Can NFC tags and access cards be cloned?

Some can, and some can’t in any practical sense. The answer depends on the chip family and on how the deployment uses it. Two cards that look identical in the hand can behave very differently under a reader.

Easy to copy

• Tags where the system only reads the unique ID and trusts it
• Older card families with known weaknesses in their security scheme
• Tags left unlocked, so anyone with a phone can rewrite the content

Harder to copy

• Chips that use mutual authentication with keys the reader checks
• Systems that verify a signature or a server-side record, not just the ID
• Deployments that use unique keys per card rather than one shared key

What an audit looks for

We note the chip type on a sample of cards, what the reader actually checks, and whether default keys are still in use. A strong chip configured with a default key is not a strong system.

This is general information, not a security certification. See the full tag audit checklist or read how to lock NFC tags.

All questions