More organisations are moving away from traditional plastic access cards and using smartphones as secure digital credentials.

For staff and visitors, the attraction is obvious.

Most people already carry their phone everywhere. There is no separate card to remember, lose or replace.

For facilities and security teams, however, the bigger benefits are often behind the scenes.

Mobile credentials can make access rights easier to issue, manage and revoke, while reducing the administrative burden associated with physical access cards.

But they are not a complete security solution on their own.

They work best as part of a properly designed door entry and access control system, supported by the right physical infrastructure and operating procedures.

What is a mobile credential?

A mobile credential allows a smartphone or other compatible device to act as the user’s access token.

Instead of presenting a plastic card or key fob to a reader, the user presents their phone.

Depending on the system, communication may take place through technologies such as Bluetooth or NFC.

The underlying principle is straightforward.

The access control system verifies the credential and determines whether that individual has permission to enter.

The physical card has simply been replaced by a digital credential.

Why are organisations moving away from cards?

Plastic cards have served businesses well for many years.

They are simple, familiar and relatively inexpensive.

But they create administrative work.

Cards need to be ordered, issued, collected, replaced and sometimes physically returned when somebody leaves the organisation.

They are also easily forgotten.

A member of staff arriving without their access card can create work for reception, security or facilities teams.

People are generally far less likely to leave home without their smartphone.

That makes mobile credentials attractive from both a user and management perspective.

Faster credential management

One of the strongest arguments for mobile access is how quickly credentials can be managed.

A traditional card may need to be physically prepared and handed to the user.

A mobile credential can often be issued electronically.

That can be particularly valuable where organisations have:

• multiple offices
• remote workers
• temporary staff
• contractors
• frequent visitors
• changing access requirements

If somebody no longer requires access, their credential can be revoked centrally.

The organisation does not necessarily need to recover a physical card first.

That can make access management faster and more controlled.

Lost credentials become easier to manage

Lost access cards create two problems.

There is the inconvenience of replacing the card.

There is also the security question of whether somebody else could use it.

Mobile credentials do not eliminate that risk completely, but modern smartphones already include security controls such as PINs, biometrics and device locking.

If a phone is lost or stolen, the access credential can also be withdrawn through the access-control platform.

That provides another layer of control compared with an unprotected plastic card.

The exact security available will depend on the chosen system and how it is configured.

What about tailgating?

This is where the marketing around mobile credentials sometimes goes too far.

Replacing plastic cards with smartphones does not automatically stop tailgating.

Tailgating happens when an unauthorised person follows an authorised person through a controlled door without presenting their own credential.

Whether the legitimate user opens the door with a card, a phone or a fingerprint does not fundamentally change that behaviour.

Mobile credentials can improve credential control.

They can make it harder for cards to be casually shared and can give organisations better visibility over who has been issued access.

But preventing tailgating usually requires a combination of measures.

That may include:

• appropriate door and entrance design
• staff awareness
• reception procedures
• CCTV coverage
• turnstiles or speed gates
• anti-passback rules
• security personnel
• monitoring and alerting

A well-designed access-control project therefore needs to consider how people actually move through the building.

Technology alone does not solve every physical security problem.

Better control for contractors

Temporary access can be one of the most useful applications.

Many organisations regularly provide access to cleaners, engineers, contractors or visiting staff.

With a traditional system, that may involve preparing temporary cards and making sure they are returned.

Mobile credentials can simplify the process.

A credential may be issued for a defined period and configured to provide access only to the areas required.

For example, an engineer visiting on Tuesday might receive access to a plant room and communications area between 9am and 2pm.

Once that period has expired, the credential no longer provides access.

That can be cleaner and easier to audit than circulating generic visitor cards.

A better user experience

Access control should improve security without making the building unnecessarily difficult to use.

Mobile credentials can help here.

People already understand how to use smartphones.

Presenting a phone to a reader can therefore feel natural and familiar.

This can be especially useful in modern offices, shared workspaces and sites with high numbers of regular users.

Some systems can also make the interaction quicker by allowing credentials to work without requiring users to manually open an application every time they reach a door.

The exact experience depends on the technology chosen.

Access control is becoming part of the wider network

Modern access-control systems are increasingly connected systems.

Controllers, readers and management platforms may rely on the organisation’s network infrastructure.

That means the quality of the underlying structured cabling becomes important.

The same applies to other building-security systems.

CCTV, wireless infrastructure and access control increasingly operate alongside one another rather than as completely independent technologies.

For example, an access-control event can be supported by footage from a nearby CCTV system.

That can help security teams understand what actually happened rather than simply seeing that a credential was presented.

Mobile does not mean cloud-only

Another misconception is that mobile access automatically requires the whole access-control system to be cloud based.

That is not necessarily the case.

Different systems use different architectures.

Some rely heavily on cloud management.

Others retain significant control locally while using cloud services for particular functions.

There are also hybrid approaches.

The correct design should depend on the organisation’s security requirements, resilience expectations, number of sites and management needs.

The technology should fit the operating environment rather than forcing the organisation to change simply to accommodate the technology.

What happens if a phone battery dies?

This is one of the first practical questions people ask.

And it is a sensible one.

No access-control system should ignore real-world behaviour.

Phones run out of battery.

Devices get replaced.

People forget them.

A properly planned deployment should therefore consider how exceptions will be handled.

That might include physical credentials for particular users, reception processes, alternative authentication methods or other fallback arrangements.

The objective is not necessarily to remove every plastic card from the organisation overnight.

For some sites, running mobile and physical credentials together may be the most sensible approach.

What about visitors?

Mobile credentials can work particularly well for pre-registered visitors.

Instead of arriving at reception and waiting for a temporary pass to be created, a visitor may be able to receive a credential before they arrive.

That can potentially improve the reception experience while still providing controlled access.

However, visitor access needs careful consideration.

A visitor should not automatically receive the same access as an employee.

Credentials should be restricted to the correct areas and valid only for an appropriate period.

Good access control is fundamentally about providing the right person with the right level of access at the right time.

The type of credential is only part of that process.

When does mobile access make sense?

Mobile credentials can be particularly attractive where organisations have:

• large numbers of employees
• several offices or buildings
• frequent starters and leavers
• regular contractors
• high volumes of visitors
• centralised facilities teams
• a need to change access rights quickly

For a small site with a handful of users and very little change, traditional cards may continue to work perfectly well.

There is no benefit in replacing a system simply because newer technology exists.

The question should always be whether the change solves a real problem.

Plan the door before choosing the credential

It is easy to focus on cards versus smartphones.

But the credential is only one component of the access-control system.

The complete solution also needs to consider:

• doors and locking hardware
• readers
• controllers
• network infrastructure
• power
• fire and emergency requirements
• CCTV integration
• visitor management
• access permissions
• reporting and auditing
• resilience
• future expansion

That is why TCNS Cabling approaches door entry and access control as an infrastructure project rather than simply supplying readers.

The technology needs to work properly with the building.

A useful evolution, not a magic fix

Mobile credentials can provide genuine benefits.

They can reduce the administration associated with physical cards, make temporary access easier to manage and provide users with a convenient way to enter controlled areas.

They can also form part of a more modern, centrally managed security environment.

But replacing a card with a smartphone does not solve poor door design, weak access policies or tailgating.

Those issues require proper security planning.

For organisations reviewing an existing access-control system, the best starting point is therefore not:

“Can we use phones instead of cards?”

It is:

“How should access to this building be managed?”

Once that has been answered, mobile credentials may form a very useful part of the solution.