--- id: CP-086 slug: nfc-rfid-access-badge-cloning lang: en title: NFC and RFID access badge cloning description: A contactless access badge can be copied or relayed without its holder noticing. What is known, what you see and what to do. canonical_url: https://startbrain.io/cyberpedia/en/articles/nfc-rfid-access-badge-cloning/ markdown_url: https://startbrain.io/cyberpedia/en/articles/nfc-rfid-access-badge-cloning.md publisher: Brain (https://startbrain.io) license: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/) cite_as: Brain, "NFC and RFID access badge cloning", Cyberpedia, 2026. https://startbrain.io/cyberpedia/en/articles/nfc-rfid-access-badge-cloning/ (CC BY 4.0) wing: 1 theme: secure_devices reflex: cr-053 schema: G3 updated: "2026-11-03" translations: en: https://startbrain.io/cyberpedia/en/articles/nfc-rfid-access-badge-cloning/ fr: https://startbrain.io/cyberpedia/fr/articles/clonage-badges-acces-nfc-rfid/ de: https://startbrain.io/cyberpedia/de/articles/klonen-zutrittsbadges-nfc-rfid/ es: https://startbrain.io/cyberpedia/es/articles/clonacion-tarjetas-acceso-nfc-rfid/ sources: - "n": 1 title: Multi-Factor Authentication Interception, Technique T1111 - Enterprise | MITRE ATT&CK® publisher: MITRE ATT&CK url: https://attack.mitre.org/techniques/T1111/ accessed: "2026-11-03" - "n": 2 title: Adversary-in-the-Middle, Technique T1557 - Enterprise | MITRE ATT&CK® publisher: MITRE ATT&CK url: https://attack.mitre.org/techniques/T1557/ accessed: "2026-11-03" - "n": 3 title: Hardware Additions, Technique T1200 - Enterprise | MITRE ATT&CK® publisher: MITRE ATT&CK url: https://attack.mitre.org/techniques/T1200/ accessed: "2026-11-03" - "n": 4 title: SP 800-116 Rev. 1, Guidelines for the Use of PIV Credentials in Facility Access | CSRC publisher: NIST url: https://csrc.nist.gov/pubs/sp/800/116/r1/final published: "2018-06-29" accessed: "2026-11-03" --- # NFC and RFID access badge cloning An access badge opens a door, a turnstile or a lift without touching anything. The badge talks to a reader at short range, and in principle a third party can copy or relay that exchange. This entry explains the idea for an employee, and what they can do at their level. A note on method. The sources cited here are general entries on rogue hardware, communication interception and strong authentication, plus a US recommendation on access cards. None of them describes in detail the cloning of 125 kHz badges, the weaknesses of MIFARE Classic, or a public demonstration with Proxmark or Chameleon. These points are therefore not asserted here. ## In 30 seconds - Where it happens: at the entrance to premises and anywhere a badge is presented to a reader. The sources cited here give no specific location for the copying itself. - What the attacker wants: to obtain credentials to access systems, services and network resources [1]. - If it has already happened: report the loss or the doubt without delay to the person in charge of premises security, who can revoke the badge. - The reflex: do not leave a badge unattended, put it away when you are not using it, and report any unknown device plugged in or left near a reader or a network. ## Straight answers ### Can I tell that my badge has been copied? The sources cited here do not say. They describe other cases where the attack goes through an intermediary placed between two devices [2]. The reasoning must therefore be this: the absence of a sign proves nothing. ### Is a recent badge safe? The sources do not establish that any badge model is safe. NIST publishes recommendations for the use of PIV cards, American professional identity cards, in building access control. They rely on a risk-based strategy to choose the appropriate authentication mechanism [4]. The choice of mechanism is therefore made according to the risk of the location, not according to a single rule. ### What should I do if I lose my badge? A MITRE entry recommends, for smart cards, removing them when they are not in use [1]. For a lost badge, reporting it immediately allows the organisation to deactivate it. This last instruction is the organisation's common sense and not from any of the sources cited. ## Inside the attacker's head The MITRE ATT&CK entries describe attackers who target the means of authentication rather than the password alone. The entry on multi-factor authentication interception lists smart cards and code generators among the mechanisms targeted [1]. It specifies that, for a smart card, a keylogger is needed to obtain the associated password during normal use [1]. With the card inserted and this password, the attacker can log in to a resource by routing the authentication through the infected workstation [1]. A similar logic exists for communications: placing oneself between two devices to collect information or act in their place [2]. The idea of a real-time relay between a badge and a remote door belongs to this family of attacks, but the sources cited here do not apply it to access badges. ## What you see on screen For a badge, there is generally no screen. What the sources describe are signs on the network and workstation side for hardware additions: a new external device recognised by the system, followed by processes launched in the same session, or a new network interface that obtains an address [3]. These signs concern IT teams, who look for them in the logs [3]. For an employee, the useful signal is often physical. An unknown box or a small computer plugged into a wall socket: the entry on hardware additions speaks of devices physically connected to the organisation's environment [3]. Such an object is reported, not unplugged by yourself. ## Under the hood The MITRE entry on hardware additions states that accessories, networking hardware or other devices can be physically introduced into a system or network to gain access to it [3]. It adds that public references to use by malicious actors are rare, whereas many authorised intrusion teams use them for initial access [3]. The capabilities cited include passive network listening, traffic modification, keystroke injection and the addition of wireless access points [3]. The adversary-in-the-middle entry describes the principle of the relay: forcing a device to communicate through a system controlled by the attacker to collect information or act [2]. It also cites downgrade attacks, which negotiate a weaker or obsolete version of a protocol or encryption algorithm [2]. For traffic encryption, the same entry recommends making sure that all wired and wireless traffic is properly encrypted [2]. The parallel with old or unencrypted badges is the writer's analogy: it is not established by these sources. On the defence side, the entry on hardware additions recommends blocking unknown devices and accessories through workstation configuration and controlling network access with device certificates and the 802.1x standard [3]. The NIST recommendation, published in June 2018, deals with the choice of authentication mechanisms for PIV cards for building access, according to risk [4]. ## Case files ### DarkVishnya, banks attacked through direct connection (reference dated 6 December 2018) The MITRE entry on hardware additions cites the DarkVishnya group. It physically connected a Bash Bunny, a Raspberry Pi, netbooks and cheap laptops to the targeted organisation's environment, in order to access its local network [3]. The reference publication, by S. Golovanov, is titled « DarkVishnya: Banks attacked through direct connection to local network » and is dated 6 December 2018 [3]. This case does not involve a cloned badge. It shows that a person present on the premises, or who has been able to enter them, can place inexpensive hardware that opens access to the internal network [3]. It is one more reason to watch who comes in and what is plugged in. The sources cited here contain no dated demonstration of HID Prox badge cloning, nor of NFC relay against payment cards or keys. This entry therefore presents none. ## Sources 1. MITRE ATT&CK, "Multi-Factor Authentication Interception, Technique T1111 - Enterprise | MITRE ATT&CK®". https://attack.mitre.org/techniques/T1111/ (accessed 3 November 2026) 2. MITRE ATT&CK, "Adversary-in-the-Middle, Technique T1557 - Enterprise | MITRE ATT&CK®". https://attack.mitre.org/techniques/T1557/ (accessed 3 November 2026) 3. MITRE ATT&CK, "Hardware Additions, Technique T1200 - Enterprise | MITRE ATT&CK®". https://attack.mitre.org/techniques/T1200/ (accessed 3 November 2026) 4. NIST, "SP 800-116 Rev. 1, Guidelines for the Use of PIV Credentials in Facility Access | CSRC", 29 June 2018. https://csrc.nist.gov/pubs/sp/800/116/r1/final (accessed 3 November 2026) --- Original source: Cyberpedia, the public cybersecurity and AI encyclopedia published by Brain. Canonical version: https://startbrain.io/cyberpedia/en/articles/nfc-rfid-access-badge-cloning/ You may reuse this text freely under the CC BY 4.0 license (https://creativecommons.org/licenses/by/4.0/), provided you credit "Brain, Cyberpedia" with a link to the canonical URL above.