Every card in your facility is one of five types. Two of them clone in seconds.

The five types, one at a time

125 kHz proximity — the legacy layer

The beige-and-white workhorse of South African estates, office parks and older factories, retailing locally from around R10. It broadcasts a fixed serial number with no encryption whatsoever, which had an honest logic in 1995 and none today: handheld duplicators that clone one in under ten seconds are consumer products, and key-cutting kiosks copy them as a service. That does not make the technology useless — it makes it an identifier, fine for low-stakes convenience (a gym locker, a time-and-attendance tap where fraud has other controls). It is not a lock, and any door that matters deserves better.

MIFARE Classic — the broken middle

NXP's 13.56 MHz MIFARE Classic became the default "smart" card of the 2000s — transit systems, campuses, thousands of SA sites — because it added memory sectors and a proprietary cipher, Crypto1. That cipher was publicly broken in 2008 and attacks have only industrialised since; cloning tools are open-source. The practical read: a MIFARE Classic estate is not an emergency, but it is a decision already made for you — new issuance should not be Classic, and the migration path matters more than the panic. Classic cards still serve honourably wherever the card is a token rather than a secret: membership, print release, canteen balance backed by a server-side ledger.

MIFARE DESFire EV2/EV3 — the current answer

Same 13.56 MHz band, entirely different security: DESFire runs AES cryptography with mutual authentication — the reader must prove itself to the card before the card says anything meaningful — plus per-application keys, so one card can carry access, payment and identity applications that cannot read each other. There is no practical cloning path. For any new credential deployment where the card guards something, DESFire EV2 or EV3 is the boring, correct choice, and the cost difference per card has shrunk to the point where choosing Classic for a new system needs a justification.

NFC mobile credentials — the card becomes software

Phones carry credentials in a secure element and present them over the same 13.56 MHz interface. The security story is strong — cryptographic credentials, remote revocation the moment a phone is reported lost, no card printing pipeline to manage. The operational story needs honesty: staff without compatible phones, battery-dead phones at 05:00 shift start, and BYOD policy questions mean most sites run mobile alongside cards rather than instead of them. As a second credential for managers and contractors it is excellent; as the sole credential for a 400-person plant it is premature for most SA operations.

UHF cards and windscreen tags — the different question

A UHF "card" on a dashboard is not an access card that grew up; it is a different band (860–960 MHz, EPC Gen2) answering a different question — which vehicle is at my gate, from metres away, without stopping. It has no place on doors (the range that makes it right for vehicles makes it wrong for proving a person is present) and it pairs naturally with the short-range card estate: DESFire for the person at the turnstile, UHF for the vehicle at the boom. Our gate automation page covers that architecture, and our technology comparison maps the full frequency ladder.

The five types side by side

Passive or active — what powers the card

Every card type above is passive RFID: the card has no battery and draws its power from the reader's field, which is why it works for decades, costs rands rather than hundreds of rands, and reads only at the range the physics of its band allows. That trade is the right one for credentials — a card that never dies in a drawer is exactly what an access system wants. Active RFID puts a battery-powered transmitter in the tag: read ranges stretch to tens or hundreds of metres, which is what electronic tolling transponders and some long-range vehicle and rail tags use — at the price of a battery that expires (typically 3–5 years), a much higher unit cost, and a replacement programme forever. Between them sits battery-assisted passive (BAP): the battery boosts the tag's reply for extra range, but the reader still initiates, mostly seen in sensor-carrying tags rather than credentials.

The buying rule is simple: people carry passive, and almost always should — there is no access-control scenario where a personnel card needs a battery. Vehicles at a gate also do fine on passive: a well-designed read point reads a passive on-metal or windscreen tag at 5–8 m, which covers a boom lane without active-tag cost or maintenance. Active earns its place where range genuinely cannot be engineered at the reader side — open-road tolling at highway speed, wide-area yard location — and if a quote proposes active tags for an ordinary gate or door, ask what the battery programme costs in year four.

Form factors and where each one fits

The same chips ship in different bodies, and the body is chosen by the scenario:

• ISO cards — the printable wallet-sized standard. Right wherever the credential doubles as visible ID: staff badges, student and patient cards, membership cards. Printable face, lanyard hole, dies in a back pocket wash.
• Key fobs — the same chip in a moulded teardrop for a keyring. Right for estates, gyms and residential access where nobody prints photos on credentials; harder-wearing than cards and harder to lend with a straight face.
• Wristbands — silicone (reusable: gyms, waterparks, hospitals, lockers) or Tyvek/paper (single-event: festivals, conferences). The scenario logic is hands-free convenience plus wet environments where a card fails; cashless payment at events runs on exactly these.
• Stickers and discs — NFC labels on equipment for tap-to-log inspection rounds, epoxy discs on returnable crates. The credential becomes the object's, not a person's.
• Windscreen tags and hard vehicle tags — UHF, read at metres: residential estates, office parks, weighbridges and automated yard gates. Tamper-evident windscreen versions void themselves if peeled off and moved to another car.
• Wearables and implants for industry — gloves-compatible wristbands and helmet tags where plant rules make pocket cards impractical; the same reasoning as our mining proximity wearables.

Scenario examples that recur in South African operations: time and attendance (card or fob tap creating a payroll record — server-side verification matters more than card cryptography), cashless canteens and vending (DESFire balance or, better, a server-side ledger keyed to the card), hotel keycards (short-lived credentials, cheap cards, revocation at checkout), gym and locker access (wristbands beat cards in wet areas), contractor and visitor management (day-expiry fobs or printed cards), and checkpoint or inspection rounds (NFC stickers on the equipment, the tap proving presence — a scenario that feeds directly into the telemetry layer we build).

How to read your own site

Three quick diagnostics. Look at the frequency: if the card works near old long-read "prox" readers and has no visible chip contact plate, it is likely 125 kHz; a phone with NFC will detect 13.56 MHz cards and often name the type. Ask what the card protects: identifiers are fine for convenience functions, but every security-relevant door on a cloneable card type is carrying risk someone accepted without writing it down. Check the coupling to billing or payroll: where a tap creates money (canteen, time and attendance, fuel), server-side verification matters more than card cryptography — a cloneable card plus a good backend beats a secure card plus blind trust in the tap.

Migrations, for the record, are rarely rip-and-replace: multi-technology readers accept old and new cards simultaneously, so an estate moves over one reissue cycle at ordinary badge-printing cost. The mistake is not running old cards — it is buying new systems on old card types because the quote was marginally cheaper.

Primary sources

• Garcia et al. — "Dismantling MIFARE Classic" (ESORICS 2008) (the original academic break of the Crypto1 cipher)
• CardLogix — NXP MIFARE DESFire EV3 specifications (AES authentication and application architecture)
• ICT — "The 125 kHz proximity card dilemma" (industry account of LF card cloning exposure)
• GS1 — EPC UHF Gen2 air interface protocol (the standard behind UHF vehicle identification)