Cyberpediaby Brain
ENDEFR

NFC and RFID access badge cloning

A contactless access badge can be copied or relayed without its holder noticing. What is known, what you see and what to do.

In 30 seconds

Where it happens
At the entrance to premises and anywhere a badge is presented to a reader. The sources cited here give no specific location for the copying itself.
What the attacker wants
To obtain credentials to access systems, services and network resources1.
If it has already happened
Report the loss or the doubt without delay to the person in charge of premises security, who can revoke the badge.
The reflex
Do not leave a badge unattended, put it away when you are not using it, and report any unknown device plugged in or left near a reader or a network.

What it is

An access badge opens a door, a turnstile or a lift without touching anything. The badge talks to a reader at short range, and in principle a third party can copy or relay that exchange. This entry explains the idea for an employee, and what they can do at their level.

A note on method. The sources cited here are general entries on rogue hardware, communication interception and strong authentication, plus a US recommendation on access cards. None of them describes in detail the cloning of 125 kHz badges, the weaknesses of MIFARE Classic, or a public demonstration with Proxmark or Chameleon. These points are therefore not asserted here.

Straight answers

Can I tell that my badge has been copied?

The sources cited here do not say. They describe other cases where the attack goes through an intermediary placed between two devices2. The reasoning must therefore be this: the absence of a sign proves nothing.

Is a recent badge safe?

The sources do not establish that any badge model is safe. NIST publishes recommendations for the use of PIV cards, American professional identity cards, in building access control. They rely on a risk-based strategy to choose the appropriate authentication mechanism4. The choice of mechanism is therefore made according to the risk of the location, not according to a single rule.

What should I do if I lose my badge?

A MITRE entry recommends, for smart cards, removing them when they are not in use1. For a lost badge, reporting it immediately allows the organisation to deactivate it. This last instruction is the organisation's common sense and not from any of the sources cited.

1Inside the attacker's head1 min

The MITRE ATT&CK entries describe attackers who target the means of authentication rather than the password alone. The entry on multi-factor authentication interception lists smart cards and code generators among the mechanisms targeted1. It specifies that, for a smart card, a keylogger is needed to obtain the associated password during normal use1. With the card inserted and this password, the attacker can log in to a resource by routing the authentication through the infected workstation1.

A similar logic exists for communications: placing oneself between two devices to collect information or act in their place2. The idea of a real-time relay between a badge and a remote door belongs to this family of attacks, but the sources cited here do not apply it to access badges.

2What you see on screen1 min

For a badge, there is generally no screen. What the sources describe are signs on the network and workstation side for hardware additions: a new external device recognised by the system, followed by processes launched in the same session, or a new network interface that obtains an address3. These signs concern IT teams, who look for them in the logs3.

For an employee, the useful signal is often physical. An unknown box or a small computer plugged into a wall socket: the entry on hardware additions speaks of devices physically connected to the organisation's environment3. Such an object is reported, not unplugged by yourself.

3Under the hoodIT teams1 min

The MITRE entry on hardware additions states that accessories, networking hardware or other devices can be physically introduced into a system or network to gain access to it3. It adds that public references to use by malicious actors are rare, whereas many authorised intrusion teams use them for initial access3. The capabilities cited include passive network listening, traffic modification, keystroke injection and the addition of wireless access points3.

The adversary-in-the-middle entry describes the principle of the relay: forcing a device to communicate through a system controlled by the attacker to collect information or act2. It also cites downgrade attacks, which negotiate a weaker or obsolete version of a protocol or encryption algorithm2. For traffic encryption, the same entry recommends making sure that all wired and wireless traffic is properly encrypted2. The parallel with old or unencrypted badges is the writer's analogy: it is not established by these sources.

On the defence side, the entry on hardware additions recommends blocking unknown devices and accessories through workstation configuration and controlling network access with device certificates and the 802.1x standard3. The NIST recommendation, published in June 2018, deals with the choice of authentication mechanisms for PIV cards for building access, according to risk4.

4Case filesReal cases1 min

DarkVishnya, banks attacked through direct connection (reference dated 6 December 2018)

The MITRE entry on hardware additions cites the DarkVishnya group. It physically connected a Bash Bunny, a Raspberry Pi, netbooks and cheap laptops to the targeted organisation's environment, in order to access its local network3. The reference publication, by S. Golovanov, is titled « DarkVishnya: Banks attacked through direct connection to local network » and is dated 6 December 20183.

This case does not involve a cloned badge. It shows that a person present on the premises, or who has been able to enter them, can place inexpensive hardware that opens access to the internal network3. It is one more reason to watch who comes in and what is plugged in.

The sources cited here contain no dated demonstration of HID Prox badge cloning, nor of NFC relay against payment cards or keys. This entry therefore presents none.

Fact sheet

Identifier
CP-086
Wing
1. Attacks and techniques
Brain skill
Securing Devices & Mobile (secure_devices)
Brain reflex
cr-053
Diagram
G3 · System & Protocol Anatomy
Languages
de, en, fr
Sources
4 sources checked on 3 November 2026
Sources4 sources
  1. MITRE ATT&CK, “Multi-Factor Authentication Interception, Technique T1111 - Enterprise | MITRE ATT&CK®”. https://attack.mitre.org/techniques/T1111/ (accessed 3 November 2026)
  2. MITRE ATT&CK, “Adversary-in-the-Middle, Technique T1557 - Enterprise | MITRE ATT&CK®”. https://attack.mitre.org/techniques/T1557/ (accessed 3 November 2026)
  3. MITRE ATT&CK, “Hardware Additions, Technique T1200 - Enterprise | MITRE ATT&CK®”. https://attack.mitre.org/techniques/T1200/ (accessed 3 November 2026)
  4. NIST, “SP 800-116 Rev. 1, Guidelines for the Use of PIV Credentials in Facility Access | CSRC”, 29 June 2018. https://csrc.nist.gov/pubs/sp/800/116/r1/final (accessed 3 November 2026)

Cite this article

Brain, “NFC and RFID access badge cloning”, Cyberpedia, 2026. https://startbrain.io/cyberpedia/en/articles/nfc-rfid-access-badge-cloning/

BibTeX 
@misc{brain_cp086_en_2026,
  author = {Brain},
  title = {NFC and RFID access badge cloning},
  year = {2026},
  howpublished = {Cyberpedia},
  url = {https://startbrain.io/cyberpedia/en/articles/nfc-rfid-access-badge-cloning/},
  note = {CC BY 4.0}
}
CC BY 4.0 licence