Every access control system needs a way to identify who’s at the door. For the past two decades, that’s meant a card — typically a proximity card (125 kHz) or a smart card (13.56 MHz). In recent years, mobile credentials — using a smartphone as the credential — have become a viable alternative. Both work. The question is which one solves the right problem for your building.
How Card Credentials Work
A proximity card contains a credential number that’s transmitted to the reader via radio frequency when the card is held near it. The reader sends the number to the access controller, which checks it against the authorized list and unlocks the door if the number matches.
There are two main card technologies:
125 kHz proximity cards are the older standard. They’re inexpensive, widely supported, and work reliably. Their weakness is security: the credential number is transmitted in the clear, and the cards can be cloned with inexpensive equipment. A cloned card is indistinguishable from the original — the system can’t tell the difference.
13.56 MHz smart cards (MIFARE, iCLASS) are the newer standard. They use encryption to protect the credential data, making cloning significantly harder. Smart cards also support multiple credentials on a single card — one sector for door access, another for parking, another for logging into a computer. For most small commercial buildings, the security upgrade over 125 kHz is worth the modest price difference.
How Mobile Credentials Work
A mobile credential replaces the physical card with an app on a smartphone. The phone communicates with the reader via Bluetooth Low Energy (BLE), Near Field Communication (NFC), or both. The app stores the credential securely in the phone’s hardware — on iOS, in the Secure Enclave; on Android, in the hardware-backed keystore.
When the user approaches the door, they tap the reader with the phone (NFC) or the reader detects the phone via BLE and unlocks automatically. The credential data is encrypted and transmitted through a cloud-based management platform, which means credentials can be issued, modified, or revoked from anywhere.
Where Cards Win
Cost. Cards are cheap. A proximity card costs a few dollars. A smart card costs a bit more. A mobile credential license typically costs more per door and per user, and the reader hardware is more expensive. For a building with 4 controlled doors and 30 users, the cost difference is meaningful.
Simplicity. A card works the same way every time. It doesn’t run out of battery. It doesn’t need a software update. It doesn’t depend on a cloud server being available. For a building without on-site IT staff, cards are the lower-maintenance option.
Turnover. When an employee leaves, you collect the card and reissue it. With mobile credentials, you revoke the credential remotely — which is faster, but depends on the management platform being accessible and the revocation propagating correctly. Both work; cards are simpler.
Where Mobile Credentials Win
No lost cards. Cards get lost, left at home, or forgotten in a jacket. People don’t forget their phones. If a phone is lost, the credential is revoked remotely and a new one issued — no physical card to replace.
Remote management. A new employee can be issued a credential before their first day. A contractor can be given time-limited access that expires automatically. A terminated employee’s access is revoked instantly. This is the strongest argument for mobile credentials in buildings with frequent turnover or contractor access.
Audit trail. Mobile credential systems typically log every access event with more detail than card-based systems — not just who and when, but through which cloud management portal. For buildings that need detailed access reporting for compliance, mobile systems make reporting easier.
Multi-door and multi-site. If a property manager oversees multiple buildings, mobile credentials can be managed centrally — one platform, one user database, all doors. Card-based systems can do this too, but the management overhead grows faster.
The Hybrid Approach
Most access control readers on the market now support both card and mobile credentials simultaneously. A building can issue cards to most users (low cost, simplicity) and mobile credentials to managers or contractors (remote management, no physical card to lose). The reader handles both — there’s no need to choose one technology and commit exclusively.
For a small commercial building — 2 to 8 controlled doors, 10 to 50 users — the practical recommendation is a multi-technology reader that supports 13.56 MHz smart cards and BLE mobile credentials. Issue cards as the default. Add mobile credentials for users who need remote provisioning or who regularly forget their card. Both methods run on the same controller and the same audit trail.
What Doesn’t Matter (But Gets Talked About)
The “card vs mobile” debate often gets framed as a security question. It isn’t — or at least, it’s not the security question that matters most. The security of an access control system depends far more on the controller, the electric strike or lock, the door hardware, and the management policies (how credentials are issued and revoked) than on whether the credential is a card or a phone. A well-managed 125 kHz system is more secure than a poorly managed mobile system.
What Pro Locksmith Does
Pro Locksmith LLC designs and installs access control systems for small commercial buildings throughout Broward County and Miami-Dade, including Fort Lauderdale, Hollywood, Pembroke Pines, Davie, Pompano Beach, Coral Springs, and Miami. We specify multi-technology readers that support both card and mobile credentials, paired with listed electric strikes or magnetic locks and mechanical lock backup. The company is licensed and insured, with a certificate of insurance provided for commercial property managers. Flat-rate pricing is quoted up front. Employees, not subcontractors.
For an access control evaluation of your building, call Pro Locksmith LLC at (954) 406-8266.
Sources
- ANSI/BHMA A156.31, Electric Strikes
- ADA Standards for Accessible Design, Section 404