Can Android emulate a card without a secure element?
Yes, through host card emulation, where an application answers the terminal directly instead of a dedicated chip doing it. What it does not give you is the trust a secure element provides, which is why it does not simply replace a physical badge.
How it works
A terminal produces the field and addresses what it believes is a card. Instead of a dedicated chip answering, the request is routed to an application on the phone, which composes the reply.
Android documents this through its host card emulation service, which an application implements to receive and answer those requests.
The phone is therefore behaving as a card while the logic lives in ordinary software rather than in tamper resistant hardware.
What it makes possible
Loyalty and membership credentials, where the value of forging one is low and the convenience of not issuing plastic is high.
Ticketing and event access, where a credential is short lived and validated against a server.
Building access in systems designed for it, where the operator controls both the phone software and the readers.
Prototyping and internal tools, where a phone replaces a card reader test rig.
What it does not give you
A secure element is tamper resistant hardware holding keys that never leave it. That is what lets a bank trust a phone with a payment credential.
Host card emulation puts the logic in an application, so the security depends on the phone's software integrity rather than on dedicated hardware.
For a system that has to resist a determined attacker with the device in hand, that is a meaningful difference rather than a technicality.
Which is why payment credentials are handled through the secure element path and not simply implemented as an application.
The access badge question
People ask whether a phone can replace an access badge, and the honest answer is that it depends on the system rather than on the phone.
A reader that checks a credential against a server can accept a phone. A reader that expects a specific card technology, or that authenticates against the card's own hardware, generally cannot.
Many legacy access systems fall in the second group, and no amount of phone capability changes them.
So the question to put to the system integrator is what their readers actually verify, not whether phones support emulation.
Frequently asked questions
Can my phone copy my building badge?
Usually not. Most access systems check something the badge holds in hardware, and emulating that is not what host card emulation offers.
Is host card emulation secure?
Its security rests on the phone's software rather than on tamper resistant hardware, which is adequate for many uses and not for all.
Why do payments not use it?
Payment credentials are held in a secure element the issuer trusts. That trust is a hardware property rather than a software one.
Does iOS offer the same thing?
iOS handles card emulation through its own framework and its own rules, which are narrower than the Android equivalent.