RFID Card vs. Smart Card vs. Mobile Credential: Choosing the Right Access Technology

In Bangladesh, you can purchase an RFID card cloner from online marketplaces for less than BDT 200. This device can read the credentials from a standard 125kHz RFID access card from a distance of up to 15 centimetres — without the cardholder being aware. The cloned credential can then be programmed onto a blank card and used to access any door on the same system.

This threat is not theoretical. Access control cards based on 125kHz EM4100 technology — the most common type in Bangladesh's mid-market office and factory sector — offer essentially no cryptographic protection. The card broadcasts its ID in clear text, and any reader can receive it.

Understanding the security hierarchy of access card technologies is not an academic exercise. It determines whether your access control system actually prevents unauthorised entry or merely tracks and records it — an important distinction when the goal is prevention, not post-incident logging.

The Access Card Technology Hierarchy

Access credentials span five generations of technology, each progressively more secure:

125kHz EM4100: The Cloning Vulnerability

EM4100 is the technology used in the majority of low-cost RFID cards and key fobs sold in Bangladesh's security equipment market. These cards broadcast a fixed ID number (typically 32–64 bits) with no encryption or authentication. Any radio receiver tuned to 125kHz can read this broadcast.

The card's ID is the credential. There is no handshake, no challenge-response, and no encryption. The access control reader simply receives the ID and grants or denies access based on a whitelist.

The BDT 200 Cloning Reality

RFID card cloners are commercially available and widely accessible. The cloning process:

1. Hold the cloner near an EM4100 card for 1–2 seconds
2. The cloner reads and stores the card's ID
3. Place a blank EM4100 card in the cloner
4. Press write — the blank card now has the cloned ID
5. The cloned card opens the same doors as the original

This can be done in a crowded lift, at a reception desk, in a restaurant — anywhere the cardholder's card is within 15 centimetres of an attacker with a concealed cloner device.

Recommendation: Do not install new 125kHz EM4100-based access control systems. If you have existing EM4100 systems, plan migration to MIFARE DESFire or mobile credentials within your current budget cycle. The security vulnerability is a fundamental technology limitation that cannot be patched.

13.56MHz MIFARE Classic: The Dominant Bangladesh Standard

MIFARE Classic is the most widely deployed contactless smart card technology globally. It uses a proprietary encryption algorithm called CRYPTO1, operating at 13.56MHz with the ISO 14443A standard.

MIFARE Classic cards have internal memory divided into sectors, each protected by independent keys. Unlike EM4100 cards, MIFARE Classic cards participate in a mutual authentication handshake before transmitting any data.

The MIFARE Classic Vulnerability

CRYPTO1 was broken by security researchers in 2008. While cloning a MIFARE Classic card is significantly more difficult than cloning an EM4100 card (requiring specialised equipment and knowledge, typically costing BDT 5,000–20,000 rather than BDT 200), it is not impossible.

For standard commercial access control in Bangladesh — offices, factories, corporate headquarters where the attacker would need meaningful technical capability and sustained opportunity — MIFARE Classic remains an adequate practical security level for most applications.

For high-security areas — bank vaults, data centre cage access, government facilities, pharmaceutical production areas — MIFARE Classic is not sufficient. Upgrade to MIFARE DESFire.

MIFARE Classic in Practice

MIFARE Classic cards are available in Bangladesh for BDT 50–150 per card (depending on quantity). Most mid-market ZKTeco, Hikvision, and access control systems sold in Bangladesh support MIFARE Classic as their primary smart card technology.

MIFARE DESFire: Banking-Grade Security

MIFARE DESFire (Data Exchange File) is NXP Semiconductor's high-security smart card platform. DESFire EV3 (the current generation) uses AES-128 encryption for all card-to-reader communication and supports mutual authentication between the card and the reader.

Why DESFire Is Significantly Harder to Clone

MIFARE DESFire cards generate a random number during each authentication transaction. The reader must respond correctly using the shared AES-128 key. Even if an attacker captures one complete authentication transaction, the captured data cannot be replayed because the next authentication will have a different random challenge.

Cloning a DESFire card requires knowledge of the sector keys — which are unique per card application, configured during card issuance, and never transmitted in plaintext. Without the keys, a captured card communication provides no useful data to an attacker.

Cost premium: MIFARE DESFire EV3 cards cost BDT 300–600 per card versus BDT 50–150 for MIFARE Classic. For a 200-person organisation, this represents an additional BDT 30,000–90,000 in card costs — a small premium relative to the total system cost for meaningfully higher security.

Bangladesh Bank recommendation: For bank branch access control — particularly for teller area access, ATM replenishment access, and IT room access — MIFARE DESFire is the minimum specification. Bangladesh Bank's ICT Security Guideline's biometric mandate for IT rooms can be complemented by DESFire card access at outer layers.

HID iClass: Proprietary High-Security Cards

HID Global's iClass platform uses a proprietary encryption scheme to protect card credentials. iClass SE and iClass Seos (current generation) use AES-128 encryption and are designed specifically for high-security access control applications.

HID iClass is the dominant high-security card platform in North America and Europe. Its proprietary nature means that only HID-authorised card issuance equipment can write credentials to iClass cards — a deliberate security feature that prevents credential duplication outside authorised channels.

Bangladesh availability: HID iClass systems are available in Bangladesh through authorised integrators. They are specified for multinational corporate headquarters, government facilities, and diplomatic missions requiring international-standard security credentials. Cost is higher than MIFARE DESFire for equivalent security levels.

BLE Mobile Credentials: The Future of Access Control

Bluetooth Low Energy (BLE) mobile credentials use a smartphone as the access credential. Instead of presenting a card, the user either presents their phone to a BLE reader (tap) or the reader automatically detects the phone as it approaches (hands-free).

How Mobile Credentials Work

The mobile credential is a digital certificate stored in the smartphone's secure element or trusted execution environment — a hardware-isolated secure processor that is physically separated from the phone's main processor. The credential cannot be copied from the secure element.

Authentication uses a challenge-response protocol over encrypted BLE. The reader sends a random challenge; the phone signs it using its private key (stored in the secure element); the reader verifies the signature using the corresponding public key. This cryptographic handshake is fundamentally uncloneable — it relies on private keys that never leave the secure element.

Mobile Credential Advantages

No physical card to lose or clone: The credential lives in the phone's secure hardware. It cannot be physically taken from the user in the same way a card can be stolen.

Remote provisioning and revocation: When an employee joins, the credential is sent to their phone over the air — no physical card issuance process. When they leave, the credential is revoked remotely within seconds, even if the phone is off-site.

Anti-tailgating capability: BLE readers can detect multiple phones approaching simultaneously and flag potential tailgating events. Card-based systems cannot do this.

No card management: No card stock, no card printing, no card losses to replace.

Twist and go / hands-free access: Modern BLE readers detect the phone approaching and authenticate automatically — the user does not need to take the phone out of their pocket.

Mobile Credential Limitations

Smartphone dependency: The user must have a charged smartphone. A dead phone means no access. For industrial environments where phones are prohibited on the floor, mobile credentials require complementary solutions.

Initial adoption friction: Some employees resist using their personal phone for work access control. Consider providing a work phone or discussing a BYOD policy.

Reader cost premium: BLE-capable readers cost slightly more than standard card readers — typically BDT 2,000–5,000 per reader more.

Bangladesh Context

Bangladesh's mobile penetration exceeds 95%. Most corporate employees carry Android or iOS smartphones. Mobile credentials are increasingly viable and are specified for new enterprise access control installations in Dhaka's premium office developments.

For factories, mobile credentials are not appropriate for production-floor workers (phones typically prohibited or impractical). Use facial recognition for factory floor workers and mobile credentials for management and administrative staff.

NFC Cards and Mobile Wallets

NFC (Near Field Communication) operates at 13.56MHz — the same frequency as MIFARE cards. Modern Android phones (and iPhone from iPhone 15 onwards) support NFC-based access credentials through mobile wallet applications.

When using NFC credentials via a mobile wallet, the security level is equivalent to a MIFARE DESFire card — the credential is stored in the phone's secure element and authenticated through the same cryptographic protocols. NFC and BLE can coexist on the same reader, allowing both card and phone use with the same reader hardware.

Recommendation Summary for Bangladesh Enterprises

Bangladesh Enterprise Access Technology Recommendations

Low-security areas (gyms, communal spaces, car parks): MIFARE Classic 13.56MHz — adequate security, economical, widely supported.

Standard commercial access control (offices, factories, standard entry points): MIFARE Classic or MIFARE DESFire. Specify DESFire for any new installation where budget allows — the security uplift is significant and card cost premium is modest.

High-security areas (bank vault zones, data centres, pharmaceutical manufacturing, government): MIFARE DESFire EV3 minimum. Consider BLE mobile credentials for management-level access. Complement with biometric for multi-factor authentication.

Bangladesh Bank IT rooms: MIFARE DESFire + biometric (2-factor) to satisfy Bangladesh Bank ICT Security Guideline biometric mandate.

Corporate headquarters with sophisticated threats: BLE mobile credentials for all management staff; MIFARE DESFire for other staff and visitors.

Do not install: New 125kHz EM4100-based systems. Replace existing EM4100 systems as a priority security improvement.

Key Takeaways

• 125kHz EM4100 RFID cards are trivially clonable with BDT 200 equipment — do not install or continue using these for any security-relevant access point
• MIFARE Classic is the current practical standard in Bangladesh — adequate for most commercial applications but not sufficient for high-security zones
• MIFARE DESFire EV3 provides banking-grade AES-128 encrypted credentials at a modest cost premium — specify for all new installations
• BLE mobile credentials eliminate physical credential vulnerabilities entirely — the future direction of enterprise access control
• NFC on smartphones provides MIFARE DESFire-equivalent security when used through a secure mobile wallet application
• Bangladesh Bank IT room compliance requires biometric — complement with DESFire card for a layered, defensible access control design

Ready to Upgrade Your Access Credentials?

SSAL supplies and configures access control systems across Bangladesh using MIFARE DESFire, HID iClass, and BLE mobile credential technologies. Our team assesses your current credential technology and designs a migration path that improves security without disrupting operations.

Contact SSAL for a free access control credential consultation:

• Phone: +880 1799-986890
• Email: info@smartsafety.com.bd
• Web: www.smartsafety.com.bd
• Office: Youth Tower Level 2, 822/2 Rokeya Sarani, Dhaka-1216

Still using 125kHz EM4100 cards at your facility? Request a free cloning vulnerability assessment — our team demonstrates the cloning vulnerability on your actual cards (with your permission) so you can see the risk firsthand and understand the urgency of migrating to secure credentials.