RFID Cloning – What is It & How It Works

Most businesses today use keycards or key fobs to control access to their facility. These items can be copied–some of them using only a smartphone.

These copies are known as clones because they function exactly like the original card, granting the same access and authorizations.

Today, we’re going to show you how easy it is to make an RFID clone and an NFC clone, talk about the best ways to thwart black hats that are after your cards, as well as touch on what you do when you legitimately need RFID cloning.

RFID Cloning

Are RFID Clones Digital Pickpocketing?

All RFID cards contain a small chip containing data about the cardholder, such as their name, company role, and authorization to enter facilities. These cards use short-range radio waves to send this data to readers, who then use the card as a “key” to open doors.

RFID cloning takes advantage of the fact that these cards will communicate with any reader indiscriminately. Hackers need to have a card reader within reading distance of a card, and they can snag the data loaded on the chip remotely.

Some hacking readers must be within a few inches of a card; others work as far as three feet away.

Have a security project?

This data can then be copied over to a blank card, and the hacker can pose as a legitimate actor and use their RFID copy to go anywhere the real employee can.

Hackers can also plant a skimmer within the reader, which then steals the data from any card read and transmits it to a hacker’s phone or other devices. But installing a reader-skimmer is a bit more difficult, as the hacker needs to crack open the casing of the reader itself.

RFID cloning digital pickpocketing

How RFID Cards Cloning Works

Intercepting Signals: RFID tags transmit data wirelessly using radio frequency signals. You can intercept these signals using specialized tools, such as RFID readers or scanners, to capture the unique identification code transmitted by the legitimate tag.

Extracting Data: Once the signal is captured, attackers extract the data transmitted by the legitimate tags. This typically includes a unique identifier and components such as a serial number or access code used to authenticate and grant access to secured areas or security systems.

Copying Data: You can copy the extracted data using a cloning device or software. This process involves programming the copied fob with the same unique identification code as the original tag, effectively creating an identical copy.

Testing the Clone: After programming the tags, attackers test it to ensure that it functions properly and can successfully bypass security measures. This may involve attempting to access restricted areas or systems using cloned fobs to verify their effectiveness in the security industry. 

How to Clone an NFC Card

An NFC card is a “Near Field Communication” card and communicates a small packet of data–like your employee status and access authorization–to an NFC reader.

It’s very similar to an RFID card, except the range of radio waves is smaller–the access card must be within centimeters of the reader–and the data chip can hold more information than an RFID card.

These can be cloned, but it is more difficult since the card reader needs to be right next to the card, thanks to their short range. 

However, if you have an Android phone, you don’t need a separate reader to do this since Androids are equipped with an NFC reader. Yes, NFC cards can be copied with smartphones.

The Android app, Mifare Classic Tool, can read data from an NFC card, store it in a file, and then write it back onto a blank card or key fob.

clone rfid cards

Addressing RFID Card Security

Leverage other forms of security hardware to protect your premises and gain access control fully. For example, a CCTV camera pointed at your card reader can detect and record tampering by a hacker trying to install a skimmer. Likewise, cameras with a field of vision over the approach to your front door reader can pick up on suspicious behavior, like a person with a bag trying to get within the reading distance of your employees and linger there.

Replace RFID cards with NFC cards. NFC tends to be more secure because they operate at such a short range; they need to be more practical to hack. But if you need the longer range that RFID cards provide, you can still select more secure models.

Use high-frequency cards, which require more powerful equipment to hack. The first generation of RFID cards used low-frequency 125KHz radio waves, which is part of why they are so easy to hack. There are still quite a few of these in use today but invest in RFID cards with a higher frequency of 13.56 MHz for greater security. High-frequency cards need more powerful card readers that hackers must build, not just purchase from Amazon. Adding this layer of difficulty makes them less attractive targets. 

You can also use cards with data encryption. This program “locks” the data on the card’s chip with what is essentially a codeword. Only another reader with the codeword can “unlock” the data and read the chip. Only authorized access cards and readers can transfer info, and unauthorized hacker readers without the codeword will be locked out.

Train employees to treat cards and key fobs with care. Smart cards kept in a secure spot on the employee’s person are less likely to be hacked by a card reader or smartphone. 

Deactivate lost cards immediately. New RFID access control systems allow you to deactivate smart cards remotely, which has obvious benefits if a card is lost or stolen.

Note: Use software that disallows duplicate cards within the system. The true card and its RFID clone form cannot be used simultaneously for your safety.

For more tips, check out our other post on RFID hacking.

white key card rfid sensor detector to open security gate


Can RFID cloning compromise security? 

Cloning of RFID access cards presents a substantial risk to security infrastructure. Permitting unauthorized access to sensitive data or restricted areas can lead to severe consequences, such as data or physical security breaches.

Organizations and individuals relying on RFID technology must be vigilant in implementing robust security measures to mitigate these risks.

Can RFID cloning be detected? 

Yes, cloned access cards can be detected, and these activities hinge on the effectiveness of implemented security measures. Essentially, advanced encryption, authentication protocols, and comprehensive monitoring systems are crucial in identifying unauthorized activity.

Legitimate RFID Copying

Sometimes, you must create an RFID key copy to replace a worn-out card. If what you have is a low-frequency 125KHz, all you need is a handheld card reader, and the steps for this are very easy:

  • Turn on the device and hold a compatible card or fob to the scanner. Click on the “Read” button.
  • The device will beep to indicate that the data is copied.
  • Hold an empty card or fob to the scanner, and click “Write.”
  • The information from the original tag or fob will then be copied onto the blank card of the fob.

To copy access cards, high-frequency NFCs, or RFID cards, you’ll want to talk and communicate with your IT department or the maker of your security equipment. These cards are more secure, and special equipment is needed to copy them properly.

Have a security project?

Do you have a security project?

About Us

Safe and Sound Security is a modern security system installation and low voltage cabling company serving residential and commercial customers for over a decade.

Do you have a
security project?


Are you looking to install a

Commercial Access Control System?

Get in touch with a Commercial Access Control System specialist today!