Every access control system needs a way to identify who’s at the door. For the past two decades, that’s meant a card, typically a proximity card (125 kHz) or a smart card (13.56 MHz). In recent years, mobile credentials, using a smartphone as the credential, have become a viable alternative. Both work. The question is which one solves the right problem for your building.
How Card Credentials Work
A proximity card contains a credential number that’s transmitted to the reader via radio frequency when the card is held near it. The reader sends the number to the access controller, which checks it against the authorized list and unlocks the door if the number matches.
There are two main card technologies:
125 kHz proximity cards are the older standard. They’re inexpensive, widely supported, and work reliably. Their weakness is security: the credential number is transmitted in the clear, and the cards can be cloned with inexpensive equipment. A cloned card is indistinguishable from the original, the system can’t tell the difference.
13.56 MHz smart cards (MIFARE, iCLASS) are the newer standard. They use encryption to protect the credential data, making cloning significantly harder. Smart cards also support multiple credentials on a single card, one sector for door access, another for parking, another for logging into a computer. For most small commercial buildings, the security upgrade over 125 kHz is worth the modest price difference.
How Mobile Credentials Work
A mobile credential replaces the physical card with an app on a smartphone. The phone communicates with the reader via Bluetooth Low Energy (BLE), Near Field Communication (NFC), or both. The app stores the credential securely in the phone’s hardware, on iOS, in the Secure Enclave; on Android, in the hardware-backed keystore.
When the user approaches the door, they tap the reader with the phone (NFC) or the reader detects the phone via BLE and unlocks automatically. The credential data is encrypted and transmitted through a cloud-based management platform, which means credentials can be issued, modified, or revoked from anywhere.
Where Cards Win
Cost. Cards are cheap. A proximity card costs a few dollars. A smart card costs a bit more. A mobile credential license typically costs more per door and per user, and the reader hardware is more expensive. For a building with 4 controlled doors and 30 users, the cost difference is meaningful.
Simplicity. A card works the same way every time. It doesn’t run out of battery. It doesn’t need a software update. It doesn’t depend on a cloud server being available. For a building without on-site IT staff, cards are the lower-maintenance option.
Turnover. When an employee leaves, you collect the card and reissue it. With mobile credentials, you revoke the credential remotely, which is faster, but depends on the management platform being accessible and the revocation propagating correctly. Both work; cards are simpler.
Where Mobile Credentials Win
No lost cards. Cards get lost, left at home, or forgotten in a jacket. People don’t forget their phones. If a phone is lost, the credential is revoked remotely and a new one issued, no physical card to replace.
Remote management. A new employee can be issued a credential before their first day. A contractor can be given time-limited access that expires automatically. A terminated employee’s access is revoked instantly. This is the strongest argument for mobile credentials in buildings with frequent turnover or contractor access.
Audit trail. Mobile credential systems typically log every access event with more detail than card-based systems, not just who and when, but through which cloud management portal. For buildings that need detailed access reporting for compliance, mobile systems make reporting easier.
Multi-door and multi-site. If a property manager oversees multiple buildings, mobile credentials can be managed centrally, one platform, one user database, all doors. Card-based systems can do this too, but the management overhead grows faster.
The Hybrid Approach
Most access control readers on the market now support both card and mobile credentials simultaneously. A building can issue cards to most users (low cost, simplicity) and mobile credentials to managers or contractors (remote management, no physical card to lose). The reader handles both, there’s no need to choose one technology and commit exclusively.
For a small commercial building, 2 to 8 controlled doors, 10 to 50 users, the practical recommendation is a multi-technology reader that supports 13.56 MHz smart cards and BLE mobile credentials. Issue cards as the default. Add mobile credentials for users who need remote provisioning or who regularly forget their card. Both methods run on the same controller and the same audit trail.
What Doesn’t Matter (But Gets Talked About)
The “card vs mobile” debate often gets framed as a security question. It isn’t, or at least, it’s not the security question that matters most. The security of an access control system depends far more on the controller, the electric strike or lock, the door hardware, and the management policies (how credentials are issued and revoked) than on whether the credential is a card or a phone. A well-managed 125 kHz system is more secure than a poorly managed mobile system.
What Pro Locksmith Does
Pro Locksmith LLC designs and installs access control systems for small commercial buildings throughout Broward County and Miami-Dade, including Fort Lauderdale, Hollywood, Pembroke Pines, Davie, Pompano Beach, Coral Springs, and Miami. We specify multi-technology readers that support both card and mobile credentials, paired with listed electric strikes or magnetic locks and mechanical lock backup. The company is licensed and insured, with a certificate of insurance provided for commercial property managers. Flat-rate pricing is quoted up front. Employees, not subcontractors.
For an access control evaluation of your building, call Pro Locksmith LLC at (954) 406-8266.
Sources
- ANSI/BHMA A156.31, Electric Strikes
- ADA Standards for Accessible Design, Section 404
The Parts of an Access-Controlled Door
The credential gets most of the attention, but it is only one piece of an access-controlled door. Whether you choose cards, phones or both, the same set of components has to work together at every opening:
- Reader. Mounted next to the door, it reads the card or phone and passes the credential to the controller.
- Controller. The brain of the system. It holds or checks the list of authorized users and schedules, decides whether to unlock, and records the event.
- Electrified locking hardware. An electric strike, an electrified lever set, an electrified exit device or a magnetic lock that actually releases the door.
- Request-to-exit device. Tells the system that someone is leaving from the inside, so it does not record a forced door. On some doors it also releases the lock.
- Door position switch. Reports whether the door is actually closed, which lets the system detect doors propped open or forced.
- Power supply with battery backup. Keeps the locks and controller running during a short power interruption.
A reader that works perfectly with a weak strike, a misaligned frame or a door that does not close fully will still give you an unsecured door. That is why the door hardware side of the project deserves as much attention as the credential choice.
Fail-Safe or Fail-Secure
Every electrified lock has to be set up to do something when power is lost. Fail-safe hardware unlocks without power. Fail-secure hardware stays locked without power but still allows exit from the inside through the mechanical handle or push bar.
For most perimeter doors on small commercial buildings, fail-secure electric strikes or electrified exit devices are the common choice, because the building stays locked during an outage while people can still leave. Magnetic locks are inherently fail-safe, since they hold only while powered. They are useful in certain situations, but they come with specific life safety requirements for egress, such as sensors and manual release buttons and connection to the fire alarm, that vary by the type of occupancy and the local authority having jurisdiction. Any maglock plan should be checked against local fire code requirements before installation.
In South Florida, where summer storms and hurricane season can knock out power for hours or longer, it is worth asking how long the battery backup will actually last and what happens at each door when it runs out.
What Happens Between the Reader and the Controller
There is a security detail that rarely comes up in the card-versus-phone conversation: the wiring from the reader to the controller. Many older systems use the Wiegand protocol for this connection. Wiegand is simple and universal, but the data travels without encryption. Someone with access to the wires behind a reader can, in principle, capture or replay credential data regardless of how secure the card itself is.
OSDP, the Open Supervised Device Protocol, is a newer standard that supports an encrypted secure channel between reader and controller, and it also lets the controller detect when a reader has been disconnected or tampered with. If you are upgrading from 125 kHz cards to smart cards or mobile credentials to improve security, it makes sense to ask whether the readers and controller can use OSDP as well. Otherwise, the upgraded credential may be protected at the card but exposed in the wall.
Moving from Old Prox Cards to a Newer System
Many small buildings in Broward already have a 125 kHz system that works fine but is aging. Replacing everything at once is not always necessary. A common migration path looks like this:
- Replace readers with multi-technology readers that read both the old prox cards and the new smart cards or phones.
- Issue new credentials to users gradually, during normal onboarding or in small groups.
- Once every active user has a new credential, disable the old 125 kHz format in the readers or in the controller.
This approach avoids a single changeover day when everyone needs a new card at once, and it lets the building find and fix any problem doors before the old cards stop working. The key step people forget is the last one. If the old card format is never turned off, the building keeps the cloning weakness it was trying to eliminate.
Onboarding and Offboarding Workflow
Whatever credential you choose, the system is only as good as the process for adding and removing people. For a small office, retail space or warehouse, write down a simple procedure that answers these questions:
- Who is allowed to issue new credentials, and who approves them?
- What access schedule does each role get? A cleaning crew and a store manager should not have the same hours or doors.
- Who removes access when someone leaves, and how quickly after their last day?
- How are lost cards or lost phones reported, and who revokes them?
- How often is the user list reviewed for people who no longer need access?
Mobile credentials make some of these steps faster, since invitations and revocations can happen remotely. Cards make other steps simpler, since a card handed back at the front desk is clearly out of circulation. Either way, a quarterly review of the user list catches most of the stale accounts that accumulate over time.
Questions to Ask About Phones in the Workplace
Mobile credentials raise practical questions that cards do not. Think through them before you commit:
- Personal phones. Are employees willing to install a work app on their own phones? Some will not be, and some may not have compatible phones. Plan to keep cards available for them.
- Dead batteries. Some phones can present a wallet-based credential for a limited period after the phone shuts down from a low battery, but this depends on the phone and the platform. It is safer to assume a dead phone means no credential and to have a backup method, such as a card, a PIN or a mechanical key held by a manager.
- Phone replacements. When someone gets a new phone, the credential usually has to be reissued. Make sure users know the process so they are not stuck outside on the first day with a new device.
- Shared devices. Warehouses and retail stores sometimes use shared handhelds. A mobile credential should be tied to a person, not a shared device, or the audit trail loses its meaning.
Keep a Mechanical Override
Every access-controlled door should have a mechanical way in for authorized people when electronics fail. That is usually a key cylinder in the lever set or exit device trim. The keys for that cylinder should be restricted to a small number of managers and should not be the same key used on ordinary interior doors. A restricted or patented keyway is a good choice here, because it limits unauthorized duplication of the one key that can bypass the whole system.
Adding a PIN for Sensitive Doors
For server closets, cash rooms, pharmacy storage or records rooms, a single credential may not be enough. Many readers include a keypad that can require a card or phone plus a PIN. A lost card or unlocked phone alone will not open the door. For most small buildings, requiring a second factor only on a few high-value doors keeps the system easy to use while adding protection where it counts.
Cloud-Managed or On-Site Controller
Mobile credential platforms are usually cloud managed, but cards can run on either a cloud-based or an on-site system. With a cloud system, the property manager can make changes from anywhere, and software updates happen automatically. With an on-site system, the building does not depend on an internet connection to manage users, but someone has to maintain the server or software. Most modern cloud controllers keep a local copy of the user list so doors keep working during an internet outage; confirm this for any system you are considering.
Visitors, Vendors and Delivery Drivers
Employees are only part of the traffic at a small commercial building. Cleaning crews, HVAC technicians, landscapers, couriers and temporary staff all need access at some point, and how you handle them affects the credential decision.
With cards, the usual approach is a small pool of temporary cards kept at the front desk or in a manager’s office, each assigned a limited schedule and signed out by name. The weakness is that temporary cards tend to wander off, and a card that was never returned stays active until someone notices. With mobile credentials, a vendor can receive a time-limited invitation that expires on its own, which removes the need to track a physical card. The weakness is that the vendor has to install an app, which not every contractor is willing to do for a single visit.
For a building with a handful of regular vendors, a mix often works best: mobile credentials for recurring contractors who visit weekly, and supervised entry or a short-term card for one-time visitors.
Warehouses, Retail and Offices Have Different Needs
The right credential depends on the building type as much as on its size.
- Warehouses. Workers often wear gloves, carry equipment and move between the dock, the floor and the office. Cards on a lanyard or clip are easy to present with gloves on. Readers at dock doors and yard gates also need to handle heat, dust and rain, so outdoor-rated readers matter more here than the credential type.
- Retail stores. Access control is usually limited to the back door, the stockroom and the office or cash room. Staff turnover can be high, which favors a system where access can be removed quickly and a credential that is inexpensive to replace.
- Office buildings. Tenants may want to control their own suites while the landlord controls the lobby, stairwells and garage. A platform that supports separate administrators for different areas keeps each party in charge of its own doors without sharing a single user list.
A Short Checklist Before You Decide
- Count the doors that actually need control, and list who needs access to each.
- Check the condition of each door, frame and closer. Fix alignment problems before adding electrified hardware.
- Decide on fail-safe or fail-secure for each opening and confirm egress requirements.
- Choose readers that support the credential types you want now and later.
- Ask about OSDP and encrypted smart card formats.
- Write the onboarding and offboarding procedure before the system goes live.
- Keep a mechanical override with tightly controlled keys.