency, and whether the credentials are cryptographic. If the answer is 125 kHz, the position is that the badge is an identifier rather than a key, and it should be paired with something else — a PIN, a second factor, or a camera on the door.
- Do not lend an access badge. For a copyable credential, "borrowed for ten minutes" and "copied" are the same event.
- Report a lost fob immediately. Deactivation is the only real remedy for a credential that cannot resist copying.
- Keep the fob and the label apart. A copied credential is far more useful when it arrives with the address it opens.
Where this fits
This is the third piece in the cheap-hardware series, after the USB stick that types and evil twin Wi-Fi; the overview is at cheap hacking gadgets explained, and the last piece covers hidden trackers and cameras. If you run an office, the organisational side — who can get in, and what they can take — is in small business security. The theme repeats: the attack is real, the conditions it needs are narrow, and the thing people buy in response is usually not the thing that helps. What does help, and what it costs, is in our security tool shortlist.
Frequently Asked Questions
Can keycards be cloned and used to access your building?
How do I know if my key fob is 125 kHz or 13.56 MHz?
Can someone clone my contactless bank card by standing near me?
Do RFID-blocking wallets work?
What should I do if my building uses cloneable fobs?
Affiliate disclosure
This article contains affiliate links. If you purchase through them, CyberTechVault earns a commission at no extra cost to you. Our assessments are based on vendors' published documentation, independent lab results and security disclosures — not on hands-on testing by us. We earn a commission from some links on this site; it can influence which providers we feature.
Full disclosure: /affiliate-disclosure.
Sources
Factual claims above were checked against these primary sources. Verify directly on the source for anything time-sensitive before relying on it.
Continue reading
privacy
Clicked on a Phishing Link? Here Is What to Check.
Clicking is rarely the disaster. Typing is. A calm triage for the ten minutes after a phishing click, and how to tell which of the two you actually did.
privacy
Found Moving With You: Cheap Trackers, Hidden Cameras and How to Find Them
Coin-sized trackers and camera-in-a-plug devices are cheap and legal to sell. Your phone now hunts for one of them automatically — here is what it catches and what it misses.
guides
Webroot SecureAnywhere Review 2026: Lightweight AV
An in-depth Webroot SecureAnywhere review for 2026: who this ultra-light cloud antivirus suits, how the rollback engine works, and how it compares.
