Physical Security
Smartphone as an access credential: benefits, risks and secure roll-out
With the smartphone as an access credential, there are no more cards to hand out and collect. We explain the methods available, where the risks lie and how to manage them.
Q-entra editorial teamPublished on 6 min read
Contents
- What mobile access is and when it pays off
- Bluetooth, NFC or wallet: the options compared
- The benefits for businesses
- Risks and how to manage them
- Data protection: what to look out for
- Mixed operation with cards, time profiles and visitors
- Checklist for the roll-out
- Conclusion: convenience and security can go together
Key takeaways
- A smartphone can securely replace cards and keys as an access credential if the system uses encryption and is well planned.
- Access rights can be issued, time-limited and revoked instantly from anywhere, without handing out cards.
- Flat batteries, guests and people without a smartphone need a backup credential such as a card or PIN.
- Depending on the settings, a phone may open doors even when locked: losses must be reported and revoked at once, and the app and operating system need regular updates.
- Use private phones only on a voluntary basis and involve data protection and the works council early.
What mobile access is and when it pays off
A smartphone can replace cards and keys as an access credential, provided the system is designed for it. The main benefit is that access rights are issued and revoked remotely, without anyone handing out or collecting cards. What makes it secure is encrypted communication, an active screen lock, a clear process for lost devices and a backup credential for when the battery runs flat.
Technically, the phone stores a digital credential in an app or in the operating system's wallet. When it is held to the reader or brought near the door, phone and reader exchange encrypted data. As with a card, the access control system decides whether the door opens based on the person, the door and the time.
Bluetooth, NFC or wallet: the options compared
Three methods have become established, plus QR codes as a special case for visitors. Many current readers support several of them at once.
| Method | How it works | Typical use |
|---|---|---|
| Bluetooth Low Energy (app) | Adjustable range, from close to the reader up to a few metres; opens with a tap in the app or on approach | Office doors, car parks, barriers |
| NFC (app) | The phone is held directly to the reader, just like a card | Busy doors, familiar routine |
| Wallet badge (NFC) | The badge sits in Apple Wallet or Google Wallet, no app needs to be opened at the door | Employee badges on supported systems |
| QR code | The code is scanned at the reader and is easy to pass on | Visitors with short validity |
Important for planning: not every reader, system or phone supports every method. Wallet badges require explicit support from the access control manufacturer, and on the iPhone, third-party apps were long unable to use NFC as a card replacement. Clarify this before choosing the hardware, not afterwards.
The benefits for businesses
- No cards to hand out: new employees can receive their credential on their phone by invitation, even before their first day.
- Revoke instantly: when someone leaves, the access right is withdrawn centrally. Nobody has to chase a card.
- Time-limited access: tradespeople, cleaning companies or project partners get access only on specific days and to specific doors.
- Extra protection from the device: if the phone must be unlocked with a PIN, fingerprint or face to open a door, access combines possession with knowledge or biometrics. You may know the principle from multi-factor authentication.
- Less admin: no printing, posting or stocktaking of cards, especially across several sites.
Risks and how to manage them
Lost or stolen phone
Do not rely on the screen lock alone after a loss. Depending on the configuration, wallet badges in Express Mode and Bluetooth opening on approach may also work on a locked device. Make it a rule that losses are reported immediately, and decide who then revokes the credential, including at weekends.
On company phones, mobile device management (MDM) can also lock or wipe the device. If you use offline components such as battery-powered lock cylinders, find out how quickly a revocation takes effect there. A new credential for a replacement phone can usually be issued quickly.
Flat battery and no signal
A phone without power opens no doors. Some devices keep wallet badges working for a while after the battery runs flat, but do not rely on that. Plan a backup credential such as a card or PIN. A missing mobile signal, for example in an underground car park, is usually not a problem: the credential is stored on the device and checked on site. Ask your supplier to confirm this.
Encryption, app security and updates
Make sure that communication between phone and reader is encrypted and that the keys are kept in the device's protected storage. Connections between readers, controllers and server belong in their own network segment, for example a VLAN. Relay attacks, in which an attacker secretly extends the radio signal between phone and reader, become harder if the system requires the phone to be unlocked or a deliberate gesture for Bluetooth access. Because security also depends on the operating system, the app should refuse phones whose operating system no longer receives security updates.
Data protection: what to look out for
Access logs are personal data, whether they come from a card or a phone. Decide which data is stored, who may view it and when it is deleted. Also check which data the app itself processes and which permissions it requests. Fingerprint or face recognition on the phone usually stays on the device and is not transmitted to the access control system.
Using employees' private phones is a sensitive point. Offer mobile access as a voluntary option and keep a card or company phone available as an alternative. In Austrian companies with a works council, systems that process employee data often require a works agreement. Clarify the details with your legal adviser and the person responsible for data protection.
Mixed operation with cards, time profiles and visitors
Mobile access rarely replaces cards completely. A proven approach is mixed operation with readers that accept encrypted cards and phones alike. Both credentials are linked to the same person and the same access rights. Time profiles therefore apply regardless of the credential: someone who may enter the warehouse only on weekdays from 7 am to 7 pm cannot get in on a Sunday with their phone either.
For visitors, invitations with tightly limited validity sent by email or app work well. QR codes are convenient but can be shared as a screenshot, so they should only be valid briefly. With a video intercom and its app, you see who is ringing and can open the door remotely. Remote openings should be logged, and access to the app should be protected by a strong login.
Checklist for the roll-out
- Which doors, gates and barriers should be operated by phone, and do the existing readers support this?
- Which methods will be used: Bluetooth, NFC, wallet or a combination?
- What backup credential is there for flat batteries, guests and people without a smartphone?
- Who revokes access rights after a loss or when someone leaves, and how quickly?
- Do wallet badges or Bluetooth also open doors from a locked phone, and is that intended?
- Have logs, retention periods and the use of private devices been clarified from a data protection perspective?
- Do readers, controllers and server run in a secured network segment with current updates?
Conclusion: convenience and security can go together
Using the smartphone as an access credential reduces admin and makes access rights more flexible. Good planning is what makes it secure: encrypted methods, clear processes for losses, a backup credential and a protected network. If you would like to introduce mobile access or modernise an existing system, Q-entra supports you with access control and the right cyber security measures.
This article is for general information only and is not legal advice. For your specific situation, please consult your legal advisor.
