Can an access badge be cloned?
It depends entirely on what the reader checks. A system that compares a number returned by the badge can be satisfied by anything returning that number. A system where the badge proves it knows a secret without disclosing it cannot, because there is nothing observable to reproduce.
Two kinds of badge
The distinction that decides everything is not the badge, the frequency or the manufacturer. It is what the reader does with what it receives.
One kind of system reads a value from the badge and compares it against a list. The badge is a name badge: it says who it is and is believed.
The other kind asks a question that only a badge holding a particular secret can answer, without that secret ever being transmitted. The badge proves rather than asserts.
Both feel identical to the person holding them. Both take the same second at the door.
The number kind
A value read from a badge is observable, because the badge returns it to any reader that asks. Anybody who can stand next to the holder for a moment can obtain it.
Whether that value can then be presented by something else is a separate question with an uncomfortable answer: hardware that will present a chosen value exists and is sold openly.
So a system authorising on a number is protected by the difficulty of getting close to a badge, and by nothing else. In an office where badges are worn visibly all day, that is not much protection.
This is not an obscure legacy arrangement. It is common in small installations, in retrofits, and wherever a door controller was chosen on price.
The secret kind
Where the badge answers a challenge using a key it never discloses, observing the exchange gives an attacker a question and an answer that will not be asked again.
There is nothing to copy, because the thing that matters was never transmitted. Reading the badge a thousand times does not accumulate it.
Which chips and which schemes provide this, and what each is called, belongs to the chip documentation rather than to a general guide, and the terminology varies between suppliers.
What matters at the level of a decision is the shape: a badge that proves cannot be reproduced by observation, and a badge that asserts can.
Working out which you have
Ask the supplier one question: does the reader verify a secret held by the badge, or compare a value the badge returns.
A supplier who cannot answer that, or who answers by naming a product rather than a mechanism, has told you something useful anyway.
Look also at what happens when a badge is lost. A system that can revoke one immediately and centrally is a system that was designed with the answer in mind.
And treat the badge number printed on the card as public information, whatever the arrangement, because in the weaker case it is the whole of the secret.
Frequently asked questions
Can any badge be cloned?
No. A badge that proves knowledge of a secret without transmitting it cannot be reproduced by observation. One that returns a number can.
How do I know which kind mine is?
Ask whether the reader verifies a secret or compares a returned value. A supplier who cannot answer has answered anyway.
Does the card being printed with a number matter?
In the weaker arrangement that number may be the whole of the credential, so treat it as public and design accordingly.
Is a phone safer than a badge?
Only if the credential was issued to the phone by the access system. Copying a badge onto a phone is not possible.