What distinguishes an access badge from a data tag?
Everything above the radio layer. A data tag hands its content to anyone who asks and can be written by anyone with a phone. An access badge answers a challenge, holds keys it never reveals, and belongs to a system that issued it.
The differences, side by side
| Property | Data tag | Access badge |
|---|---|---|
| Content | Readable by anyone | Protected by keys |
| Writable | By any phone | Only with the keys |
| Proves itself | No | Yes, by challenge |
| Issued by | Anyone | A managed process |
| Read by a phone | Fully | Identifier only |
| Cost per unit | Cents | Substantially more |
The last row explains why the confusion persists. The two objects look identical and one costs a fraction of the other.
What a phone sees
Presented with a data tag, a phone reads everything: the chip, the tag type, the identifier and the content.
Presented with an access badge, a phone typically reports the identifier and the underlying technology, and nothing useful beyond it. The protected areas require keys the phone does not have.
That is a quick and useful test. A card that reveals nothing but its identifier is doing something a data tag does not.
It does not prove the system is well designed, only that the card has protected content. What the reader actually checks is a separate question.
The awkward middle ground
Some widely deployed access cards use proprietary schemes built above the standard radio layer, and several of those schemes have been publicly analysed and found weak.
They are still in service in enormous numbers, because access systems are replaced on a decade scale and a working door is rarely a priority.
A card of that kind is neither a plain data tag nor a modern credential. It has protection that no longer counts as protection.
Two such families have been analysed in the open literature. MIFARE Classic was broken in Dismantling MIFARE Classic, published by Garcia and colleagues in 2008, and HID iCLASS in Dismantling iCLASS and iCLASS Elite by the same group in 2012. Naming them is not a judgement on the supplier: it is the reason a card bought a decade ago should be checked rather than trusted.
Telling which you have
Read a card with a phone and note what comes back. Full readable content points at a data tag, and an identifier alone points at something protected.
Ask the integrator what the reader verifies: a number compared against a list, or a cryptographic challenge. That answer matters more than the card.
Look at the age of the installation. Systems installed long ago frequently use schemes nobody would specify today.
And do not assume that an expensive looking card is a modern one. Appearance and packaging tell you nothing about what is inside.
Frequently asked questions
Why does my phone only show a number for my work badge?
Because the rest is protected by keys your phone does not have. That is the expected behaviour for an access card.
Are all access cards secure?
No. Some widely deployed proprietary schemes have been publicly analysed and found weak, and they remain in service in large numbers.
Can I tell the difference by looking?
No. The two objects are indistinguishable by appearance, which is why reading one with a phone is the quick test.
Does a protected card mean a secure system?
Not by itself. What the reader actually verifies is the deciding factor, and that is a question for the integrator.