Mobile Credentials vs Keycards for Michigan Offices
When was the last time you checked which keycards still open your front door? If your office runs on the thin white proximity cards most buildings installed 10 or 15 years ago, anyone with a cheap card cloner and three seconds near an employee's pocket can copy one.
That is the quiet reason so many businesses are rethinking door access control right now. The other reason is convenience. HID's State of Physical Access Control report found 39% of organizations already use mobile credentials, and respondents named touchless access (48%) and mobile access (44%) as the top two trends in the industry.
So should your Grand Rapids or West Michigan office move from keycards to phones? Here is a straight comparison of mobile credentials vs keycards, with the costs, risks, and edge cases that matter for a 20 to 100 person business.
The Problem With Old Proximity Keycards
Legacy 125 kHz proximity cards are not secure, and most small businesses still use them.
These "prox" cards broadcast a fixed number with no encryption. A reader asks, the card answers, the door opens. Devices that read and copy them are sold openly online. An attacker can clone a badge in a coffee shop line, then walk into your office after hours.
Newer smart cards using 13.56 MHz technology with encryption (often called high-frequency or "secure" cards) solve most of this. They are much harder to copy. If you keep physical cards, upgrading from prox to encrypted smart cards is the minimum step.
A simple test: look at the back of your badge or ask your installer what format you run. If the answer includes "125 kHz" or "prox," put a card upgrade on your 2027 budget.
How Mobile Credentials Work
A mobile credential is an encrypted digital badge stored on an employee's smartphone or smartwatch that opens doors through Bluetooth or NFC.
The employee installs an app or adds a badge to Apple Wallet or Google Wallet. They tap the phone on the reader, or in some setups simply walk up with the phone in their pocket. The reader checks the encrypted credential against the access control system, and the door unlocks.
Most mobile credential platforms are cloud-managed. An office manager can issue a badge by email, set door schedules, and revoke access from a browser. That remote control is the biggest operational difference from cards.
Mobile Credentials vs Keycards: Side-by-Side
Here is how the three common options compare for a typical Michigan office.
| Factor | 125 kHz Prox Card | Encrypted Smart Card | Mobile Credential | |---|---|---|---| | Clone resistance | Poor | Strong | Strong | | Issue a new badge | Print and hand over | Print and hand over | Send by email or app | | Revoke access | Must collect card or delete in system | Same | Instant, remote | | Lost credential | Common, often unreported | Common, often unreported | Phones get reported fast | | Per-user cost | Card cost each time | Higher card cost | Annual license per user (varies by vendor) | | Works if phone dies | Yes | Yes | Depends on reader and wallet features | | Requires network and cloud | No | Usually no | Yes, for management |
A few takeaways jump out. Mobile credentials win on management and revocation. Encrypted cards win on simplicity and work for anyone, including people without smartphones. Prox cards lose on security and should be retired.
Security Benefits of Mobile Access Control
The main security gain is fast revocation and better identity checks.
When an employee leaves, a mobile credential can be shut off in seconds, from anywhere. Lost keycards often go unreported for days. People notice a missing phone within minutes.
Phones also add a layer of identity protection. Most require a fingerprint, face scan, or PIN to unlock, so a stolen phone is harder to use as a badge than a stolen card. And when your access control system ties into Microsoft Entra ID or Google Workspace, disabling a user's IT account can disable their door access at the same moment. For law firms and accounting firms that must show who could reach client files, that single offboarding step closes a real audit gap. Our pages on cybersecurity for law firms and cybersecurity for accounting firms cover those client-data obligations.
There is a trade-off. Cloud-managed door access makes your doors part of your IT network. Controllers and readers need firmware updates, strong admin passwords, multi-factor authentication on the management portal, and their own network segment. CISA's guidance on securing IoT and operational technology applies directly to door controllers. A door system with default credentials on a flat network is a new way into your business.
When Keycards Still Make Sense
Mobile credentials are not right for every person or every door.
Keep encrypted smart cards available for:
- Employees who do not want company apps on a personal phone
- Shared roles like cleaning crews, temps, and contractors
- Manufacturing floors where phones are not allowed
- Backup access when a phone battery dies
Most modern readers support both cards and phones, so you do not have to choose one. A hybrid setup, mobile for office staff and smart cards for everyone else, is the most common result for West Michigan manufacturers and healthcare practices we work with. For healthcare, door logs that show who entered medication rooms or records areas support HIPAA physical safeguard requirements. See our healthcare cybersecurity page for more.
What a Move to Mobile Access Control Involves
Moving to mobile credentials usually means new readers, a cloud management platform, and a network review.
A typical project for a single-site Michigan office looks like this:
- Audit what you have. Count doors, controllers, reader models, and card formats. Find out who still has active badges.
- Check the reader hardware. Older readers often cannot read phones or encrypted cards. Plan to replace them.
- Review the network. Put door controllers on their own VLAN, require MFA on the admin portal, and confirm internet connectivity at each door controller.
- Plan for fire and life safety. Electric locks must meet fire code and release properly. Your installer should confirm this with local code requirements.
- Roll out in phases. Start with the main entrance and a pilot group, then expand.
- Tie offboarding to IT. Connect access control to your identity system so one action removes both IT and door access.
If you are also upgrading cameras, ask about integration. Linking door events to video clips makes investigations much faster. Our earlier post on cloud door access control for Michigan businesses covers platform selection in more depth.
Frequently Asked Questions About Mobile Credentials and Keycards
Are mobile credentials more secure than keycards?
Mobile credentials are more secure than legacy 125 kHz proximity keycards and comparable to encrypted smart cards, with the added benefit of instant remote revocation and phone-level biometric unlocking. Evolv Technology Solutions recommends retiring prox cards first, then adding mobile credentials where they fit.
Can someone clone my office keycard?
Yes, if your office uses 125 kHz proximity cards, they can be cloned with inexpensive devices sold online. Encrypted 13.56 MHz smart cards and mobile credentials are far harder to copy. Evolv can identify your card format during a free access control review for Grand Rapids and West Michigan businesses.
What happens if an employee's phone dies?
Many mobile credential systems include a power reserve feature that lets the phone open doors for a few hours after the battery dies, depending on phone model and wallet support. Evolv still recommends keeping a small set of encrypted backup cards for every site.
Do employees have to use their personal phones?
No. Employees can use company phones, or you can issue encrypted smart cards to anyone who prefers not to install a work app. Evolv designs most Michigan office deployments as hybrid systems that support both phones and cards on the same readers.
How much does mobile access control cost for a small business?
Cost depends on door count, whether existing readers support mobile credentials, and the platform's per-user or per-door license. Most projects include hardware, installation, and an annual cloud subscription. Evolv Technology Solutions provides itemized quotes after a site walk so you can compare upgrade options side by side.
Find Out What Your Badges Are Really Protecting
If your access control system is more than five years old, there is a good chance your badges can be copied and your offboarding has gaps.
Evolv Technology Solutions designs and manages door access control for Grand Rapids and West Michigan businesses, and we connect it to the IT and security systems you already run. Schedule a free access control review at evolvtechsolutions.com. We will check your card format, door hardware, and network setup, and give you a clear plan for cards, phones, or both.