Card Cloning: Why Old Badges Copy in Seconds and Bank Cards Do Not

By NorwegianSpark Editorial · Published August 9, 2026 — written with AI assistance and reviewed by the NorwegianSpark SA editorial team.

Everything in your wallet that opens a door or pays for coffee answers a radio. What separates the items that can be copied from a distance from the items that cannot is not the plastic, the size or the price. It is whether the card performs cryptography or simply recites an identifier.

That distinction is invisible from the outside, which is why the subject generates so much confused advice. It is worth learning once, because the conclusion is reassuring about the item people worry about most and unsettling about the one they never think about.

The card that just says a number

The oldest widely-deployed access credentials operate on the 125 kHz band and are, functionally, a radio barcode. Present the card, it transmits a fixed identifier, the reader checks the identifier against a list. There is no secret, no challenge, no proof of possession. The number is the whole credential.

A credential like that can be copied by anything able to read it and repeat it. It does not require breaking anything, because there is nothing to break — the design simply predates the idea that someone might want to. These cards are still extremely common in older office buildings, gyms, car parks, storage facilities and blocks of flats, and the copying hardware is cheap and sold openly for the entirely legitimate purpose of duplicating your own fob.

If your building fob is a thin white card or a plain plastic tag with no chip visible and no contactless payment logo, it is quite likely in this category. That is not a reason to panic — it is a reason for whoever runs the building to have a plan.

The card that proves itself

The newer generation works on 13.56 MHz and does something fundamentally different: the reader issues a challenge, the card performs a computation using a key that never leaves it, and returns a response. Listening to that exchange does not let you repeat it, because the next challenge will be different. Copying the card would mean extracting the key, and on a modern implementation that is a hardware attack, not a proximity attack.

The important caveat is that "13.56 MHz" is a radio band, not a security level. The most widely deployed early card of this type used a proprietary 48-bit cipher called Crypto1, which was kept secret rather than published for review. In 2008 it was reverse-engineered and broken — the Digital Security group at Radboud University Nijmegen was central to that work, alongside other researchers — and the practical result was that those cards could be cloned in seconds. The manufacturer sought a court injunction to stop publication and lost; a Dutch judge ruled against it in July 2008. The Netherlands ended up replacing a national transit card system.

The lesson is the one security engineering keeps re-teaching: secrecy of the algorithm is not security. Modern successors use published, reviewed ciphers with proper key lengths, and they hold up. But a building that installed cards in 2007 and has not touched the system since is running the broken generation, and the fact that it is "contactless" and "encrypted" in the brochure does not change that.

Your bank card is the safe one

This is the part people get backwards. The contactless payment card in your wallet is among the best-protected items you own.

It does not transmit a copyable secret. Each tap produces a single-use cryptographic value that authorises one transaction and is worthless afterwards. There is a strict low-value limit before a PIN is demanded, transactions are monitored for velocity, and — the part that actually matters — consumer liability for fraudulent card transactions is limited by law in the EEA, the UK and the United States. Even in the failure case, the loss is generally not yours.

So the RFID-blocking wallet industry is selling a solution to a problem your card already solves. It does no harm, and if it makes you comfortable that is a legitimate reason to own one. It is not a security necessity, and it should not be the item you buy after reading an article about card cloning.

The card fraud that actually happens to people is overwhelmingly not proximity-based. It is data stolen in a breach, skimmers physically fitted to a machine, and card details phished or entered on a fraudulent checkout page. What to do after a data breach and phishing are the relevant reading, not this one.

Where the real exposure sits

Ranked honestly by how likely it is to affect you:

• A building or office using 125 kHz fobs. The credential is copyable by design and there is no consumer-side fix. This is a facilities decision.
• A first-generation 13.56 MHz system that was never upgraded. Broken since 2008, still installed in plenty of places.
• Hotel keys. Wide variation, generally not your problem to solve, and generally not the way a hotel room gets entered.
• Passports. These implement access control that requires optically reading the document before the chip will talk, so a chip cannot simply be read from a passing bag.
• Contactless bank cards. Cryptographically sound, liability-limited, and the least of your worries.

What to actually do

• Do not buy the blocking wallet as a security measure. Buy it if you like it.
• If you manage a building, ask which generation is installed. Two questions: what frequency, and whether the credentials are cryptographic. If the answer is 125 kHz, the honest position is that the badge is an identifier rather than a key, and it should be paired with something else — a PIN, a second factor, or a camera on the door.
• Do not lend an access badge. For a copyable credential, "borrowed for ten minutes" and "copied" are the same event.
• Report a lost fob immediately. Deactivation is the only real remedy for a credential that cannot resist copying.
• Keep the fob and the label apart. A copied credential is far more useful when it arrives with the address it opens.

Where this fits

This is the third piece in the cheap-hardware series, after the USB stick that types and evil twin Wi-Fi; the overview is at cheap hacking gadgets explained. The theme repeats: the attack is real, the conditions it needs are narrow, and the thing people buy in response is usually not the thing that helps.